stado credentials grant rebind
Invocation
stado credentials grant rebind [OPTIONS] --host <HOST> --token-file <TOKEN_FILE>Purpose
Bind the stado grant back to the bearer file the fleet holds, when that file no longer opens it: same capabilities, audience and expiry. The recovery for every credential read answering "consumer not authorized to read item field" after the owner's grant record and the fleet's bearer file diverged. Refused when the file already opens the grant; verified after.
Required inputs and options
| Input or option | Contract |
|---|---|
--host <HOST> | The host that owns the vault |
--token-file <TOKEN_FILE> | The stado bearer file on that host (absolute path) |
--json | Command option; required or optional as shown in the invocation. |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.