CLI reference / service / grant

stado service grant

Invocation

stado service grant <COMMAND>

Purpose

The Skarbiec grants this service's consumers hold: show the declared ones, mint them, or reconcile one with an existing token file

Required inputs and options

This command has no command-specific inputs or options.

Output and state effect

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Refusals

• Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

Subcommands

• show — The grants this service's consumers declare, as minting would issue them; mints nothing
• mint — Mint every grant this service's consumers declare, through the same path `grant sync` uses, so a product's credential need is written where the service is declared instead of remembered as flags. A grant declared for Stado's own consumer is not minted, because a mint replaces every capability Stado holds: each `read:<item>#<field>` it names is added to that grant on the vault owner, keeping the bearer in the declared token file there; any capability other than a read is refused for that row
• sync — Reconcile one Skarbiec consumer grant with an existing owner-only token file