authservicecentral ctl grants create

Create a resource-scoped role grant for a principal or group through POST /v1/manage/grants. The management token requires the configured grants.write permission, conventionally management.grants.write.

See the ctl overview for common flags and subject-selection rules.

Usage

authservicecentral ctl [common flags] grants create \
  (--principal-source SOURCE --principal-subject SUBJECT | --group GROUP_ID) \
  --role ROLE --resource-type TYPE --resource-id ID \
  [--id ID] [--create-resource-if-missing]

Flags

Flag	Required	Default	Description
--principal-source SOURCE	conditional	none	Configured token-source identity prefix for a principal grantee. Requires --principal-subject.
--principal-subject SUBJECT	conditional	none	External subject identifier for a principal grantee. Requires --principal-source.
--group GROUP_ID	conditional	none	Existing group grantee. Mutually exclusive with principal flags.
--role ROLE	yes	none	YAML-defined role with a permission applicable to the target resource type.
--resource-type TYPE	yes	none	Type of the grant’s target resource.
--resource-id ID	yes	none	ID of the grant’s target resource.
--id ID	no	generated by the service	Stable grant identifier. Supplying one supports deterministic retries.
--create-resource-if-missing	no	false	Ask the service to create a missing eligible application resource before granting.

Exactly one complete subject form is required. Implicit resource creation is limited to parentless application resource types with no required relationships; audiences and groups must be created through their dedicated APIs. Semantically identical retries return the existing grant.

Example

authservicecentral ctl --token-file ./management.jwt grants create \
  --principal-source corporate \
  --principal-subject alice \
  --role editor \
  --resource-type document \
  --resource-id report-123

The default table contains ID, SUBJECT, ROLE, and RESOURCE.