Service Identity Onboard

goodmem service-identity onboard

Create a service identity, grants, and a scoped API key

Synopsis

Create one service identity, give it the requested direct grants, and issue a SCOPED API key with an identical immutable ceiling. The command uses separate RPCs; completed steps remain durable if a later step fails, and generated UUIDs make every result inspectable.

goodmem service-identity onboard [flags]

Examples

  goodmem service-identity onboard \
    --display-name prod-search \
    --grant READ_SPACE:EXACT:SPACE:70e025f6-76ca-4cbe-b8fc-7dab8e84590a \
    --grant READ_MEMORY:DIRECT_MEMBERS_OF:SPACE:70e025f6-76ca-4cbe-b8fc-7dab8e84590a

Options

      --api-key-id string     Optional client-provided API-key UUID
      --description string    Optional workload description
  -n, --display-name string   Unique operator-facing name
      --expires-at string     Optional RFC3339 exclusive expiration
  -f, --format string         Output format: table, json, compact, quiet (default "table")
      --grant strings         Granted rule OPERATION:SELECTOR[:RESOURCE_KIND:RESOURCE_UUID] (repeatable)
      --grant-id strings      Optional client UUID for each --grant, in the same order (repeatable)
  -h, --help                  help for onboard
      --id string             Optional client-provided service-identity UUID
      --key-label strings     API-key label key=value (repeatable)
  -l, --label strings         Service-identity label key=value (repeatable)
  -q, --quiet                 Output only the one-time raw API key
      --valid-from string     Optional RFC3339 inclusive validity start

Options inherited from parent commands

      --api-key string   API key for authentication (can also be set via GOODMEM_API_KEY environment variable)
      --server string    GoodMem server address (gRPC API)