evidencectl access client add command reference
Add one local client and generate its private key.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.46.0 and catalog SHA-256 d43b1bf418e0b00fac52311fa3a106fa124512dbc88cf511475713af2d73aa47. Hidden implementation commands are omitted.
evidencectl access client add [OPTIONS] --access-profile <ACCESS_PROFILE> --generate-local-key <CLIENT>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
--grant-bootstrap-resource <GRANT_BOOTSTRAP_RESOURCE> is present | --grant-bootstrap-scope <GRANT_BOOTSTRAP_SCOPE> is required. |
--first-party-bootstrap-scope <FIRST_PARTY_BOOTSTRAP_SCOPE> is present | All of --first-party-bootstrap-resource <FIRST_PARTY_BOOTSTRAP_RESOURCE>, --first-party-issuer <FIRST_PARTY_ISSUER> are required. |
--first-party-bootstrap-resource <FIRST_PARTY_BOOTSTRAP_RESOURCE> is present | All of --first-party-issuer <FIRST_PARTY_ISSUER>, --first-party-bootstrap-scope <FIRST_PARTY_BOOTSTRAP_SCOPE> are required. |
--first-party-issuer <FIRST_PARTY_ISSUER> is present | All of --first-party-bootstrap-resource <FIRST_PARTY_BOOTSTRAP_RESOURCE>, --first-party-bootstrap-scope <FIRST_PARTY_BOOTSTRAP_SCOPE> are required. |
| Command invocation | --first-party-bootstrap-scope <FIRST_PARTY_BOOTSTRAP_SCOPE> and --grant-bootstrap-scope <GRANT_BOOTSTRAP_SCOPE> cannot be used together. |
Arguments
Section titled “Arguments”| Argument | Always required | Default | Values | Environment | Description |
|---|---|---|---|---|---|
<CLIENT> | Yes | n/a | n/a | n/a | Lowercase client identifier |
Options
Section titled “Options”| Option | Always required | Repeatable | Default | Values | Environment | Description |
|---|---|---|---|---|---|---|
--access-profile <ACCESS_PROFILE> | Yes | Yes | n/a | n/a | n/a | Existing target access profile assigned to this client. Repeat for disjoint grants |
--evidence-audience <EVIDENCE_AUDIENCE> | No | No | n/a | n/a | n/a | Audience inside every selected definition ceiling. Inferred when exactly one fits |
--actor-kind <ACTOR_KIND> | No | No | n/a | human, agent, service | n/a | Actor permitted by the selected profiles. Inferred when exactly one fits |
--generate-local-key | Yes | No | n/a | n/a | n/a | Generate an owner-only P-256 key for local client authentication |
--grant-bootstrap-scope <GRANT_BOOTSTRAP_SCOPE> | No | No | n/a | n/a | n/a | Use institutional task exchange with this one bootstrap scope |
--grant-bootstrap-resource <GRANT_BOOTSTRAP_RESOURCE> | No | No | n/a | n/a | n/a | Bootstrap resource audience. Omit to use the shared issuer owner’s default |
--first-party-bootstrap-scope <FIRST_PARTY_BOOTSTRAP_SCOPE> | No | No | n/a | n/a | n/a | Use a signed first-party context with this one bootstrap scope |
--first-party-bootstrap-resource <FIRST_PARTY_BOOTSTRAP_RESOURCE> | No | No | n/a | n/a | n/a | Exact resource for the first-party bootstrap credential |
--first-party-issuer <FIRST_PARTY_ISSUER> | No | No | n/a | n/a | n/a | Exact trusted issuer of the signed first-party context |
--format <FORMAT> | No | No | human | human, json, junit | n/a | Emit the selected command’s report in this format. junit is accepted only by test and fixtures run |
-h, --help | No | No | n/a | n/a | n/a | Print help |
Generation contract
Section titled “Generation contract”After changing a public command, argument, option, default, environment binding, or help description, run cargo run --locked -p registry-cli-docs -- --write, commit crates/registry-cli-docs/catalog.json, then run npm run generate from docs/site.