📣
TiDB Cloud Premium is now in public preview. Unlimited growth, instant elasticity, advanced security for enterprise workloads. Try it out →
​
Sign InStart for Free
AI
Developer
Best Practices
API
​
Sign InStart for Free

ti fs-vault create-grant

Creates a time-limited delegated grant for one agent and scope.

Syntax

ti fs-vault create-grant
  --agent-id <string>
  --permission <string>
  --scope <string>
  --ttl <duration>
  [--dry-run]
  [--file-system-id <string>]
  [--fs-token <string>]
  [--help]
  [--label-hint <string>]
  [--token-only]
  [--version]

Options

  • --agent-id <string>: Agent ID for the delegated grant. [required]
  • --permission <string>: Grant permission: read or write. For the current permission behavior, see Grant permissions. [required]
  • --scope <string>: Secret scope in the form <secret-name> for all fields or <secret-name>/<field-name> for one field; repeatable. The equivalent canonical Vault paths /n/vault/<secret-name> and /n/vault/<secret-name>/<field-name> are also accepted. [required]
  • --ttl <duration>: Grant time to live, for example, 1h. [required]
  • --dry-run: Validate the request without applying changes.
  • --file-system-id <string>: Select the file system. You can also set TI_FS_FILE_SYSTEM_ID.
  • --fs-token <string>: Set the Filesystem token. If omitted, the command uses the TI_FS_TOKEN environment variable. If neither is provided, the command uses the local token stored for the selected Filesystem.
  • --help: Display help information.
  • --label-hint <string>: Optional grant label hint.
  • --token-only: Print only the delegated bearer token.
  • --version: Display version information.

For options shared by all commands, see Global options.

Grant permissions

PermissionCurrent ti behavior
readAllows delegated list-secrets, read-secret, run-with-secret, and mount-vault operations within the grant scopes.
writeThe service accepts this permission, but it does not include read authority. The current ti command surface does not expose an operation that writes a secret with a delegated token.

Examples

  • Create a temporary read grant:

    # Limit an agent to one secret field for ten minutes.
ti fs-vault create-grant --file-system-id <file-system-id> --agent-id deploy-agent --scope db-prod/DB_URL --permission read --ttl 10m

  • Return only the delegated token:

    # Produce token-only output for injection into an isolated CI job.
ti fs-vault create-grant --file-system-id <file-system-id> --agent-id ci-agent --scope api-dev/TOKEN --permission read --ttl 5m --token-only

Was this page helpful?