CLI command
skarbiec acquisition-request
Verify a workload's signed proof and issue a short-lived, one-use capability for one exact field.
Invocation#
skarbiec acquisition-request <consumer> <item> <field> --workload-id <id> --workload-timestamp <epoch> --workload-nonce <nonce> --workload-signature <hex>Purpose#
Verify a workload's signed proof and issue a short-lived, one-use capability for one exact field.
Required inputs and options#
- Requires consumer, item, field, workload id, integer epoch timestamp, nonce, and Ed25519 signature matching the registered workload public key.
Output and state effects#
- On success prints the opaque token and expiry and appends acquisition-issued without logging the token or value.
Refusals#
- Returns { ok: false, error: unauthorized } for absent/expired grants, scope mismatch, stale proof, replayed nonce, or invalid signature; malformed required inputs are rejected.