skarbiec credential acquire

Invocation#

skarbiec credential acquire <item-id> --consumer <consumer> [--purpose <text>] [--signup-origin <https-origin>] --as <caller> --token-file <path>
# canonical-host mode
skarbiec credential acquire [<item-id>] --provider <provider> --consumer <consumer> [--account <email>] [--signup-origin <https-origin>] [--dry-run] --local

Purpose#

Start a persisted provider workflow for a credential that does not yet exist.

Required inputs and options#

• Remote mode requires item, consumer, caller, and token file. Local mode requires provider and consumer; a generic provider may supply the omitted item id from its slug. Purpose, account, expectations, signup origin, and dry-run are bounded options where supported.

Output and state effects#

• Records the request before Weles runs; completed provider verification creates a managed encrypted item, while queued/approval/configuration outcomes remain explicit operation state.

Refusals#

• Refuses a conflicting unmanaged item, invalid generic signup origin, provider/field/directory mismatch, quarantine, unsupported flags/trajectory, or a managed write whose captured origin differs. A present pending-request item that cannot be decrypted or decoded refuses lifecycle admission with its item id and underlying cause; it is never treated as a missing request. Its canonical value must be an object: a readable scalar, array or null is malformed, not an empty operation. The same rule applies to role acquisition resolution: an unreadable retained request cannot authorize a replacement acquisition. Managed item API role resolution, acquisition tagging and staged baseline lookup preserve these failures in an explicit HTTP conflict response before mutation; managed-write authorization failures retain their causal error rather than closing the connection silently. An absent request alone skips the retained retry and pending-operation checks. The isolated real CLI journey tests/credential/unreadable_request.sh covers missing and non-object canonical values for direct and role acquisition, names the retained request, and checks encrypted request and complete item-map preservation; supply SKARBIEC and SKARBIEC_TEST_SOURCE_REVISION.