Skip to content

permissions command group

permissions provides read-only access to the ADMIN-scope permission catalog in {{ product_name }}. Use it to discover the permission identifiers that drive grant and role management.

The permissions command family is a remote gRPC client group. Every command reaches the {{ product_name }} server, so before you run it you must:

  1. Create a host profile with profile hosts create.
  2. Authenticate with profile authn login.

Select a specific host profile for one-shot use with the global -p/--profile option (default default-admin), placed before the command path.

Commands in this group

Command Purpose
permissions search Search the read-only ADMIN-scope permission catalog

Group help

bin/admin.sh permissions --help

Search the read-only permission catalog available to the ADMIN scope. With no query term, the full ADMIN-plane catalog is returned. Results are paged and can be matched with different search modes.

Syntax

bin/admin.sh permissions search [options]

Required options

This command has no command-specific required options.

Optional options

Show optional options
Option Default Description
-q, --query none Query string. When omitted or blank, the full ADMIN-scope catalog is returned
-m, --query-mode QUERY_MODE_ILIKE Query match mode: QUERY_MODE_WEB, QUERY_MODE_PLAIN, or QUERY_MODE_ILIKE
-n, --query-page-number 1 Start page (the first page is page number 1)
-s, --query-page-size 50 Page size (minimum 1, maximum 250)
-f, --out-format YAML Output format: JSON or YAML

Validation rules

  • --query-mode must be one of QUERY_MODE_WEB, QUERY_MODE_PLAIN, or QUERY_MODE_ILIKE.
  • --query-page-number is 1-based; the first page is page 1.
  • --query-page-size is clamped to the inclusive range 1-250.
  • A blank or omitted --query returns the full ADMIN-scope catalog.

Example (full catalog, YAML)

bin/admin.sh permissions search

Example (search term with paging, JSON)

bin/admin.sh permissions search \
  -q certificate \
  -m QUERY_MODE_ILIKE \
  -n 1 \
  -s 100 \
  -f json

Example (explicit host profile)

bin/admin.sh -p prod-admin permissions search -q sign -f yaml

Standard CLI options are documented in Global options.

FAQ

Do I need to log in before running permissions search?

Yes. permissions search is a remote gRPC call, so you must first create a host profile with profile hosts create and authenticate with profile authn login.

What happens if I omit the --query option?

The full ADMIN-scope permission catalog is returned. A blank or missing --query is treated as no filter.

Can permissions search change any permissions or grants?

No. The permissions command group is read-only. It only queries the ADMIN-scope catalog to help you discover permission identifiers.