opschain admin trust list

packs:agentspacks:agent-governance

opschain admin trust list [--server <url>] [--auth-token <token>]

Lists every trust grant (the v2 TrustService.ListTrustGrants read) — the full history: active grants (the only ones compiled into the trust snapshot), pending agent proposals awaiting opschain admin trust approve, and revoked grants kept as audit artifacts. An active grant carrying a pending revoke proposal additionally shows revoke_proposed_by / revoke_proposed_at while it stays active.

Each grant renders with its id (what approve, reject and revoke take), subject (subject_kind, subject_id, and subject_values for attribute selectors), scope, actions, tier, approvers, act_as, status, note, and the granted_by/granted_at — plus approved_by/approved_at and revoked_by/revoked_at where those transitions happened.

Flags

Flag	Meaning
--server <url>	Server base URL. Default: the active context, then OPSCHAIN_SERVER.
--auth-token <token>	Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server.
--filter <column>[!]=<value>	Keep only rows matching the term (repeatable; terms AND). Columns are the printed table headers lowercased (spaces/dashes fold to _); * wildcards match the whole cell case-insensitively, != negates, commas mean any-of. Applied client-side. Grammar: opschain docs cli.

Output

The default -o table renders one row per grant:

ID       SUBJECT                     SCOPE           TIER        ACTIONS   ACT AS  STATUS  GRANTED BY
grant-1  service_account:sa-doctor   /projects/acme  supervised  deploy_*  -       active  admin

-o json|yaml prints the raw listing document ({"grants": […]}) with every field, including the ones the table drops (approvers, note, the timestamps and the approved/revoked attributions).

Exit codes

Code	Meaning
0	The grants were printed.
1	The server refused or failed the request (including a rejected admin token).
2	Usage — unexpected arguments, or no server / admin token resolvable.

Named errors

• a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — exit 2.
• this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' — exit 2.
• the server rejected the credential — run 'opschain login' again, or check the admin token — exit 1.

See also

• opschain docs cli/admin-trust-grant — write a grant.
• opschain docs cli/admin-trust-approve / opschain docs cli/admin-trust-reject — settle the pending rows.
• opschain docs cli/admin-trust-revoke — revoke an active grant.