opschain security roles list

Included from Basic tier

Lists the local-lane security-role grant rows (global security administrators, auditors and superusers). Mapped grants — provider groups mapped to a role — are listed on their identity provider's group mappings instead. TARGET is user or group; ORIGIN is manual for a grant a person made, else the securing prefix the upgrade converted it from ((widened) when the conversion widened it to the enclosing project); REVIEW is the converted grant's review-queue state.

opschain security roles list
ROLE                    TARGET  PRINCIPAL           SCOPE   ORIGIN                                                    REVIEW     ID
security_administrator  user    alice               global  manual                                                    -          019a...
security_administrator  user    bob                 web     securing_prefix /projects/web/environments/dev (widened)  pending    019a...
security_administrator  group   ldap:policy-admins  global  securing_prefix (global)                                  confirmed  019a...
auditor                 user    carol               global  manual                                                    -          019a...

-o, --output json|yaml emits the grant rows as a machine document.

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--filter <column>[!]=<value>	Keep only rows matching the term (repeatable; terms AND). Columns are the printed table headers lowercased; * wildcards match the whole cell case-insensitively, != negates, commas mean any-of. Applied client-side. Grammar: opschain docs cli.

See also

• opschain docs cli/security-roles-grant
• opschain docs cli/security-roles-revoke
• opschain docs cli/security-roles-review