opschain admin authz review-export

Included from Basic tier

The access-review entitlement export: who can do what, where. One run captures five tables:

• grants — every rule × policy × principal combination: policy, rule, path, specificity, the principal (username, group name, or everyone) and the four action booleans. A user grant is one row per assignment and is per-identity: the row's user_id names the exact account it grants — a same-named account of another provider holds no part of it (see opschain docs identity).
• users — every account with its auth provider, superuser and blocked standing (standing follows the per-identity assignments, so only the assigned account of a same-named pair is flagged).
• system_assignments — the system policy assignments.
• api_tokens and runner_registration_tokens — the credential inventories: every live API key and session of the native lane (the same inventory opschain tokens list answers from), plus the runner registration tokens. Token VALUES are never read — the database stores hashes — so the export carries owners, descriptions, use counts and expiries only.

Like convert-report, it reads the database directly — no server or login — but only the PostgreSQL store qualifies: the review reads the adopted authorisation tables.

Flags

Flag	Meaning
--store <dsn>	Required. A postgres:// (or postgresql://) DSN over the adopted authorisation tables.
--format <fmt>	json (default): one document. csv: one file per table.
--out <path>	For json: an output file (stdout when omitted). For csv: the output directory, required. Files are created exclusively — an existing file of the same name fails the export rather than being overwritten.

Exit codes

• 0 — export written.
• 1 — a non-PostgreSQL store, a database failure, or an unwritable/existing output file.
• 2 — usage: --store missing, an invalid --format, or csv without --out.

Named errors

• the access review reads the adopted authorisation tables: --store must be a postgres:// DSN — exits 1.
• invalid --format "<fmt>" (must be json or csv) — exits 2.
• --format csv requires --out <directory> — exits 2.

Examples

JSON document to stdout (fields: generated_at, grants, users, system_assignments, api_tokens, runner_registration_tokens):

opschain admin authz review-export --store postgres://opschain@db/opschain

CSV tables for a spreadsheet-driven review:

opschain admin authz review-export --store postgres://opschain@db/opschain --format csv --out ./review
wrote grants, users, system_assignments, api_tokens and runner_registration_tokens CSVs to ./review

See also

• opschain docs cli/admin-authz-convert-report — the rule-path conversion report.
• opschain docs cli/admin-authz-policies — acting on what the review finds.