opschain admin trust reject

packs:agentspacks:agent-governance

opschain admin trust reject <grant-id> [--server <url>] [--auth-token <token>]

The human deny path for agent proposals (the v2 TrustService.RejectTrustGrant verb), disambiguated by the grant's state exactly like approve:

• A pending grant (an agent's proposal) is refused — it moves to revoked without ever having activated or compiled.
• An active grant carrying a pending revoke has the revoke cleared — the grant stays active and keeps compiling, as if the proposal had not been made (the rejection is still audited).

Anything else — an ordinary active grant, a revoked one, an unknown id — answers 404: there is nothing pending to reject.

<grant-id> comes from opschain admin trust list (pending rows show status: pending; pending revokes show revoke_proposed_by).

Flags

Flag	Meaning
--server <url>	Server base URL. Default: the active context, then OPSCHAIN_SERVER.
--auth-token <token>	Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server.

Output

Always a machine document (JSON unless -o yaml) with the grant's id and its resulting status — revoked for a refused proposal, active for a cleared revoke.

Exit codes

Code	Meaning
0	The pending change was refused/cleared.
1	The server refused or failed the request (nothing pending, rejected admin token).
2	Usage — wrong arguments, or no server / admin token resolvable.

Named errors

• no pending trust grant or pending revoke with that id — 404, exit 1.
• a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — exit 2.
• this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' — exit 2.
• the server rejected the credential — run 'opschain login' again, or check the admin token — exit 1.

See also

• opschain docs cli/admin-trust-approve — the accept path for the same pending rows.
• opschain docs cli/admin-trust-list — find what is pending.