Enum OrgSubcommand 

pub enum OrgSubcommand {
    Create {
        name: String,
        key: Option<String>,
        metadata_file: Option<PathBuf>,
    },
    Attest {
        subject_did: String,
        payload_file: PathBuf,
        note: Option<String>,
        expires_at: Option<String>,
        key: Option<String>,
    },
    Revoke {
        subject_did: String,
        note: Option<String>,
        key: Option<String>,
    },
    Show {
        subject_did: String,
        include_revoked: bool,
    },
    List {
        include_revoked: bool,
    },
    AddMember {
        org: String,
        member_did: String,
        role: CliRole,
        capabilities: Option<Vec<Capability>>,
        key: Option<String>,
        note: Option<String>,
    },
    RevokeMember {
        org: String,
        member_did: String,
        note: Option<String>,
        key: Option<String>,
        dry_run: bool,
    },
    ListMembers {
        org: String,
        include_revoked: bool,
    },
    Audit {
        org: String,
        member_did: String,
        artifact: Option<PathBuf>,
        signed_at: Option<u128>,
        json: bool,
    },
    OffboardingLog {
        org: String,
        member_did: Option<String>,
        json: bool,
    },
    Bundle {
        org: String,
        out: PathBuf,
    },
    Join {
        code: String,
        registry: Option<String>,
    },
    Policy {
        action: PolicyAction,
    },
    AnchorOidcPolicy {
        org: String,
        file: PathBuf,
        key: Option<String>,
    },
    Metrics {
        org: String,
        json: bool,
    },
    Trace {
        commit: Option<String>,
        member: Option<String>,
        signed_at: Option<u128>,
        json: bool,
    },
}

Subcommands for managing authorizations issued by this identity.

Variants

Create

Create a new organization identity

Fields

name: String

Organization name

key: Option<String>

Alias for the local signing key (auto-generated if not provided)

metadata_file: Option<PathBuf>

Optional metadata file (if provided, merged with org metadata)

Attest

Fields

subject_did: String

payload_file: PathBuf

note: Option<String>

expires_at: Option<String>

key: Option<String>

Revoke

Fields

subject_did: String

note: Option<String>

key: Option<String>

Show

Fields

subject_did: String

include_revoked: bool

List

Fields

include_revoked: bool

AddMember

Add a member to an organization

Fields

org: String

Organization identity ID

member_did: String

Member identity ID to add

role: CliRole

Role to assign (admin, member, readonly)

capabilities: Option<Vec<Capability>>

Override default capabilities (comma-separated)

key: Option<String>

Alias of the signing key in keychain

note: Option<String>

Optional note for the authorization

RevokeMember

Revoke a member from an organization

Fields

org: String

Organization identity ID

member_did: String

Member identity ID to revoke

note: Option<String>

Reason for revocation

key: Option<String>

Alias of the signing key in keychain

dry_run: bool

Preview actions without making changes.

ListMembers

List members of an organization

Fields

org: String

Organization identity ID

include_revoked: bool

Include revoked members

Audit

Classify a member’s authority at an artifact’s signing position (by KEL position)

Fields

org: String

Organization identity ID

member_did: String

Member identity ID to classify

artifact: Option<PathBuf>

Artifact path (shown in the report for context)

signed_at: Option<u128>

The artifact’s in-band signing KEL position (e.g. a commit’s Auths-Anchor-Seq)

json: bool

Emit the typed verdict as JSON

OffboardingLog

List durable off-boarding records for an organization

Fields

org: String

Organization identity ID

member_did: Option<String>

Restrict to a single member

json: bool

Emit the records as JSON

Bundle

Produce a self-contained, air-gapped provenance bundle for an organization

Fields

org: String

Organization identity ID

out: PathBuf

Output path for the bundle file

Join

Join an organization using an invite code

Fields

code: String

Invite code (e.g. from auths org join --code C23BD59F)

registry: Option<String>

Registry URL to contact

Policy

Manage the org-wide authorization policy (anchored on the org KEL)

Fields

action: PolicyAction

Policy action (set/show)

AnchorOidcPolicy

Anchor the org’s OIDC-subject policy on its KEL (who may sign keylessly). Verifiers resolve it with auths artifact verify --oidc-policy-did <org-did> — the witnessed log is the policy’s source of truth, not a pinned file.

Fields

org: String

Organization identity ID

file: PathBuf

Path to the OIDC-subject policy JSON (issuer + repository, optional workflow_ref)

key: Option<String>

Org signing key alias (defaults to the org slug alias)

Metrics

Show fleet governance metrics for an organization

Fields

org: String

Organization identity ID

json: bool

Emit the metrics as JSON

Trace

Trace an agent’s delegation chain to the authorizing root + live-at-signing

Fields

commit: Option<String>

A signed commit SHA — traces its signer (Auths-Device) at its anchor-seq

member: Option<String>

A member/agent identity ID to trace directly

signed_at: Option<u128>

The in-band signing KEL position (used with --member; --commit reads it from the commit’s Auths-Anchor-Seq trailer)

json: bool

Emit the chain as JSON

Trait Implementations

impl Clone for OrgSubcommand

fn clone(&self) -> OrgSubcommand

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OrgSubcommand

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for OrgSubcommand

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for OrgSubcommand

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand