# Giving support access with keenauth support-access-grants

`keenauth support-access-grants` manages the time-limited access you give to KeenAuth support staff for one environment. A grant has a scope, a duration of 1 to 72 hours and the reference of your support ticket. It is never edited; you can only revoke it. Every use of a grant by staff is written to the environment audit log.

## Who can give access

Creating and revoking a grant needs a `keenauth login` session of a dashboard user with the `owner` or `admin` role, and a step-up confirmation within the last 300 seconds. An API key or a machine client gets `403 insufficient_permissions`; the CLI prints the error and exits with code 3. Listing and reading grants only needs the `support-access-grants:read` permission.

## Commands

```sh
keenauth support-access-grants list --status active
keenauth support-access-grants get sag_01j9z3k4m5n6p7q8r9s0t1v2w3
keenauth support-access-grants create --data @grant.json
keenauth support-access-grants delete sag_01j9z3k4m5n6p7q8r9s0t1v2w3 --yes
```

`create` reads the request body from `--data` (`@file.json`, or `-` for standard input):

```json
{
  "scope": "read",
  "duration_hours": 24,
  "ticket_ref": "SUP-1234",
  "allowed_regions_of_staff": ["eu"]
}
```

| Field | Description |
|---|---|
| `scope` | `read` (read only) or `read_write_config` (configuration changes; staff never write user data). |
| `duration_hours` | 1 to 72. |
| `ticket_ref` | Your support ticket reference: 1 to 200 printable ASCII characters, no leading or trailing space. |
| `allowed_regions_of_staff` | Optional, Enterprise plan only: `eu`, `us`. Limits access to staff located in these regions. |

`delete` revokes the grant before it expires. It asks for confirmation; without a terminal you must pass `--yes`, otherwise the command exits with code 2. Revoking a grant that is already revoked or expired changes nothing and succeeds.

See the API reference for [create](/docs/api/management/support-access-grants/create) and [delete](/docs/api/management/support-access-grants/delete).