Giving support access with keenauth support-access-grants
keenauth support-access-grants manages the time-limited access you give to KeenAuth support staff for one environment. A grant has a scope, a duration of 1 to 72 hours and the reference of your support ticket. It is never edited; you can only revoke it. Every use of a grant by staff is written to the environment audit log.
Who can give access
Creating and revoking a grant needs a keenauth login session of a dashboard user with the owner or admin role, and a step-up confirmation within the last 300 seconds. An API key or a machine client gets 403 insufficient_permissions; the CLI prints the error and exits with code 3. Listing and reading grants only needs the support-access-grants:read permission.
Commands
keenauth support-access-grants list --status active
keenauth support-access-grants get sag_01j9z3k4m5n6p7q8r9s0t1v2w3
keenauth support-access-grants create --data @grant.json
keenauth support-access-grants delete sag_01j9z3k4m5n6p7q8r9s0t1v2w3 --yes
create reads the request body from --data (@file.json, or - for standard input):
{
"scope": "read",
"duration_hours": 24,
"ticket_ref": "SUP-1234",
"allowed_regions_of_staff": ["eu"]
}
| Field | Description |
|---|---|
scope |
read (read only) or read_write_config (configuration changes; staff never write user data). |
duration_hours |
1 to 72. |
ticket_ref |
Your support ticket reference: 1 to 200 printable ASCII characters, no leading or trailing space. |
allowed_regions_of_staff |
Optional, Enterprise plan only: eu, us. Limits access to staff located in these regions. |
delete revokes the grant before it expires. It asks for confirmation; without a terminal you must pass --yes, otherwise the command exits with code 2. Revoking a grant that is already revoked or expired changes nothing and succeeds.