[{"data":1,"prerenderedAt":1505},["ShallowReactive",2],{"navigation":3,"/ecosystem/grapes":145,"/ecosystem/grapes-surround":1500},[4,28,49,88,101,127],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Getting Started","/getting-started","1.getting-started/1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Working with Agents","/getting-started/working-with-agents","1.getting-started/2.working-with-agents",{"title":16,"path":17,"stem":18},"Setup a Service Provider","/getting-started/setup-service-provider","1.getting-started/3.setup-service-provider",{"title":20,"path":21,"stem":22},"Setup an Identity Provider","/getting-started/setup-identity-provider","1.getting-started/4.setup-identity-provider",{"title":24,"path":25,"stem":26},"Developers","/getting-started/developers","1.getting-started/5.developers",false,{"title":29,"icon":27,"path":30,"stem":31,"children":32,"page":27},"Guides","/guides","2.guides",[33,37,41,45],{"title":34,"path":35,"stem":36},"How It Works","/guides/how-it-works","2.guides/1.how-it-works",{"title":38,"path":39,"stem":40},"Capabilities Guide","/guides/capabilities-guide","2.guides/2.capabilities-guide",{"title":42,"path":43,"stem":44},"End-to-End Tutorial","/guides/end-to-end-tutorial","2.guides/3.end-to-end-tutorial",{"title":46,"path":47,"stem":48},"Delegation Guide","/guides/delegation-guide","2.guides/4.delegation-guide",{"title":50,"path":51,"stem":52,"children":53,"icon":27},"Ecosystem","/ecosystem","3.ecosystem/1.index",[54,56,60,64,68,72,76,80,84],{"title":55,"path":51,"stem":52},"Overview",{"title":57,"path":58,"stem":59},"grapes CLI","/ecosystem/grapes","3.ecosystem/2.grapes",{"title":61,"path":62,"stem":63},"shapes CLI","/ecosystem/shapes","3.ecosystem/3.shapes",{"title":65,"path":66,"stem":67},"escapes","/ecosystem/escapes","3.ecosystem/4.escapes",{"title":69,"path":70,"stem":71},"OpenApe Proxy","/ecosystem/proxy","3.ecosystem/5.proxy",{"title":73,"path":74,"stem":75},"OpenApe Browser","/ecosystem/browser","3.ecosystem/6.browser",{"title":77,"path":78,"stem":79},"OpenApe Auth","/ecosystem/auth","3.ecosystem/7.auth",{"title":81,"path":82,"stem":83},"OpenApe Grants","/ecosystem/grants","3.ecosystem/8.grants",{"title":85,"path":86,"stem":87},"nuxt-auth-sp","/ecosystem/nuxt-auth-sp","3.ecosystem/9.nuxt-auth-sp",{"title":89,"icon":27,"path":90,"stem":91,"children":92,"page":27},"Security","/security","4.security",[93,97],{"title":94,"path":95,"stem":96},"Compliance","/security/compliance","4.security/1.compliance",{"title":98,"path":99,"stem":100},"Threat Model","/security/threat-model","4.security/2.threat-model",{"title":102,"path":103,"stem":104,"children":105,"icon":27},"Reference","/reference","5.reference/1.index",[106,107,111,115,119,123],{"title":102,"path":103,"stem":104},{"title":108,"path":109,"stem":110},"IdP Configuration","/reference/idp-configuration","5.reference/2.idp-configuration",{"title":112,"path":113,"stem":114},"SP Configuration","/reference/sp-configuration","5.reference/3.sp-configuration",{"title":116,"path":117,"stem":118},"API Endpoints","/reference/api-endpoints","5.reference/4.api-endpoints",{"title":120,"path":121,"stem":122},"escapes Config","/reference/escapes-config","5.reference/5.escapes-config",{"title":124,"path":125,"stem":126},"Proxy Config","/reference/proxy-config","5.reference/6.proxy-config",{"title":128,"path":129,"stem":130,"children":131,"icon":27},"Operations","/operations","6.operations/1.index",[132,133,137,141],{"title":128,"path":129,"stem":130},{"title":134,"path":135,"stem":136},"Deployment","/operations/deployment","6.operations/2.deployment",{"title":138,"path":139,"stem":140},"Troubleshooting","/operations/troubleshooting","6.operations/3.troubleshooting",{"title":142,"path":143,"stem":144},"Monitoring","/operations/monitoring","6.operations/4.monitoring",{"id":146,"title":57,"body":147,"description":1494,"extension":1495,"links":1496,"meta":1497,"navigation":639,"path":58,"seo":1498,"stem":59,"__hash__":1499},"docs/3.ecosystem/2.grapes.md",{"type":148,"value":149,"toc":1462},"minimark",[150,154,162,167,196,200,205,223,226,230,270,273,277,303,310,314,318,365,369,509,513,520,585,589,593,600,737,808,812,892,896,900,958,962,1000,1004,1039,1046,1050,1070,1073,1077,1080,1084,1186,1269,1273,1294,1298,1302,1309,1345,1359,1363,1386,1390,1396,1458],[151,152,153],"h1",{"id":153},"grapes",[155,156,157,158,161],"p",{},"The universal CLI for the OpenApe grant lifecycle. Handles authentication, grant requests, approvals, delegations, and integrates with ",[159,160,65],"a",{"href":66}," for privilege elevation.",[163,164,166],"h2",{"id":165},"installation","Installation",[168,169,174],"pre",{"className":170,"code":171,"language":172,"meta":173,"style":173},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","npm install -g @openape/grapes\n","bash","",[175,176,177],"code",{"__ignoreMap":173},[178,179,182,186,190,193],"span",{"class":180,"line":181},"line",1,[178,183,185],{"class":184},"sBMFI","npm",[178,187,189],{"class":188},"sfazB"," install",[178,191,192],{"class":188}," -g",[178,194,195],{"class":188}," @openape/grapes\n",[163,197,199],{"id":198},"authentication","Authentication",[201,202,204],"h3",{"id":203},"human-login-browser-based","Human Login (Browser-based)",[168,206,208],{"className":170,"code":207,"language":172,"meta":173,"style":173},"grapes login --idp https://id.example.com\n",[175,209,210],{"__ignoreMap":173},[178,211,212,214,217,220],{"class":180,"line":181},[178,213,153],{"class":184},[178,215,216],{"class":188}," login",[178,218,219],{"class":188}," --idp",[178,221,222],{"class":188}," https://id.example.com\n",[155,224,225],{},"Opens a browser for Passkey authentication. The IdP redirects back to a local callback server on port 9876.",[201,227,229],{"id":228},"agent-login-key-based","Agent Login (Key-based)",[168,231,233],{"className":170,"code":232,"language":172,"meta":173,"style":173},"grapes login --idp https://id.example.com \\\n  --key ~/.ssh/agent_key \\\n  --email agent+deploy@example.com\n",[175,234,235,250,261],{"__ignoreMap":173},[178,236,237,239,241,243,246],{"class":180,"line":181},[178,238,153],{"class":184},[178,240,216],{"class":188},[178,242,219],{"class":188},[178,244,245],{"class":188}," https://id.example.com",[178,247,249],{"class":248},"sTEyZ"," \\\n",[178,251,253,256,259],{"class":180,"line":252},2,[178,254,255],{"class":188},"  --key",[178,257,258],{"class":188}," ~/.ssh/agent_key",[178,260,249],{"class":248},[178,262,264,267],{"class":180,"line":263},3,[178,265,266],{"class":188},"  --email",[178,268,269],{"class":188}," agent+deploy@example.com\n",[155,271,272],{},"Uses Ed25519 challenge-response authentication. No browser needed.",[201,274,276],{"id":275},"session-management","Session Management",[168,278,280],{"className":170,"code":279,"language":172,"meta":173,"style":173},"grapes whoami        # Show current identity, IdP, token expiry\ngrapes logout        # Clear stored credentials\n",[175,281,282,293],{"__ignoreMap":173},[178,283,284,286,289],{"class":180,"line":181},[178,285,153],{"class":184},[178,287,288],{"class":188}," whoami",[178,290,292],{"class":291},"sHwdD","        # Show current identity, IdP, token expiry\n",[178,294,295,297,300],{"class":180,"line":252},[178,296,153],{"class":184},[178,298,299],{"class":188}," logout",[178,301,302],{"class":291},"        # Clear stored credentials\n",[155,304,305,306,309],{},"Credentials are stored in ",[175,307,308],{},"~/.config/grapes/auth.json"," (mode 0600).",[163,311,313],{"id":312},"grant-requests","Grant Requests",[201,315,317],{"id":316},"request-a-command-grant","Request a Command Grant",[168,319,321],{"className":170,"code":320,"language":172,"meta":173,"style":173},"grapes request \"systemctl restart nginx\" \\\n  --audience escapes \\\n  --reason \"Deploy hotfix #42\"\n",[175,322,323,342,352],{"__ignoreMap":173},[178,324,325,327,330,334,337,340],{"class":180,"line":181},[178,326,153],{"class":184},[178,328,329],{"class":188}," request",[178,331,333],{"class":332},"sMK4o"," \"",[178,335,336],{"class":188},"systemctl restart nginx",[178,338,339],{"class":332},"\"",[178,341,249],{"class":248},[178,343,344,347,350],{"class":180,"line":252},[178,345,346],{"class":188},"  --audience",[178,348,349],{"class":188}," escapes",[178,351,249],{"class":248},[178,353,354,357,359,362],{"class":180,"line":263},[178,355,356],{"class":188},"  --reason",[178,358,333],{"class":332},[178,360,361],{"class":188},"Deploy hotfix #42",[178,363,364],{"class":332},"\"\n",[201,366,368],{"id":367},"request-with-options","Request with Options",[370,371,372,388],"table",{},[373,374,375],"thead",{},[376,377,378,382,385],"tr",{},[379,380,381],"th",{},"Flag",[379,383,384],{},"Description",[379,386,387],{},"Default",[389,390,391,412,425,448,470,482,494],"tbody",{},[376,392,393,399,409],{},[394,395,396],"td",{},[175,397,398],{},"--audience",[394,400,401,402,404,405,408],{},"Service identifier (e.g., ",[175,403,65],{},", ",[175,406,407],{},"proxy",")",[394,410,411],{},"Required",[376,413,414,419,422],{},[394,415,416],{},[175,417,418],{},"--host",[394,420,421],{},"Target host",[394,423,424],{},"System hostname",[376,426,427,432,444],{},[394,428,429],{},[175,430,431],{},"--approval",[394,433,434,435,404,438,404,441],{},"Grant type: ",[175,436,437],{},"once",[175,439,440],{},"timed",[175,442,443],{},"always",[394,445,446],{},[175,447,437],{},[376,449,450,455,467],{},[394,451,452],{},[175,453,454],{},"--duration",[394,456,457,458,404,461,404,464,408],{},"Duration for timed grants (e.g., ",[175,459,460],{},"30m",[175,462,463],{},"1h",[175,465,466],{},"7d",[394,468,469],{},"—",[376,471,472,477,480],{},[394,473,474],{},[175,475,476],{},"--reason",[394,478,479],{},"Human-readable reason",[394,481,469],{},[376,483,484,489,492],{},[394,485,486],{},[175,487,488],{},"--run-as",[394,490,491],{},"Execute as specific user",[394,493,469],{},[376,495,496,501,504],{},[394,497,498],{},[175,499,500],{},"--wait",[394,502,503],{},"Block until approved/denied (5 min timeout)",[394,505,506],{},[175,507,508],{},"false",[201,510,512],{"id":511},"request-a-capability-grant","Request a Capability Grant",[155,514,515,516,519],{},"For use with ",[159,517,518],{"href":62},"Shapes"," adapters:",[168,521,523],{"className":170,"code":522,"language":172,"meta":173,"style":173},"grapes request-capability kubectl \\\n  --resource pods \\\n  --selector default \\\n  --action delete \\\n  --approval once \\\n  --wait\n",[175,524,525,537,547,557,568,579],{"__ignoreMap":173},[178,526,527,529,532,535],{"class":180,"line":181},[178,528,153],{"class":184},[178,530,531],{"class":188}," request-capability",[178,533,534],{"class":188}," kubectl",[178,536,249],{"class":248},[178,538,539,542,545],{"class":180,"line":252},[178,540,541],{"class":188},"  --resource",[178,543,544],{"class":188}," pods",[178,546,249],{"class":248},[178,548,549,552,555],{"class":180,"line":263},[178,550,551],{"class":188},"  --selector",[178,553,554],{"class":188}," default",[178,556,249],{"class":248},[178,558,560,563,566],{"class":180,"line":559},4,[178,561,562],{"class":188},"  --action",[178,564,565],{"class":188}," delete",[178,567,249],{"class":248},[178,569,571,574,577],{"class":180,"line":570},5,[178,572,573],{"class":188},"  --approval",[178,575,576],{"class":188}," once",[178,578,249],{"class":248},[178,580,582],{"class":180,"line":581},6,[178,583,584],{"class":188},"  --wait\n",[163,586,588],{"id":587},"grant-execution","Grant Execution",[201,590,592],{"id":591},"run-request-execute-in-one-step","Run (Request + Execute in One Step)",[155,594,595,596,599],{},"The ",[175,597,598],{},"run"," command combines request, approval-wait, and execution:",[168,601,603],{"className":170,"code":602,"language":172,"meta":173,"style":173},"# Request grant, wait for approval, execute via escapes\ngrapes run escapes \"systemctl restart nginx\" --reason \"Deploy\"\n\n# With timed approval\ngrapes run escapes \"apt-get upgrade\" --approval timed --duration 1h\n\n# For non-escapes audiences, outputs the JWT to stdout\nTOKEN=$(grapes run proxy \"test\" 2>/dev/null)\ncurl -H \"Authorization: Bearer $TOKEN\" https://api.example.com/action\n",[175,604,605,610,635,641,646,673,677,683,715],{"__ignoreMap":173},[178,606,607],{"class":180,"line":181},[178,608,609],{"class":291},"# Request grant, wait for approval, execute via escapes\n",[178,611,612,614,617,619,621,623,625,628,630,633],{"class":180,"line":252},[178,613,153],{"class":184},[178,615,616],{"class":188}," run",[178,618,349],{"class":188},[178,620,333],{"class":332},[178,622,336],{"class":188},[178,624,339],{"class":332},[178,626,627],{"class":188}," --reason",[178,629,333],{"class":332},[178,631,632],{"class":188},"Deploy",[178,634,364],{"class":332},[178,636,637],{"class":180,"line":263},[178,638,640],{"emptyLinePlaceholder":639},true,"\n",[178,642,643],{"class":180,"line":559},[178,644,645],{"class":291},"# With timed approval\n",[178,647,648,650,652,654,656,659,661,664,667,670],{"class":180,"line":570},[178,649,153],{"class":184},[178,651,616],{"class":188},[178,653,349],{"class":188},[178,655,333],{"class":332},[178,657,658],{"class":188},"apt-get upgrade",[178,660,339],{"class":332},[178,662,663],{"class":188}," --approval",[178,665,666],{"class":188}," timed",[178,668,669],{"class":188}," --duration",[178,671,672],{"class":188}," 1h\n",[178,674,675],{"class":180,"line":581},[178,676,640],{"emptyLinePlaceholder":639},[178,678,680],{"class":180,"line":679},7,[178,681,682],{"class":291},"# For non-escapes audiences, outputs the JWT to stdout\n",[178,684,686,689,692,694,696,699,701,704,706,709,712],{"class":180,"line":685},8,[178,687,688],{"class":248},"TOKEN",[178,690,691],{"class":332},"=$(",[178,693,153],{"class":184},[178,695,616],{"class":188},[178,697,698],{"class":188}," proxy",[178,700,333],{"class":332},[178,702,703],{"class":188},"test",[178,705,339],{"class":332},[178,707,708],{"class":332}," 2>",[178,710,711],{"class":188},"/dev/null",[178,713,714],{"class":332},")\n",[178,716,718,721,724,726,729,732,734],{"class":180,"line":717},9,[178,719,720],{"class":184},"curl",[178,722,723],{"class":188}," -H",[178,725,333],{"class":332},[178,727,728],{"class":188},"Authorization: Bearer ",[178,730,731],{"class":248},"$TOKEN",[178,733,339],{"class":332},[178,735,736],{"class":188}," https://api.example.com/action\n",[370,738,739,749],{},[373,740,741],{},[376,742,743,745,747],{},[379,744,381],{},[379,746,384],{},[379,748,387],{},[389,750,751,764,774,784,794],{},[376,752,753,757,760],{},[394,754,755],{},[175,756,431],{},[394,758,759],{},"Grant type",[394,761,762],{},[175,763,437],{},[376,765,766,770,772],{},[394,767,768],{},[175,769,476],{},[394,771,479],{},[394,773,469],{},[376,775,776,780,782],{},[394,777,778],{},[175,779,488],{},[394,781,491],{},[394,783,469],{},[376,785,786,790,792],{},[394,787,788],{},[175,789,418],{},[394,791,421],{},[394,793,424],{},[376,795,796,801,804],{},[394,797,798],{},[175,799,800],{},"--escapes-path",[394,802,803],{},"Path to escapes binary",[394,805,806],{},[175,807,65],{},[201,809,811],{"id":810},"get-token-for-existing-grant","Get Token for Existing Grant",[168,813,815],{"className":170,"code":814,"language":172,"meta":173,"style":173},"# Get the AuthZ-JWT for an already-approved grant\ngrapes token \u003Cgrant-id>\n\n# Pipe to another command\nJWT=$(grapes token abc123)\nescapes --grant \"$JWT\" -- systemctl restart nginx\n",[175,816,817,822,841,845,850,866],{"__ignoreMap":173},[178,818,819],{"class":180,"line":181},[178,820,821],{"class":291},"# Get the AuthZ-JWT for an already-approved grant\n",[178,823,824,826,829,832,835,838],{"class":180,"line":252},[178,825,153],{"class":184},[178,827,828],{"class":188}," token",[178,830,831],{"class":332}," \u003C",[178,833,834],{"class":188},"grant-i",[178,836,837],{"class":248},"d",[178,839,840],{"class":332},">\n",[178,842,843],{"class":180,"line":263},[178,844,640],{"emptyLinePlaceholder":639},[178,846,847],{"class":180,"line":559},[178,848,849],{"class":291},"# Pipe to another command\n",[178,851,852,855,857,859,861,864],{"class":180,"line":570},[178,853,854],{"class":248},"JWT",[178,856,691],{"class":332},[178,858,153],{"class":184},[178,860,828],{"class":188},[178,862,863],{"class":188}," abc123",[178,865,714],{"class":332},[178,867,868,870,873,875,878,880,883,886,889],{"class":180,"line":581},[178,869,65],{"class":184},[178,871,872],{"class":188}," --grant",[178,874,333],{"class":332},[178,876,877],{"class":248},"$JWT",[178,879,339],{"class":332},[178,881,882],{"class":188}," --",[178,884,885],{"class":188}," systemctl",[178,887,888],{"class":188}," restart",[178,890,891],{"class":188}," nginx\n",[163,893,895],{"id":894},"grant-management","Grant Management",[201,897,899],{"id":898},"list-grants","List Grants",[168,901,903],{"className":170,"code":902,"language":172,"meta":173,"style":173},"grapes list                      # All grants\ngrapes list --status pending     # Only pending\ngrapes list --limit 50           # Up to 50 results\ngrapes list --json               # JSON output\n",[175,904,905,915,930,946],{"__ignoreMap":173},[178,906,907,909,912],{"class":180,"line":181},[178,908,153],{"class":184},[178,910,911],{"class":188}," list",[178,913,914],{"class":291},"                      # All grants\n",[178,916,917,919,921,924,927],{"class":180,"line":252},[178,918,153],{"class":184},[178,920,911],{"class":188},[178,922,923],{"class":188}," --status",[178,925,926],{"class":188}," pending",[178,928,929],{"class":291},"     # Only pending\n",[178,931,932,934,936,939,943],{"class":180,"line":263},[178,933,153],{"class":184},[178,935,911],{"class":188},[178,937,938],{"class":188}," --limit",[178,940,942],{"class":941},"sbssI"," 50",[178,944,945],{"class":291},"           # Up to 50 results\n",[178,947,948,950,952,955],{"class":180,"line":559},[178,949,153],{"class":184},[178,951,911],{"class":188},[178,953,954],{"class":188}," --json",[178,956,957],{"class":291},"               # JSON output\n",[201,959,961],{"id":960},"check-grant-status","Check Grant Status",[168,963,965],{"className":170,"code":964,"language":172,"meta":173,"style":173},"grapes status \u003Cgrant-id>\ngrapes status \u003Cgrant-id> --json\n",[175,966,967,982],{"__ignoreMap":173},[178,968,969,971,974,976,978,980],{"class":180,"line":181},[178,970,153],{"class":184},[178,972,973],{"class":188}," status",[178,975,831],{"class":332},[178,977,834],{"class":188},[178,979,837],{"class":248},[178,981,840],{"class":332},[178,983,984,986,988,990,992,994,997],{"class":180,"line":252},[178,985,153],{"class":184},[178,987,973],{"class":188},[178,989,831],{"class":332},[178,991,834],{"class":188},[178,993,837],{"class":248},[178,995,996],{"class":332},">",[178,998,999],{"class":188}," --json\n",[201,1001,1003],{"id":1002},"approve-deny-as-approver","Approve / Deny (as Approver)",[168,1005,1007],{"className":170,"code":1006,"language":172,"meta":173,"style":173},"grapes approve \u003Cgrant-id>\ngrapes deny \u003Cgrant-id>\n",[175,1008,1009,1024],{"__ignoreMap":173},[178,1010,1011,1013,1016,1018,1020,1022],{"class":180,"line":181},[178,1012,153],{"class":184},[178,1014,1015],{"class":188}," approve",[178,1017,831],{"class":332},[178,1019,834],{"class":188},[178,1021,837],{"class":248},[178,1023,840],{"class":332},[178,1025,1026,1028,1031,1033,1035,1037],{"class":180,"line":252},[178,1027,153],{"class":184},[178,1029,1030],{"class":188}," deny",[178,1032,831],{"class":332},[178,1034,834],{"class":188},[178,1036,837],{"class":248},[178,1038,840],{"class":332},[1040,1041,1043],"callout",{"type":1042},"info",[155,1044,1045],{},"You must be logged in as the agent's owner or designated approver to approve/deny grants.",[201,1047,1049],{"id":1048},"revoke-a-grant","Revoke a Grant",[168,1051,1053],{"className":170,"code":1052,"language":172,"meta":173,"style":173},"grapes revoke \u003Cgrant-id>\n",[175,1054,1055],{"__ignoreMap":173},[178,1056,1057,1059,1062,1064,1066,1068],{"class":180,"line":181},[178,1058,153],{"class":184},[178,1060,1061],{"class":188}," revoke",[178,1063,831],{"class":332},[178,1065,834],{"class":188},[178,1067,837],{"class":248},[178,1069,840],{"class":332},[155,1071,1072],{},"Revokes an approved grant immediately. The AuthZ-JWT will fail verification after revocation.",[163,1074,1076],{"id":1075},"delegations","Delegations",[155,1078,1079],{},"Delegations allow a user to grant another identity the ability to act on their behalf at a specific service.",[201,1081,1083],{"id":1082},"create-a-delegation","Create a Delegation",[168,1085,1087],{"className":170,"code":1086,"language":172,"meta":173,"style":173},"grapes delegate \\\n  --to agent+bot@example.com \\\n  --at escapes \\\n  --approval always\n\n# With scopes and expiry\ngrapes delegate \\\n  --to alice@example.com \\\n  --at proxy \\\n  --scopes \"read,exec\" \\\n  --expires \"2026-12-31T23:59:59Z\"\n",[175,1088,1089,1098,1108,1117,1124,1128,1133,1141,1150,1158,1173],{"__ignoreMap":173},[178,1090,1091,1093,1096],{"class":180,"line":181},[178,1092,153],{"class":184},[178,1094,1095],{"class":188}," delegate",[178,1097,249],{"class":248},[178,1099,1100,1103,1106],{"class":180,"line":252},[178,1101,1102],{"class":188},"  --to",[178,1104,1105],{"class":188}," agent+bot@example.com",[178,1107,249],{"class":248},[178,1109,1110,1113,1115],{"class":180,"line":263},[178,1111,1112],{"class":188},"  --at",[178,1114,349],{"class":188},[178,1116,249],{"class":248},[178,1118,1119,1121],{"class":180,"line":559},[178,1120,573],{"class":188},[178,1122,1123],{"class":188}," always\n",[178,1125,1126],{"class":180,"line":570},[178,1127,640],{"emptyLinePlaceholder":639},[178,1129,1130],{"class":180,"line":581},[178,1131,1132],{"class":291},"# With scopes and expiry\n",[178,1134,1135,1137,1139],{"class":180,"line":679},[178,1136,153],{"class":184},[178,1138,1095],{"class":188},[178,1140,249],{"class":248},[178,1142,1143,1145,1148],{"class":180,"line":685},[178,1144,1102],{"class":188},[178,1146,1147],{"class":188}," alice@example.com",[178,1149,249],{"class":248},[178,1151,1152,1154,1156],{"class":180,"line":717},[178,1153,1112],{"class":188},[178,1155,698],{"class":188},[178,1157,249],{"class":248},[178,1159,1161,1164,1166,1169,1171],{"class":180,"line":1160},10,[178,1162,1163],{"class":188},"  --scopes",[178,1165,333],{"class":332},[178,1167,1168],{"class":188},"read,exec",[178,1170,339],{"class":332},[178,1172,249],{"class":248},[178,1174,1176,1179,1181,1184],{"class":180,"line":1175},11,[178,1177,1178],{"class":188},"  --expires",[178,1180,333],{"class":332},[178,1182,1183],{"class":188},"2026-12-31T23:59:59Z",[178,1185,364],{"class":332},[370,1187,1188,1198],{},[373,1189,1190],{},[376,1191,1192,1194,1196],{},[379,1193,381],{},[379,1195,384],{},[379,1197,411],{},[389,1199,1200,1213,1225,1238,1257],{},[376,1201,1202,1207,1210],{},[394,1203,1204],{},[175,1205,1206],{},"--to",[394,1208,1209],{},"Delegate email",[394,1211,1212],{},"Yes",[376,1214,1215,1220,1223],{},[394,1216,1217],{},[175,1218,1219],{},"--at",[394,1221,1222],{},"Service/audience",[394,1224,1212],{},[376,1226,1227,1232,1235],{},[394,1228,1229],{},[175,1230,1231],{},"--scopes",[394,1233,1234],{},"Comma-separated scopes",[394,1236,1237],{},"No",[376,1239,1240,1244,1252],{},[394,1241,1242],{},[175,1243,431],{},[394,1245,1246,404,1248,404,1250],{},[175,1247,437],{},[175,1249,440],{},[175,1251,443],{},[394,1253,1254,1255,408],{},"No (default: ",[175,1256,437],{},[376,1258,1259,1264,1267],{},[394,1260,1261],{},[175,1262,1263],{},"--expires",[394,1265,1266],{},"ISO 8601 expiration date",[394,1268,1237],{},[201,1270,1272],{"id":1271},"list-delegations","List Delegations",[168,1274,1276],{"className":170,"code":1275,"language":172,"meta":173,"style":173},"grapes delegations\ngrapes delegations --json\n",[175,1277,1278,1285],{"__ignoreMap":173},[178,1279,1280,1282],{"class":180,"line":181},[178,1281,153],{"class":184},[178,1283,1284],{"class":188}," delegations\n",[178,1286,1287,1289,1292],{"class":180,"line":252},[178,1288,153],{"class":184},[178,1290,1291],{"class":188}," delegations",[178,1293,999],{"class":188},[163,1295,1297],{"id":1296},"configuration","Configuration",[201,1299,1301],{"id":1300},"config-file-optional","Config File (Optional)",[155,1303,1304,1305,1308],{},"Create ",[175,1306,1307],{},"~/.config/grapes/config.toml",":",[168,1310,1314],{"className":1311,"code":1312,"language":1313,"meta":173,"style":173},"language-toml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[defaults]\nidp = \"https://id.example.com\"\n\n[agent]\nkey = \"~/.ssh/agent_key\"\nemail = \"agent+deploy@example.com\"\n","toml",[175,1315,1316,1321,1326,1330,1335,1340],{"__ignoreMap":173},[178,1317,1318],{"class":180,"line":181},[178,1319,1320],{},"[defaults]\n",[178,1322,1323],{"class":180,"line":252},[178,1324,1325],{},"idp = \"https://id.example.com\"\n",[178,1327,1328],{"class":180,"line":263},[178,1329,640],{"emptyLinePlaceholder":639},[178,1331,1332],{"class":180,"line":559},[178,1333,1334],{},"[agent]\n",[178,1336,1337],{"class":180,"line":570},[178,1338,1339],{},"key = \"~/.ssh/agent_key\"\n",[178,1341,1342],{"class":180,"line":581},[178,1343,1344],{},"email = \"agent+deploy@example.com\"\n",[155,1346,1347,1348,404,1351,1354,1355,1358],{},"With a config file, you can skip the ",[175,1349,1350],{},"--idp",[175,1352,1353],{},"--key",", and ",[175,1356,1357],{},"--email"," flags.",[201,1360,1362],{"id":1361},"environment-variables","Environment Variables",[370,1364,1365,1374],{},[373,1366,1367],{},[376,1368,1369,1372],{},[379,1370,1371],{},"Variable",[379,1373,384],{},[389,1375,1376],{},[376,1377,1378,1383],{},[394,1379,1380],{},[175,1381,1382],{},"GRAPES_IDP",[394,1384,1385],{},"Override IdP URL",[163,1387,1389],{"id":1388},"endpoint-discovery","Endpoint Discovery",[155,1391,1392,1393,1308],{},"All API endpoints are discovered automatically via OIDC ",[175,1394,1395],{},".well-known/openid-configuration",[370,1397,1398,1408],{},[373,1399,1400],{},[376,1401,1402,1405],{},[379,1403,1404],{},"Discovery Key",[379,1406,1407],{},"Endpoint",[389,1409,1410,1422,1434,1446],{},[376,1411,1412,1417],{},[394,1413,1414],{},[175,1415,1416],{},"openape_grants_endpoint",[394,1418,1419],{},[175,1420,1421],{},"/api/grants",[376,1423,1424,1429],{},[394,1425,1426],{},[175,1427,1428],{},"openape_delegations_endpoint",[394,1430,1431],{},[175,1432,1433],{},"/api/delegations",[376,1435,1436,1441],{},[394,1437,1438],{},[175,1439,1440],{},"ddisa_agent_challenge_endpoint",[394,1442,1443],{},[175,1444,1445],{},"/api/agent/challenge",[376,1447,1448,1453],{},[394,1449,1450],{},[175,1451,1452],{},"ddisa_agent_authenticate_endpoint",[394,1454,1455],{},[175,1456,1457],{},"/api/agent/authenticate",[1459,1460,1461],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":173,"searchDepth":263,"depth":252,"links":1463},[1464,1465,1470,1475,1479,1485,1489,1493],{"id":165,"depth":252,"text":166},{"id":198,"depth":252,"text":199,"children":1466},[1467,1468,1469],{"id":203,"depth":263,"text":204},{"id":228,"depth":263,"text":229},{"id":275,"depth":263,"text":276},{"id":312,"depth":252,"text":313,"children":1471},[1472,1473,1474],{"id":316,"depth":263,"text":317},{"id":367,"depth":263,"text":368},{"id":511,"depth":263,"text":512},{"id":587,"depth":252,"text":588,"children":1476},[1477,1478],{"id":591,"depth":263,"text":592},{"id":810,"depth":263,"text":811},{"id":894,"depth":252,"text":895,"children":1480},[1481,1482,1483,1484],{"id":898,"depth":263,"text":899},{"id":960,"depth":263,"text":961},{"id":1002,"depth":263,"text":1003},{"id":1048,"depth":263,"text":1049},{"id":1075,"depth":252,"text":1076,"children":1486},[1487,1488],{"id":1082,"depth":263,"text":1083},{"id":1271,"depth":263,"text":1272},{"id":1296,"depth":252,"text":1297,"children":1490},[1491,1492],{"id":1300,"depth":263,"text":1301},{"id":1361,"depth":263,"text":1362},{"id":1388,"depth":252,"text":1389},"Universal Grant Management CLI — request, approve, delegate, and execute.","md",null,{},{"title":57,"description":1494},"aF0roBDyIjZYgIv0BIyw9hah7t_7vbNCuAsGsJ0xCLU",[1501,1503],{"title":55,"path":51,"stem":52,"description":1502,"children":-1},"The OpenApe package ecosystem.",{"title":61,"path":62,"stem":63,"description":1504,"children":-1},"Grant-constrained execution layer — run any CLI through structured permissions.",1774221116104]