oz0 app create
For: Operators and developers looking up a command.
Register an app whose backend exchanges a signed-in person's token from one of the cluster's identity providers (--provider) for a short-lived token that acts as that person on the runtime API: POST /v1/token on the edge (RFC 8693), with the app's key as actor_token.
The person's ID token, or a JWT access token, must be for the app's own client ID at that provider (--client-id), and the person must have signed in to this cluster once (the console or oz0 login). The token lasts at most 15 minutes and acts as the person: approvals, questions, budgets and the audit log see them, with the app beside them.
What it may do is the person's own permissions narrowed to the app's (--permission, from jobs.read[.own], jobs.start[.granted], jobs.cancel[.own], approvals.decide[.named], questions.answer[.own], feeds.read, budget.request and tenant.read; by default the agent user's without the chat drawer, and jobs.start). Content (what jobs read and wrote) only with --content, for people who have it. Only the tenant's members act through it, and the tenant's owners register it. A client ID belongs to one app in the cluster, and never the cluster's own.
Usage
oz0 app create <name> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--client-id | string | the app's own client ID at that provider: its tokens' audience | |
--content | bool | let people who see content see it through the app | |
--json | bool | print JSON instead of a table | |
--permission | stringArray | the agent user's | what people may do through the app; repeat for more |
--provider | string | the cluster's identity provider whose people use the app (oz0 oidc list) | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.