Agent index (llms.txt) — fetch this first, then the page it names.

orama members and audit

Who may work in a namespace, and the namespace's audit trail. Every command and flag below comes from the orama command tree, so it matches the binary.

Global conventions are on the CLI overview.

orama audit

Read this namespace's audit trail

text

orama audit [flags]

text

Print what has happened in a namespace: sign-ins, keys minted and revoked,
grants given and taken away, deployments, functions, secrets and namespace changes.

Events are shown oldest first. --follow keeps the command running and prints new
ones as they are recorded.

Actions: auth.challenge, auth.verify, auth.refresh, auth.refresh.replay, auth.logout, key.issue, key.revoke, key.rotate, key.revoke_all, namespace.create, namespace.delete, namespace.operator_remove, secret.set, secret.delete, function.deploy, function.delete, deployment.deploy, deployment.delete, operator.action, auth.legacy_credential, grant.add, grant.revoke, namespace.transfer, namespace.backup, namespace.restore, auth.device.start, auth.device.approve, auth.device.deny, auth.device.claim, auth.device.revoke, namespace.session_policy, namespace.sign_in_policy, node.register, node.key.enrol

Flag	Default	Description
`--action`	—	Show only this action
`--limit`	`0`	How many events to fetch at once (default 50, max 200)
`--namespace`	—	Namespace name
`--principal`	—	Show only what this wallet or key did
`--since`	—	Show only what happened after this time (RFC3339, or the created_at of a row)
`-f`, `--follow`	`false`	Keep running and print new events as they are recorded

orama members

Manage who may work in a namespace

text

orama members

text

List, add and remove the wallets that hold a grant in a namespace, and
transfer the namespace itself.

A namespace has exactly one owner. Everybody else holds a role:

  admin    the control plane — deployments, functions, secrets, keys, raw database
  runtime  the data plane — invoke, storage, push, webrtc, proxy, pubsub, cache
  reader   a member with no grant at all

Ownership is not a role you can hand out: use 'orama members transfer'.

Subcommands: add, list, remove, transfer

orama members add

Give a wallet a role in this namespace

text

orama members add <wallet> [flags]

Flag	Default	Description
`--expires-in-hours`	`0`	Expire the grant after this many hours (default: never)
`--name`	—	Human label for this member
`--namespace`	—	Namespace name
`--resource`	—	Narrow the role to a resource, e.g. storage:avatars/* (applied in the cache, fn, pubsub, storage domains; any other is refused)
`--role`	—	Role to grant (reader, runtime, developer, admin)

orama members list

List who holds a grant in this namespace

text

orama members list [flags]

Aliases: ls

Flag	Default	Description
`--namespace`	—	Namespace name

orama members remove

Take a wallet's grant away

text

orama members remove <wallet> [flags]

Aliases: rm

Flag	Default	Description
`--namespace`	—	Namespace name

orama members transfer

Hand this namespace to another wallet

text

orama members transfer <wallet> [flags]

text

Make another wallet the owner of this namespace.

Only the current owner may do this, and it is one step rather than a removal and
a grant, so there is no moment where the namespace has no owner.
You keep an admin grant, so handing a project over does not lock you out of it.
<wallet> must be a wallet address (0x and 40 hex digits, or a Solana public key);
the gateway refuses anything else rather than hand the namespace to nobody.

Flag	Default	Description
`--force`	`false`	Skip confirmation prompt
`--namespace`	—	Namespace name