finnest dcr

Fetch/summarize an SSA or safely inspect and reconcile OPIN DCR state.

Decode/fetch a provider DCR software statement (SSA), inspect a receiver DCR attempt, or reconcile one exact registration after out-of-band provider confirmation. SSA/token/secret material and certificate thumbprints are never printed.

Grupo: Deploy e ciclo de vida · Nível: avançado

Comando avançado

Use este comando quando a documentação de operação ou o suporte Finnest indicar.

Uso

finnest dcr <subcomando> [opções]

Exemplos

finnest dcr ssa-summary --ssa-file ./ssa.jwt
finnest dcr ssa-summary --ssa-file ./ssa.jwt --json
finnest dcr fetch-ssa --org-id <id> --software-id <id> --directory-client-id <client-id> --brcac-cert ./brcac.pem --brcac-key ./brcac.key --out ./ssa.jwt
finnest dcr registration-status <authorisation-server-id>
finnest dcr reconcile <authorisation-server-id> <attempt-id> provider_confirmed_not_created --evidence-reference <provider-ticket> --yes

Opções

• --ssa-file <path> — Path to a compact SSA JWT file for dcr ssa-summary.
• --log-level <level> — Diagnostic verbosity: error, warn, info, debug, or trace.
• --plain — Force headless output even on an interactive TTY.
• --verbose — Enable debug-level diagnostics.

As opções globais de saída também se aplicam.

Subcomandos

• ssa-summary — Decode a compact SSA to a sanitized summary.
• fetch-ssa — Fetch a fresh SSA from the Directory and write it to disk.
• registration-status — Read the sanitized local DCR registration/attempt state.
• reconcile — Delete one exact registration after provider confirmation.

finnest dcr ssa-summary

Decode a compact SSA to a sanitized summary.

Opções

• --ssa-file <path> — Path to a compact SSA JWT file for dcr ssa-summary.
• --log-level <level> — Diagnostic verbosity: error, warn, info, debug, or trace.
• --plain — Force headless output even on an interactive TTY.
• --verbose — Enable debug-level diagnostics.

As opções globais de saída também se aplicam.

finnest dcr fetch-ssa

Fetch a fresh SSA from the Directory and write it to disk.

Fetch a fresh SSA using the Directory-required mTLS + directory:software bearer (the Directory only accepts an SSA whose iat is under 5 minutes old). The assertion path is defined by the official OPIN Directory OpenAPI; --endpoint may change only the path on the configured Directory origin.

Opções

• --org-id <id> — Directory organisation id used to build the SSA endpoint path.
• --software-id <id> — Directory software statement id used to build the SSA endpoint path.
• --brcac-cert <path> — Path to the BRCAC client certificate PEM used for mTLS.
• --brcac-key <path> — Path to the BRCAC client key PEM used for mTLS.
• --ca-bundle <path> — Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.
• --directory-base <url> — OPIN Directory mTLS API base; token endpoint comes from issuer discovery.
• --directory-client-id <id> — Directory Software Statement ClientId used to obtain the Directory token.
• --endpoint <url> — Directory SSA path override on the configured API origin.
• --environment <environment> — Target environment: sandbox or prod.
• --out <path> — Write the command output to this file (created with 0600 permissions).
• --log-level <level> — Diagnostic verbosity: error, warn, info, debug, or trace.
• --plain — Force headless output even on an interactive TTY.
• --verbose — Enable debug-level diagnostics.

As opções globais de saída também se aplicam.

finnest dcr registration-status

Read the sanitized local DCR registration/attempt state.

Argumentos

• <authorisation-server-id> — Directory Authorisation Server UUID.

Opções

• --auth-base <url> — Authorization server base URL (non-mTLS host) for the OPIN target report.
• --environment <environment> — Target environment: sandbox or prod.
• --log-level <level> — Diagnostic verbosity: error, warn, info, debug, or trace.
• --plain — Force headless output even on an interactive TTY.
• --verbose — Enable debug-level diagnostics.

As opções globais de saída também se aplicam.

finnest dcr reconcile

Delete one exact registration after provider confirmation.

Argumentos

• <authorisation-server-id> — Directory Authorisation Server UUID.
• <attempt-id> — Exact attempt UUID returned by registration-status.
• <resolution> — Provider-confirmed disposition of the registration (not-created applies only to a pending attempt). Valores: provider_confirmed_not_created, provider_confirmed_deleted.

Opções

• --auth-base <url> — Authorization server base URL (non-mTLS host) for the OPIN target report.
• --environment <environment> — Target environment: sandbox or prod.
• --evidence-reference <reference> — Provider ticket or retained evidence reference for exact-attempt reconciliation.
• --yes — Approve a mutating operation.
• --log-level <level> — Diagnostic verbosity: error, warn, info, debug, or trace.
• --plain — Force headless output even on an interactive TTY.
• --verbose — Enable debug-level diagnostics.

As opções globais de saída também se aplicam.