LOAD EXTERNAL GRANTS AT STARTUP

This guide shows you how to load authorization grants from a YAML file outside the repository when starting swamp serve.

Write the grants file

Create a YAML file with a top-level grants key. The format is the same as files in the grants/ directory:

# /etc/swamp/grants.yaml
grants:
  - subject: user:deploy-bot
    effect: allow
    actions: [run]
    resource: workflow:@acme/deploy
  - subject: idp-group:platform-eng
    effect: allow
    actions: [run, read]
    resource: model:*

Start the server with the grants file

Pass the file path with --grants-file:

swamp serve --auth-mode token --admins 'user:admin-id' \
  --grants-file /etc/swamp/grants.yaml

Or set the SWAMP_GRANTS_FILE environment variable:

export SWAMP_GRANTS_FILE=/etc/swamp/grants.yaml
swamp serve --auth-mode token --admins 'user:admin-id'

The server loads grants from this file at startup. If the file does not exist or contains invalid YAML, the server refuses to start.

Verify the grants loaded

List active grants to confirm:

swamp access grant list --server wss://localhost:9090

Grants from the external file appear alongside any grants from the grants/ directory and CLI-created grants.

Related

• Manage Grants with Files — manage grants as YAML files in the repository's grants/ directory
• Manage Access Grants — create and manage grants with the CLI
• Authorization — full reference for subjects, effects, actions, and resource selectors
• Serve Flags — all swamp serve flags and environment variables