SPICEDB(1)

NAME
spicedb - A modern permissions database

SYNOPSIS
spicedb [options...] [argument...]

DESCRIPTION
A database that stores and computes permissions

OPTIONS

--log-format
    format of logs ("auto", "console", "json")

--log-level
    verbosity of logging ("trace", "debug", "info", "warn", "error")

--skip-release-check
    if true, skips checking for new SpiceDB releases

COMMANDS

completion
    Generate the autocompletion script for the specified shell

COMMANDS
    bash
        Generate the autocompletion script for bash

    OPTIONS
        --no-descriptions disable completion descriptions

    fish
        Generate the autocompletion script for fish

    OPTIONS
        --no-descriptions disable completion descriptions

    powershell
        Generate the autocompletion script for powershell

    OPTIONS
        --no-descriptions disable completion descriptions

    zsh
        Generate the autocompletion script for zsh

    OPTIONS
        --no-descriptions disable completion descriptions

datastore
    datastore operations

COMMANDS
    gc
        executes garbage collection

    OPTIONS
        --datastore-allowed-migrations migration levels that will not fail the health check (in addition to the current head migration)

        --datastore-bootstrap-files
            bootstrap data yaml files to load

        --datastore-bootstrap-overwrite
            overwrite any existing data with bootstrap data (this can be quite slow)

        --datastore-bootstrap-timeout
            maximum duration before timeout for the bootstrap data to be written

        --datastore-conn-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-conn-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-conn-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-conn-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-conn-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-conn-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-read-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-conn-pool-read-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-conn-pool-read-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-conn-pool-read-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-conn-pool-read-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-read-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-write-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-conn-pool-write-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-conn-pool-write-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-conn-pool-write-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-conn-pool-write-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-write-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-conn-uri
            connection string used by remote datastores (e.g. "postgres://postgres:password@localhost:5432/spicedb")

        --datastore-connect-rate
            rate at which new connections are allowed to the datastore (at a rate of 1/duration) (CockroachDB driver only)

        --datastore-connection-balancing
            enable connection balancing between database nodes (CockroachDB driver only)

        --datastore-credentials-provider-name
            retrieve datastore credentials dynamically using ("aws-iam")

        --datastore-disable-stats
            disable recording relationship counts to the stats table

        --datastore-disable-watch-support
            disable watch support (only enable if you absolutely do not need watch)

        --datastore-engine
            type of datastore to initialize ("cockroachdb", "mysql", "postgres", "spanner")

        --datastore-experimental-column-optimization
            enable experimental column optimization

        --datastore-follower-read-delay-duration
            amount of time to subtract from non-sync revision timestamps to ensure they are sufficiently in the past to enable follower reads (CockroachDB and Spanner drivers only) or read replicas (Postgres and MySQL drivers only)

        --datastore-gc-interval
            amount of time between passes of garbage collection (Postgres driver only)

        --datastore-gc-max-operation-time
            maximum amount of time a garbage collection pass can operate before timing out (Postgres driver only)

        --datastore-gc-window
            amount of time before revisions are garbage collected

        --datastore-include-query-parameters-in-traces
            include query parameters in traces (Postgres and CockroachDB drivers only)

        --datastore-max-tx-retries
            number of times a retriable transaction should be retried

        --datastore-migration-phase
            datastore-specific flag that should be used to signal to a datastore which phase of a multi-step migration it is in

        --datastore-mysql-table-prefix
            prefix to add to the name of all SpiceDB database tables

        --datastore-prometheus-metrics
            set to false to disable metrics from the datastore (do not use for Spanner; setting to false will disable metrics to the configured metrics store in Spanner)

        --datastore-query-userset-batch-size
            number of usersets after which a relationship query will be split into multiple queries

        --datastore-read-replica-conn-pool-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-read-replica-conn-pool-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-read-replica-conn-pool-read-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-uri
            connection string used by remote datastores for read replicas (e.g. "postgres://postgres:password@localhost:5432/spicedb"). (Postgres and MySQL drivers only).

        --datastore-read-replica-credentials-provider-name
            retrieve datastore credentials dynamically using ("aws-iam")

        --datastore-readonly
            set the service to read-only mode

        --datastore-relationship-integrity-current-key-filename
            current key filename for relationship integrity checks

        --datastore-relationship-integrity-current-key-id
            current key id for relationship integrity checks

        --datastore-relationship-integrity-enabled
            enables relationship integrity checks. (CockroachDB driver only)

        --datastore-relationship-integrity-expired-keys
            config for expired keys for relationship integrity checks

        --datastore-relaxed-isolation-level
            used to relax the isolation level used in transactions (Postgres driver only)

        --datastore-request-hedging
            enable request hedging

        --datastore-request-hedging-initial-slow-value
            initial value to use for slow datastore requests, before statistics have been collected

        --datastore-request-hedging-max-requests
            maximum number of historical requests to consider

        --datastore-request-hedging-quantile
            quantile of historical datastore request time over which a request will be considered slow

        --datastore-revision-fuzzing-duration
            amount of time to advertize stale revisions

        --datastore-revision-quantization-interval
            boundary interval to which to round the quantized revision

        --datastore-revision-quantization-max-staleness-percent
            float percentage (where 1 = 100%!)(MISSING) of the revision quantization interval where we may opt to select a stale revision for performance reasons. Defaults to 0.1 (representing 10%!)(MISSING)

        --datastore-spanner-credentials
            path to service account key credentials file with access to the cloud spanner instance (omit to use application default credentials)

        --datastore-spanner-emulator-host
            URI of spanner emulator instance used for development and testing (e.g. localhost:9010)

        --datastore-spanner-max-sessions
            maximum number of sessions across all Spanner gRPC connections the client can have at a given time

        --datastore-spanner-metrics
            configure the metrics that are emitted by the Spanner datastore ("none", "native", "otel")

        --datastore-spanner-min-sessions
            minimum number of sessions across all Spanner gRPC connections the client can have at a given time

        --datastore-tx-overlap-key
            static key to touch when writing to ensure transactions overlap (only used if --datastore-tx-overlap-strategy=static is set; CockroachDB driver only)

        --datastore-tx-overlap-strategy
            strategy to generate transaction overlap keys ("request", "prefix", "static", "insecure") (CockroachDB driver only - see https://spicedb.dev/d/crdb-overlap for details)

        --datastore-watch-buffer-length
            how large the watch buffer should be before blocking

        --datastore-watch-buffer-write-timeout
            how long the watch buffer should queue before forcefully disconnecting the reader

        --datastore-watch-change-buffer-maximum-size
            how much memory to reserve for the watch change buffer, either as a quantity of bytes (e.g. 5Gi) or a percentage of available memory (e.g. 50%!)(MISSING). if this value is exceeded, the watch will error and must be restarted.

        --datastore-watch-connect-timeout
            how long the watch connection to the underlying datastore should wait before timing out (CockroachDB driver only)

        --otel-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-insecure
            connect to the OpenTelemetry collector in plaintext

        --otel-jaeger-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-jaeger-service-name
            service name for trace data

        --otel-provider
            OpenTelemetry provider for tracing ("none", "otlphttp", "otlpgrpc")

        --otel-sample-ratio
            ratio of traces that are sampled

        --otel-service-name
            service name for trace data

        --otel-trace-propagator
            OpenTelemetry trace propagation format ("b3", "w3c", "ottrace"). Add multiple propagators separated by comma.

        --pprof-block-profile-rate
            sets the block profile sampling rate (between 0 and 1)

        --pprof-mutex-profile-rate
            sets the mutex profile sampling rate (between 0 and 1)

        --termination-log-path
            local path to the termination log file, which contains a JSON payload to surface as reason for termination

        --write-conn-acquisition-timeout
            amount of time that the server will wait for a connection to the datastore to become available when performing a write operation before throwing a ResourceExhausted error. 0 means wait indefinitely. (CockroachDB driver only)

    head
        compute the head (latest) database migration revision available

    OPTIONS
        --datastore-engine type of datastore to initialize ("cockroachdb", "mysql", "postgres", "spanner")

        --otel-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-insecure
            connect to the OpenTelemetry collector in plaintext

        --otel-jaeger-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-jaeger-service-name
            service name for trace data

        --otel-provider
            OpenTelemetry provider for tracing ("none", "otlphttp", "otlpgrpc")

        --otel-sample-ratio
            ratio of traces that are sampled

        --otel-service-name
            service name for trace data

        --otel-trace-propagator
            OpenTelemetry trace propagation format ("b3", "w3c", "ottrace"). Add multiple propagators separated by comma.

        --pprof-block-profile-rate
            sets the block profile sampling rate (between 0 and 1)

        --pprof-mutex-profile-rate
            sets the mutex profile sampling rate (between 0 and 1)

        --termination-log-path
            local path to the termination log file, which contains a JSON payload to surface as reason for termination

    migrate [revision]
        execute datastore schema migrations

    OPTIONS
        --datastore-conn-uri connection string used by remote datastores (e.g. "postgres://postgres:password@localhost:5432/spicedb")

        --datastore-credentials-provider-name
            retrieve datastore credentials dynamically using ("aws-iam")

        --datastore-engine
            type of datastore to initialize ("cockroachdb", "mysql", "postgres", "spanner")

        --datastore-mysql-table-prefix
            prefix to add to the name of all mysql database tables

        --datastore-spanner-credentials
            path to service account key credentials file with access to the cloud spanner instance (omit to use application default credentials)

        --datastore-spanner-emulator-host
            URI of spanner emulator instance used for development and testing (e.g. localhost:9010)

        --migration-backfill-batch-size
            number of items to migrate per iteration of a datastore backfill

        --migration-timeout
            defines a timeout for the execution of the migration, set to 1 hour by default

        --otel-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-insecure
            connect to the OpenTelemetry collector in plaintext

        --otel-jaeger-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-jaeger-service-name
            service name for trace data

        --otel-provider
            OpenTelemetry provider for tracing ("none", "otlphttp", "otlpgrpc")

        --otel-sample-ratio
            ratio of traces that are sampled

        --otel-service-name
            service name for trace data

        --otel-trace-propagator
            OpenTelemetry trace propagation format ("b3", "w3c", "ottrace"). Add multiple propagators separated by comma.

        --pprof-block-profile-rate
            sets the block profile sampling rate (between 0 and 1)

        --pprof-mutex-profile-rate
            sets the mutex profile sampling rate (between 0 and 1)

        --termination-log-path
            local path to the termination log file, which contains a JSON payload to surface as reason for termination

    repair
        executes datastore repair

    OPTIONS
        --datastore-allowed-migrations migration levels that will not fail the health check (in addition to the current head migration)

        --datastore-bootstrap-files
            bootstrap data yaml files to load

        --datastore-bootstrap-overwrite
            overwrite any existing data with bootstrap data (this can be quite slow)

        --datastore-bootstrap-timeout
            maximum duration before timeout for the bootstrap data to be written

        --datastore-conn-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-conn-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-conn-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-conn-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-conn-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-conn-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-read-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-conn-pool-read-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-conn-pool-read-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-conn-pool-read-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-conn-pool-read-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-read-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-write-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-conn-pool-write-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-conn-pool-write-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-conn-pool-write-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-conn-pool-write-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-conn-pool-write-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-conn-uri
            connection string used by remote datastores (e.g. "postgres://postgres:password@localhost:5432/spicedb")

        --datastore-connect-rate
            rate at which new connections are allowed to the datastore (at a rate of 1/duration) (CockroachDB driver only)

        --datastore-connection-balancing
            enable connection balancing between database nodes (CockroachDB driver only)

        --datastore-credentials-provider-name
            retrieve datastore credentials dynamically using ("aws-iam")

        --datastore-disable-stats
            disable recording relationship counts to the stats table

        --datastore-disable-watch-support
            disable watch support (only enable if you absolutely do not need watch)

        --datastore-engine
            type of datastore to initialize ("cockroachdb", "mysql", "postgres", "spanner")

        --datastore-experimental-column-optimization
            enable experimental column optimization

        --datastore-follower-read-delay-duration
            amount of time to subtract from non-sync revision timestamps to ensure they are sufficiently in the past to enable follower reads (CockroachDB and Spanner drivers only) or read replicas (Postgres and MySQL drivers only)

        --datastore-gc-interval
            amount of time between passes of garbage collection (Postgres driver only)

        --datastore-gc-max-operation-time
            maximum amount of time a garbage collection pass can operate before timing out (Postgres driver only)

        --datastore-gc-window
            amount of time before revisions are garbage collected

        --datastore-include-query-parameters-in-traces
            include query parameters in traces (Postgres and CockroachDB drivers only)

        --datastore-max-tx-retries
            number of times a retriable transaction should be retried

        --datastore-migration-phase
            datastore-specific flag that should be used to signal to a datastore which phase of a multi-step migration it is in

        --datastore-mysql-table-prefix
            prefix to add to the name of all SpiceDB database tables

        --datastore-prometheus-metrics
            set to false to disable metrics from the datastore (do not use for Spanner; setting to false will disable metrics to the configured metrics store in Spanner)

        --datastore-query-userset-batch-size
            number of usersets after which a relationship query will be split into multiple queries

        --datastore-read-replica-conn-pool-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-read-replica-conn-pool-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-healthcheck-interval
            amount of time between connection health checks in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-max-idletime
            maximum amount of time a connection can idle in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-max-lifetime
            maximum amount of time a connection can live in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-max-lifetime-jitter
            waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

        --datastore-read-replica-conn-pool-read-max-open
            number of concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-pool-read-min-open
            number of minimum concurrent connections open in a remote datastore's connection pool

        --datastore-read-replica-conn-uri
            connection string used by remote datastores for read replicas (e.g. "postgres://postgres:password@localhost:5432/spicedb"). (Postgres and MySQL drivers only).

        --datastore-read-replica-credentials-provider-name
            retrieve datastore credentials dynamically using ("aws-iam")

        --datastore-readonly
            set the service to read-only mode

        --datastore-relationship-integrity-current-key-filename
            current key filename for relationship integrity checks

        --datastore-relationship-integrity-current-key-id
            current key id for relationship integrity checks

        --datastore-relationship-integrity-enabled
            enables relationship integrity checks. (CockroachDB driver only)

        --datastore-relationship-integrity-expired-keys
            config for expired keys for relationship integrity checks

        --datastore-relaxed-isolation-level
            used to relax the isolation level used in transactions (Postgres driver only)

        --datastore-request-hedging
            enable request hedging

        --datastore-request-hedging-initial-slow-value
            initial value to use for slow datastore requests, before statistics have been collected

        --datastore-request-hedging-max-requests
            maximum number of historical requests to consider

        --datastore-request-hedging-quantile
            quantile of historical datastore request time over which a request will be considered slow

        --datastore-revision-fuzzing-duration
            amount of time to advertize stale revisions

        --datastore-revision-quantization-interval
            boundary interval to which to round the quantized revision

        --datastore-revision-quantization-max-staleness-percent
            float percentage (where 1 = 100%!)(MISSING) of the revision quantization interval where we may opt to select a stale revision for performance reasons. Defaults to 0.1 (representing 10%!)(MISSING)

        --datastore-spanner-credentials
            path to service account key credentials file with access to the cloud spanner instance (omit to use application default credentials)

        --datastore-spanner-emulator-host
            URI of spanner emulator instance used for development and testing (e.g. localhost:9010)

        --datastore-spanner-max-sessions
            maximum number of sessions across all Spanner gRPC connections the client can have at a given time

        --datastore-spanner-metrics
            configure the metrics that are emitted by the Spanner datastore ("none", "native", "otel")

        --datastore-spanner-min-sessions
            minimum number of sessions across all Spanner gRPC connections the client can have at a given time

        --datastore-tx-overlap-key
            static key to touch when writing to ensure transactions overlap (only used if --datastore-tx-overlap-strategy=static is set; CockroachDB driver only)

        --datastore-tx-overlap-strategy
            strategy to generate transaction overlap keys ("request", "prefix", "static", "insecure") (CockroachDB driver only - see https://spicedb.dev/d/crdb-overlap for details)

        --datastore-watch-buffer-length
            how large the watch buffer should be before blocking

        --datastore-watch-buffer-write-timeout
            how long the watch buffer should queue before forcefully disconnecting the reader

        --datastore-watch-change-buffer-maximum-size
            how much memory to reserve for the watch change buffer, either as a quantity of bytes (e.g. 5Gi) or a percentage of available memory (e.g. 50%!)(MISSING). if this value is exceeded, the watch will error and must be restarted.

        --datastore-watch-connect-timeout
            how long the watch connection to the underlying datastore should wait before timing out (CockroachDB driver only)

        --otel-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-insecure
            connect to the OpenTelemetry collector in plaintext

        --otel-jaeger-endpoint
            OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

        --otel-jaeger-service-name
            service name for trace data

        --otel-provider
            OpenTelemetry provider for tracing ("none", "otlphttp", "otlpgrpc")

        --otel-sample-ratio
            ratio of traces that are sampled

        --otel-service-name
            service name for trace data

        --otel-trace-propagator
            OpenTelemetry trace propagation format ("b3", "w3c", "ottrace"). Add multiple propagators separated by comma.

        --pprof-block-profile-rate
            sets the block profile sampling rate (between 0 and 1)

        --pprof-mutex-profile-rate
            sets the mutex profile sampling rate (between 0 and 1)

        --termination-log-path
            local path to the termination log file, which contains a JSON payload to surface as reason for termination

        --write-conn-acquisition-timeout
            amount of time that the server will wait for a connection to the datastore to become available when performing a write operation before throwing a ResourceExhausted error. 0 means wait indefinitely. (CockroachDB driver only)

help [command]
    Help about any command

lsp
    serve language server protocol

OPTIONS
    --addr address to listen on to serve LSP

    --stdio
        enable stdio mode for LSP

man
    Generate man page

OPTIONS
    -h, --help help for man

    --log-format
        format of logs ("auto", "console", "json")

    --log-level
        verbosity of logging ("trace", "debug", "info", "warn", "error")

    --skip-release-check
        if true, skips checking for new SpiceDB releases

postgres-fdw
    serve a Postgres Foreign Data Wrapper for SpiceDB (EXPERIMENTAL)

OPTIONS
    --postgres-access-token-secret (required) The password that Postgres will use to authenticate to the FDW proxy (configured in the Postgres FDW extension's OPTIONS)

    --postgres-endpoint
        The endpoint at which to serve the Postgres protocol

    --postgres-username
        The username that Postgres will use to connect to the FDW proxy

    --spicedb-access-token-secret
        (required) Access token for calling the SpiceDB API

    --spicedb-api-endpoint
        SpiceDB API endpoint

    --spicedb-insecure
        Use insecure connection to SpiceDB API

serve
    serve the permissions database

OPTIONS
    --dashboard-addr address to listen on to serve dashboard

    --dashboard-enabled
        enable http dashboard server

    --dashboard-tls-cert-path
        local path to the TLS certificate used to serve dashboard

    --dashboard-tls-key-path
        local path to the TLS key used to serve dashboard

    --datastore-allowed-migrations
        migration levels that will not fail the health check (in addition to the current head migration)

    --datastore-bootstrap-files
        bootstrap data yaml files to load

    --datastore-bootstrap-overwrite
        overwrite any existing data with bootstrap data (this can be quite slow)

    --datastore-bootstrap-timeout
        maximum duration before timeout for the bootstrap data to be written

    --datastore-conn-healthcheck-interval
        amount of time between connection health checks in a remote datastore's connection pool

    --datastore-conn-max-idletime
        maximum amount of time a connection can idle in a remote datastore's connection pool

    --datastore-conn-max-lifetime
        maximum amount of time a connection can live in a remote datastore's connection pool

    --datastore-conn-max-lifetime-jitter
        waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

    --datastore-conn-max-open
        number of concurrent connections open in a remote datastore's connection pool

    --datastore-conn-min-open
        number of minimum concurrent connections open in a remote datastore's connection pool

    --datastore-conn-pool-read-healthcheck-interval
        amount of time between connection health checks in a remote datastore's connection pool

    --datastore-conn-pool-read-max-idletime
        maximum amount of time a connection can idle in a remote datastore's connection pool

    --datastore-conn-pool-read-max-lifetime
        maximum amount of time a connection can live in a remote datastore's connection pool

    --datastore-conn-pool-read-max-lifetime-jitter
        waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

    --datastore-conn-pool-read-max-open
        number of concurrent connections open in a remote datastore's connection pool

    --datastore-conn-pool-read-min-open
        number of minimum concurrent connections open in a remote datastore's connection pool

    --datastore-conn-pool-write-healthcheck-interval
        amount of time between connection health checks in a remote datastore's connection pool

    --datastore-conn-pool-write-max-idletime
        maximum amount of time a connection can idle in a remote datastore's connection pool

    --datastore-conn-pool-write-max-lifetime
        maximum amount of time a connection can live in a remote datastore's connection pool

    --datastore-conn-pool-write-max-lifetime-jitter
        waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

    --datastore-conn-pool-write-max-open
        number of concurrent connections open in a remote datastore's connection pool

    --datastore-conn-pool-write-min-open
        number of minimum concurrent connections open in a remote datastore's connection pool

    --datastore-conn-uri
        connection string used by remote datastores (e.g. "postgres://postgres:password@localhost:5432/spicedb")

    --datastore-connect-rate
        rate at which new connections are allowed to the datastore (at a rate of 1/duration) (CockroachDB driver only)

    --datastore-connection-balancing
        enable connection balancing between database nodes (CockroachDB driver only)

    --datastore-credentials-provider-name
        retrieve datastore credentials dynamically using ("aws-iam")

    --datastore-disable-stats
        disable recording relationship counts to the stats table

    --datastore-disable-watch-support
        disable watch support (only enable if you absolutely do not need watch)

    --datastore-engine
        type of datastore to initialize ("cockroachdb", "mysql", "postgres", "spanner")

    --datastore-experimental-column-optimization
        enable experimental column optimization

    --datastore-follower-read-delay-duration
        amount of time to subtract from non-sync revision timestamps to ensure they are sufficiently in the past to enable follower reads (CockroachDB and Spanner drivers only) or read replicas (Postgres and MySQL drivers only)

    --datastore-gc-interval
        amount of time between passes of garbage collection (Postgres driver only)

    --datastore-gc-max-operation-time
        maximum amount of time a garbage collection pass can operate before timing out (Postgres driver only)

    --datastore-gc-window
        amount of time before revisions are garbage collected

    --datastore-include-query-parameters-in-traces
        include query parameters in traces (Postgres and CockroachDB drivers only)

    --datastore-max-tx-retries
        number of times a retriable transaction should be retried

    --datastore-migration-phase
        datastore-specific flag that should be used to signal to a datastore which phase of a multi-step migration it is in

    --datastore-mysql-table-prefix
        prefix to add to the name of all SpiceDB database tables

    --datastore-prometheus-metrics
        set to false to disable metrics from the datastore (do not use for Spanner; setting to false will disable metrics to the configured metrics store in Spanner)

    --datastore-query-userset-batch-size
        number of usersets after which a relationship query will be split into multiple queries

    --datastore-read-replica-conn-pool-healthcheck-interval
        amount of time between connection health checks in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-max-idletime
        maximum amount of time a connection can idle in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-max-lifetime
        maximum amount of time a connection can live in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-max-lifetime-jitter
        waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

    --datastore-read-replica-conn-pool-max-open
        number of concurrent connections open in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-min-open
        number of minimum concurrent connections open in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-read-healthcheck-interval
        amount of time between connection health checks in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-read-max-idletime
        maximum amount of time a connection can idle in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-read-max-lifetime
        maximum amount of time a connection can live in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-read-max-lifetime-jitter
        waits rand(0, jitter) after a connection is open for max lifetime to actually close the connection (default: 20%!o(MISSING)f max lifetime, 30m for CockroachDB)

    --datastore-read-replica-conn-pool-read-max-open
        number of concurrent connections open in a remote datastore's connection pool

    --datastore-read-replica-conn-pool-read-min-open
        number of minimum concurrent connections open in a remote datastore's connection pool

    --datastore-read-replica-conn-uri
        connection string used by remote datastores for read replicas (e.g. "postgres://postgres:password@localhost:5432/spicedb"). (Postgres and MySQL drivers only).

    --datastore-read-replica-credentials-provider-name
        retrieve datastore credentials dynamically using ("aws-iam")

    --datastore-readonly
        set the service to read-only mode

    --datastore-relationship-integrity-current-key-filename
        current key filename for relationship integrity checks

    --datastore-relationship-integrity-current-key-id
        current key id for relationship integrity checks

    --datastore-relationship-integrity-enabled
        enables relationship integrity checks. (CockroachDB driver only)

    --datastore-relationship-integrity-expired-keys
        config for expired keys for relationship integrity checks

    --datastore-relaxed-isolation-level
        used to relax the isolation level used in transactions (Postgres driver only)

    --datastore-request-hedging
        enable request hedging

    --datastore-request-hedging-initial-slow-value
        initial value to use for slow datastore requests, before statistics have been collected

    --datastore-request-hedging-max-requests
        maximum number of historical requests to consider

    --datastore-request-hedging-quantile
        quantile of historical datastore request time over which a request will be considered slow

    --datastore-revision-fuzzing-duration
        amount of time to advertize stale revisions

    --datastore-revision-quantization-interval
        boundary interval to which to round the quantized revision

    --datastore-revision-quantization-max-staleness-percent
        float percentage (where 1 = 100%!)(MISSING) of the revision quantization interval where we may opt to select a stale revision for performance reasons. Defaults to 0.1 (representing 10%!)(MISSING)

    --datastore-schema-watch-heartbeat
        heartbeat time on the schema watch in the datastore (if supported). 0 means to default to the datastore's minimum.

    --datastore-spanner-credentials
        path to service account key credentials file with access to the cloud spanner instance (omit to use application default credentials)

    --datastore-spanner-emulator-host
        URI of spanner emulator instance used for development and testing (e.g. localhost:9010)

    --datastore-spanner-max-sessions
        maximum number of sessions across all Spanner gRPC connections the client can have at a given time

    --datastore-spanner-metrics
        configure the metrics that are emitted by the Spanner datastore ("none", "native", "otel")

    --datastore-spanner-min-sessions
        minimum number of sessions across all Spanner gRPC connections the client can have at a given time

    --datastore-tx-overlap-key
        static key to touch when writing to ensure transactions overlap (only used if --datastore-tx-overlap-strategy=static is set; CockroachDB driver only)

    --datastore-tx-overlap-strategy
        strategy to generate transaction overlap keys ("request", "prefix", "static", "insecure") (CockroachDB driver only - see https://spicedb.dev/d/crdb-overlap for details)

    --datastore-watch-buffer-length
        how large the watch buffer should be before blocking

    --datastore-watch-buffer-write-timeout
        how long the watch buffer should queue before forcefully disconnecting the reader

    --datastore-watch-change-buffer-maximum-size
        how much memory to reserve for the watch change buffer, either as a quantity of bytes (e.g. 5Gi) or a percentage of available memory (e.g. 50%!)(MISSING). if this value is exceeded, the watch will error and must be restarted.

    --datastore-watch-connect-timeout
        how long the watch connection to the underlying datastore should wait before timing out (CockroachDB driver only)

    --disable-v1-schema-api
        disables the V1 schema API

    --disable-version-response
        disables version response support in the API

    --dispatch-cache-enabled
        enable caching of dispatch calls this server makes to other servers

    --dispatch-cache-kind-for-testing
        choose a different kind of cache, for testing

    --dispatch-cache-max-cost
        upper bound (in bytes or as a percent of available memory) of the cache for dispatch calls this server makes to other servers

    --dispatch-cache-metrics
        enable metrics for the cache for dispatch calls this server makes to other servers

    --dispatch-cache-num-counters
        number of counters for tracking access frequency in the cache for dispatch calls this server makes to other servers. A higher number means more accurate eviction decisions but more memory usage

    --dispatch-check-permission-concurrency-limit
        maximum number of parallel goroutines to create for each check request or subrequest. defaults to --dispatch-concurrency-limit

    --dispatch-chunk-size
        maximum number of object IDs in a dispatched request

    --dispatch-cluster-addr
        address to listen on to serve dispatch

    --dispatch-cluster-cache-enabled
        enable caching of dispatch calls this server receives from other servers

    --dispatch-cluster-cache-kind-for-testing
        choose a different kind of cache, for testing

    --dispatch-cluster-cache-max-cost
        upper bound (in bytes or as a percent of available memory) of the cache for dispatch calls this server receives from other servers

    --dispatch-cluster-cache-metrics
        enable metrics for the cache for dispatch calls this server receives from other servers

    --dispatch-cluster-cache-num-counters
        number of counters for tracking access frequency in the cache for dispatch calls this server receives from other servers. A higher number means more accurate eviction decisions but more memory usage

    --dispatch-cluster-enabled
        enable dispatch gRPC server

    --dispatch-cluster-max-conn-age
        how long a connection serving dispatch should be able to live

    --dispatch-cluster-max-workers
        set the number of workers for this server (0 value means 1 worker per request)

    --dispatch-cluster-network
        network type to serve dispatch ("tcp", "tcp4", "tcp6", "unix", "unixpacket")

    --dispatch-cluster-tls-cert-path
        local path to the TLS certificate used to serve dispatch

    --dispatch-cluster-tls-key-path
        local path to the TLS key used to serve dispatch

    --dispatch-concurrency-limit
        maximum number of parallel goroutines to create for each request or subrequest

    --dispatch-hashring-replication-factor
        set the replication factor of the consistent hasher used for the dispatcher

    --dispatch-hashring-spread
        set the spread of the consistent hasher used for the dispatcher

    --dispatch-lookup-resources-concurrency-limit
        maximum number of parallel goroutines to create for each lookup resources request or subrequest. defaults to --dispatch-concurrency-limit

    --dispatch-lookup-subjects-concurrency-limit
        maximum number of parallel goroutines to create for each lookup subjects request or subrequest. defaults to --dispatch-concurrency-limit

    --dispatch-max-depth
        maximum recursion depth for nested calls

    --dispatch-reachable-resources-concurrency-limit
        maximum number of parallel goroutines to create for each reachable resources request or subrequest. defaults to --dispatch-concurrency-limit

    --dispatch-upstream-addr
        upstream grpc address to dispatch to

    --dispatch-upstream-ca-path
        local path to the TLS CA used when connecting to the dispatch cluster

    --dispatch-upstream-timeout
        maximum duration of a dispatch call an upstream cluster before it times out

    --enable-experimental-lookup-resources
        do not use; this flag is unused and will be removed in a future version

    --enable-experimental-relationship-expiration
        enables experimental support for relationship expiration

    --enable-experimental-watchable-schema-cache
        enables the experimental schema cache, which uses the Watch API to keep the schema up to date

    --enable-memory-protection-middleware
        enables middleware that does a best effort at preventing OOM (Out of Memory) if the server's memory usage is too high by returning ResourceExhausted on incoming requests

    --enable-performance-insight-metrics
        enables performance insight metrics, which are used to track the latency of API calls by shape

    --enable-revision-heartbeat
        enables support for revision heartbeat, used to create a synthetic revision on an interval defined by the quantization window (Postgres driver only)

    --experimental-dispatch-secondary-maximum-primary-hedging-delays
        maximum number of hedging delays to use for each request type to delay the primary request. default is 5ms

    --experimental-dispatch-secondary-upstream-addrs
        secondary upstream addresses for dispatches, each with a name

    --experimental-dispatch-secondary-upstream-exprs
        map from request type to its associated CEL expression, which returns the secondary upstream(s) to be used for the request

    --experimental-lookup-resources-version
        if non-empty, the version of the experimental lookup resources API to use: `lr3` or empty

    --experimental-query-plan
        comma-separated list of operations to route through the experimental query plan engine; valid values are `check`, `lr` (LookupResources), and `ls` (LookupSubjects)

    --grpc-addr
        address to listen on to serve gRPC

    --grpc-enabled
        enable gRPC gRPC server

    --grpc-log-requests-enabled
        enable logging of API request payloads

    --grpc-log-responses-enabled
        enable logging of API response payloads

    --grpc-max-conn-age
        how long a connection serving gRPC should be able to live

    --grpc-max-workers
        set the number of workers for this server (0 value means 1 worker per request)

    --grpc-network
        network type to serve gRPC ("tcp", "tcp4", "tcp6", "unix", "unixpacket")

    --grpc-preshared-key
        (required) preshared key(s) that must be provided by clients to authenticate requests

    --grpc-shutdown-grace-period
        time limit given to the server to shutdown gracefully after it receives SIGINT or SIGTERM. A value of zero means no limit

    --grpc-tls-cert-path
        local path to the TLS certificate used to serve gRPC

    --grpc-tls-key-path
        local path to the TLS key used to serve gRPC

    --http-addr
        address to listen on to serve proxy

    --http-cors-allowed-origins
        Set CORS allowed origins for http gateway, defaults to all origins

    --http-cors-enabled
        DANGEROUS: Enable CORS on the http gateway

    --http-enabled
        enable http proxy server

    --http-tls-cert-path
        local path to the TLS certificate used to serve proxy

    --http-tls-key-path
        local path to the TLS key used to serve proxy

    --http-upstream-override-addr
        Override the upstream to point to a different gRPC server

    --http-upstream-override-tls-cert-path
        Override the upstream TLS certificate

    --lookup-resources-chunk-cache-enabled
        enable caching of LookupResources3 chunks

    --lookup-resources-chunk-cache-kind-for-testing
        choose a different kind of cache, for testing

    --lookup-resources-chunk-cache-max-cost
        upper bound (in bytes or as a percent of available memory) of the cache for LookupResources3 chunks

    --lookup-resources-chunk-cache-metrics
        enable metrics for the cache for LookupResources3 chunks

    --lookup-resources-chunk-cache-num-counters
        number of counters for tracking access frequency in the cache for LookupResources3 chunks. A higher number means more accurate eviction decisions but more memory usage

    --max-bulk-export-relationships-limit
        maximum number of relationships that can be exported in a single request

    --max-caveat-context-size
        maximum allowed size of request caveat context in bytes. A value of zero or less means no limit

    --max-datastore-read-page-size
        limit on the maximum page size that we will load into memory from the datastore at one time

    --max-delete-relationships-limit
        maximum number of relationships that can be deleted in a single request

    --max-lookup-resources-limit
        maximum number of resources that can be looked up in a single request

    --max-read-relationships-limit
        maximum number of relationships that can be read in a single request

    --max-relationship-context-size
        maximum allowed size of the context to be stored in a relationship

    --metrics-addr
        address to listen on to serve metrics

    --metrics-enabled
        enable http metrics server

    --metrics-tls-cert-path
        local path to the TLS certificate used to serve metrics

    --metrics-tls-key-path
        local path to the TLS key used to serve metrics

    --mismatch-zed-token-behavior
        behavior to enforce when an API call receives a zedtoken that was originally intended for a different kind of datastore. One of: full-consistency (treat as a full-consistency call, ignoring the zedtoken), min-latency (treat as a min-latency call, ignoring the zedtoken), error (return an error). defaults to full-consistency for safety.

    --ns-cache-enabled
        enable caching of schema

    --ns-cache-expiration
        amount of time a namespace entry should remain cached

    --ns-cache-kind-for-testing
        choose a different kind of cache, for testing

    --ns-cache-max-cost
        upper bound (in bytes or as a percent of available memory) of the cache for schema

    --ns-cache-metrics
        enable metrics for the cache for schema

    --ns-cache-num-counters
        number of counters for tracking access frequency in the cache for schema. A higher number means more accurate eviction decisions but more memory usage

    --otel-endpoint
        OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

    --otel-insecure
        connect to the OpenTelemetry collector in plaintext

    --otel-jaeger-endpoint
        OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

    --otel-jaeger-service-name
        service name for trace data

    --otel-provider
        OpenTelemetry provider for tracing ("none", "otlphttp", "otlpgrpc")

    --otel-sample-ratio
        ratio of traces that are sampled

    --otel-service-name
        service name for trace data

    --otel-trace-propagator
        OpenTelemetry trace propagation format ("b3", "w3c", "ottrace"). Add multiple propagators separated by comma.

    --pprof-block-profile-rate
        sets the block profile sampling rate (between 0 and 1)

    --pprof-mutex-profile-rate
        sets the mutex profile sampling rate (between 0 and 1)

    --schema-prefixes-required
        require prefixes on all object definitions in schemas

    --streaming-api-response-delay-timeout
        maximum time that streaming APIs (LookupSubjects, LookupResources, ReadRelationships and ExportBulkRelationships) can be allowed to run but no response be sent to the client before the stream times out

    --telemetry-ca-override-path
        path to a custom CA to use with the telemetry endpoint

    --telemetry-endpoint
        endpoint to which telemetry is reported, empty string to disable

    --telemetry-interval
        approximate period between telemetry reports, minimum 1 minute

    --termination-log-path
        local path to the termination log file, which contains a JSON payload to surface as reason for termination

    --testing-only-schema-additive-writes
        append new definitions to the existing schema, rather than overwriting it

    --update-relationships-max-preconditions-per-call
        maximum number of preconditions allowed for WriteRelationships and DeleteRelationships calls

    --watch-api-heartbeat
        heartbeat time on the watch in the API. 0 means to default to the datastore's minimum.

    --write-conn-acquisition-timeout
        amount of time that the server will wait for a connection to the datastore to become available when performing a write operation before throwing a ResourceExhausted error. 0 means wait indefinitely. (CockroachDB driver only)

    --write-relationships-max-updates-per-call
        maximum number of updates allowed for WriteRelationships calls

EXAMPLES
        No TLS and in-memory datastore:

            spicedb serve --grpc-preshared-key "somerandomkeyhere"

        TLS and HTTP enabled, and a real datastore:

            spicedb serve --grpc-preshared-key "realkeyhere" \

            --grpc-tls-cert-path path/to/tls/cert --grpc-tls-key-path path/to/tls/key \

            --http-enabled http-tls-cert-path path/to/tls/cert --http-tls-key-path path/to/tls/key \

            --datastore-engine postgres \

            --datastore-conn-uri "postgres-connection-string-here"

serve-testing
    test server with an in-memory datastore

OPTIONS
    --grpc-addr address to listen on to serve gRPC

    --grpc-enabled
        enable gRPC gRPC server

    --grpc-max-conn-age
        how long a connection serving gRPC should be able to live

    --grpc-max-workers
        set the number of workers for this server (0 value means 1 worker per request)

    --grpc-network
        network type to serve gRPC ("tcp", "tcp4", "tcp6", "unix", "unixpacket")

    --grpc-shutdown-grace-period
        time limit given to the server to shutdown gracefully after it receives SIGINT or SIGTERM. A value of zero means no limit

    --grpc-tls-cert-path
        local path to the TLS certificate used to serve gRPC

    --grpc-tls-key-path
        local path to the TLS key used to serve gRPC

    --http-addr
        address to listen on to serve http

    --http-enabled
        enable http http server

    --http-tls-cert-path
        local path to the TLS certificate used to serve http

    --http-tls-key-path
        local path to the TLS key used to serve http

    --load-configs
        configuration yaml files to load

    --max-bulk-export-relationships-limit
        maximum number of relationships that can be exported in a single request

    --max-caveat-context-size
        maximum allowed size of request caveat context in bytes. A value of zero or less means no limit

    --max-delete-relationships-limit
        maximum number of relationships that can be deleted in a single request

    --max-lookup-resources-limit
        maximum number of resources that can be looked up in a single request

    --max-read-relationships-limit
        maximum number of relationships that can be read in a single request

    --max-relationship-context-size
        maximum allowed size of the context to be stored in a relationship

    --otel-endpoint
        OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

    --otel-insecure
        connect to the OpenTelemetry collector in plaintext

    --otel-jaeger-endpoint
        OpenTelemetry collector endpoint - the endpoint can also be set by using enviroment variables

    --otel-jaeger-service-name
        service name for trace data

    --otel-provider
        OpenTelemetry provider for tracing ("none", "otlphttp", "otlpgrpc")

    --otel-sample-ratio
        ratio of traces that are sampled

    --otel-service-name
        service name for trace data

    --otel-trace-propagator
        OpenTelemetry trace propagation format ("b3", "w3c", "ottrace"). Add multiple propagators separated by comma.

    --pprof-block-profile-rate
        sets the block profile sampling rate (between 0 and 1)

    --pprof-mutex-profile-rate
        sets the mutex profile sampling rate (between 0 and 1)

    --readonly-grpc-addr
        address to listen on to serve read-only gRPC

    --readonly-grpc-enabled
        enable read-only gRPC gRPC server

    --readonly-grpc-max-conn-age
        how long a connection serving read-only gRPC should be able to live

    --readonly-grpc-max-workers
        set the number of workers for this server (0 value means 1 worker per request)

    --readonly-grpc-network
        network type to serve read-only gRPC ("tcp", "tcp4", "tcp6", "unix", "unixpacket")

    --readonly-grpc-tls-cert-path
        local path to the TLS certificate used to serve read-only gRPC

    --readonly-grpc-tls-key-path
        local path to the TLS key used to serve read-only gRPC

    --readonly-http-addr
        address to listen on to serve read-only HTTP

    --readonly-http-enabled
        enable http read-only HTTP server

    --readonly-http-tls-cert-path
        local path to the TLS certificate used to serve read-only HTTP

    --readonly-http-tls-key-path
        local path to the TLS key used to serve read-only HTTP

    --termination-log-path
        local path to the termination log file, which contains a JSON payload to surface as reason for termination

    --update-relationships-max-preconditions-per-call
        maximum number of preconditions allowed for WriteRelationships and DeleteRelationships calls

    --write-relationships-max-updates-per-call
        maximum number of updates allowed for WriteRelationships calls

version
    displays the version of SpiceDB

OPTIONS
    --include-deps include dependencies' versions

EXAMPLES

No TLS and in-memory datastore:

        spicedb serve --grpc-preshared-key "somerandomkeyhere"

    TLS and HTTP enabled, and a real datastore:

        spicedb serve --grpc-preshared-key "realkeyhere" \

        --grpc-tls-cert-path path/to/tls/cert --grpc-tls-key-path path/to/tls/key \

        --http-enabled http-tls-cert-path path/to/tls/cert --http-tls-key-path path/to/tls/key \

        --datastore-engine postgres \

        --datastore-conn-uri "postgres-connection-string-here"