# swb audience

Who may bind one of the signed-in tenant's own services, to read it and to
maintain it.

## Synopsis

```
usage: swb audience <app> <env> <kind> <name> [--json]
```

## Arguments and flags

| Argument or flag | Takes | Default |
|---|---|---|
| `<app>` | The app the service belongs to. Required. | — |
| `<env>` | The environment it runs in. Required. | — |
| `<kind>` | One of `app`, `api`, `dev-portal`, `site`, `agent` or `data`, in any case. Required. | — |
| `<name>` | Its name within that app and environment. Required. | — |
| `--json` | Nothing. Prints the audience as the API answered it instead of the two lines. | off |
| `--help`, `-h` | Prints the command's help and exits. | off |

## What it prints

Two lines, one per mode:

```
read         every tenant
maintain     weidt-group, atlas-group
```

| Line | What it is |
|---|---|
| `read` | The tenants that may bind the service to read, or `every tenant` where its audience is the whole organization. |
| `maintain` | The tenants that may bind it to maintain, or `no tenant`. |

`--json` prints the audience as the API answered it: `read` and `maintain`,
each a list of tenant ids, a read audience of every tenant answered as
`["org"]`.

## The operation and the permission

`Query.audience`. The caller needs `swb.apps.read` on the tenant. The
service's own execution role reads the same audience, for its gateway
policy and its broker.

## The same act in the console

None: the console has no page for one service's audience.

## Refusals and exit status

Exit status is 0 on success and 1 on a refusal.

| Refusal | When |
|---|---|
| `not signed in or token expired — run swb login` | There is no usable credential. |
| `takes a service's <app> <env> <kind> <name>` | Fewer than the four parts were given. |
| `<kind> takes app, api, dev-portal, site, agent, data, not "<value>"` | The kind is none of those. |
| `NotFound: Service <app>/<env>/<kind>/<name> not found` | The signed-in tenant holds no such service. A service no row stands for has no audience, empty or otherwise. |
| The API's own error text | The control plane refused the read — a caller without `swb.apps.read`, for example. |