vgs-cli 1.34.0.dev1__py3-none-any.whl → 1.34.0.dev2__py3-none-any.whl

vgs_cli-1.34.0.dev2.data/data/vgscli/credentials-admin.yaml

@@ -0,0 +1,26 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read
+    - name: cards:write
+    - name: card-attributes:read
+    - name: network-tokens:read
+    - name: network-tokens:write
+    - name: 3ds:write
+    - name: 3ds:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgs_cli-1.34.0.dev1.data/data/vgscli/calm.yaml → vgs_cli-1.34.0.dev2.data/data/vgscli/public-credential-collect.yaml

@@ -1,7 +1,10 @@
 apiVersion: 1.0.0
 kind: ServiceAccount
 data:
-  name: calm
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
   {%- if vaults | length == 0 %}
       {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
   {% elif vaults | length == 1 %}
@@ -12,5 +15,7 @@ data:
   {% endif %}
   scopes:
     - name: cards:write
+    - name: card-attributes:read
     - name: network-tokens:write
-    - name: merchants:write
+    - name: 3ds:write
+    - name: 3ds:read

vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-no-pci.yaml

@@ -0,0 +1,22 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read
+    - name: cards-attributes:read
+    - name: network-tokens:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-with-pci.yaml

@@ -0,0 +1,23 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read-pci
+    - name: cards:read
+    - name: card-attributes:read
+    - name: network-tokens:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

{vgs_cli-1.34.0.dev1.dist-info → vgs_cli-1.34.0.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vgs-cli
-Version: 1.34.0.dev1
+Version: 1.34.0.dev2
 Summary: VGS Client
 Home-page: https://github.com/verygoodsecurity/vgs-cli
 Author: Very Good Security
@@ -68,6 +68,7 @@ Command Line Tool for programmatic configurations on VGS.
   - [Routes](#routes)
   - [Collect Forms](#collect-forms)
   - [Access credentials and logs](#access-credentials-and-logs)
+  - [Service accounts](#service-accounts)
   - [Certificates](#certificates)
 - [Automation with VGS CLI](#automation-with-vgs-cli)
 
@@ -101,7 +102,7 @@ Check our [official documentation](https://docs.verygoodsecurity.com/vault/devel
 Install the agent skill:
 
 ```bash
-npx skills add verygoodsecurity/vgs-cli --skill vgs-cli-guide
+npx skills add verygoodsecurity/skills --skill vgs-cli-guide
 ```
 
 The guide covers Dashboard-assisted onboarding, the complete built-in command
@@ -193,6 +194,35 @@ access. The CLI masks generated webhook secrets in its output.
 | `vgs logs access -T <TENANT_ID>` | View tenant access logs. |
 | `vgs logs operations -T <TENANT_ID> -R <REQUEST_ID>` | View request operation logs. |
 
+### Service accounts
+
+Generate a service-account resource for exactly one tenant. Names must contain
+1–20 characters. Save the generated YAML so you can review it before applying
+it.
+
+```bash
+vgs generate service-account --template <TEMPLATE> -T <TENANT_ID> --var name=<NAME> > service-account.yaml
+```
+
+| Template | Purpose |
+| --- | --- |
+| `public-credential-collect` | Collect payment credentials without read access. |
+| `read-credentials-no-pci` | Read tokenized credentials without PCI data. |
+| `read-credentials-with-pci` | Read credentials including PCI data. |
+| `credentials-admin` | Read and write payment credentials. |
+
+After reviewing the generated scopes, apply the resource to the organization:
+
+```bash
+vgs apply service-account -O <ORGANIZATION_ID> -f service-account.yaml
+```
+
+The apply response contains a one-time client secret. Run the command only in
+your private terminal, store the secret in an approved secret manager, and do
+not commit or share the response. See the
+[service-account documentation](https://docs.verygoodsecurity.com/vault/developer-tools/vgs-cli/service-account)
+for the full workflow.
+
 ### Certificates
 
 | Command | Purpose |

{vgs_cli-1.34.0.dev1.dist-info → vgs_cli-1.34.0.dev2.dist-info}/RECORD

@@ -1,21 +1,20 @@
-vgs_cli-1.34.0.dev1.data/data/vgscli/calm.yaml,sha256=HyCIHO5LZdPaeczNw_IOSGxzBBhrSa42lWtGm3GF4mY,448
-vgs_cli-1.34.0.dev1.data/data/vgscli/checkout.yaml,sha256=O2hfGAmgLcM9BGvo4tjIhMe8DX1x6Tbj0Ep6dSxmu2I,555
-vgs_cli-1.34.0.dev1.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
-vgs_cli-1.34.0.dev1.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
-vgs_cli-1.34.0.dev1.data/data/vgscli/http-route-template.yaml,sha256=HHKoTF4pSGWUTR1lsw6CIBNdTvTyqNjkeocco80_K38,1663
-vgs_cli-1.34.0.dev1.data/data/vgscli/mft-route-template.yaml,sha256=3TwiVS6yDir3uc0g0G_p5Hj4Gje2aq8Zi6vnnRa4j5Q,142
-vgs_cli-1.34.0.dev1.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
-vgs_cli-1.34.0.dev1.data/data/vgscli/payments-admin.yaml,sha256=zMTRLAeuSrMdDZau7AdHr2GVBbvblwxrj1hCZfR4zE8,700
-vgs_cli-1.34.0.dev1.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
-vgs_cli-1.34.0.dev1.data/data/vgscli/sub-account-checkout.yaml,sha256=bTYscQeNxU2nfNzSeZ3ffmVFni4Iuigh1rxd2_uKn3M,629
-vgs_cli-1.34.0.dev1.data/data/vgscli/tenant-template.yaml,sha256=Q0z5_ds5UWign6ndBodLtXVZHWWCV-VsUVMnvJAhqPM,388
-vgs_cli-1.34.0.dev1.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
-vgs_cli-1.34.0.dev1.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.34.0.dev1.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
-vgs_cli-1.34.0.dev1.data/data/vgscli/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
-vgs_cli-1.34.0.dev1.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
+vgs_cli-1.34.0.dev2.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
+vgs_cli-1.34.0.dev2.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
+vgs_cli-1.34.0.dev2.data/data/vgscli/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
+vgs_cli-1.34.0.dev2.data/data/vgscli/http-route-template.yaml,sha256=HHKoTF4pSGWUTR1lsw6CIBNdTvTyqNjkeocco80_K38,1663
+vgs_cli-1.34.0.dev2.data/data/vgscli/mft-route-template.yaml,sha256=3TwiVS6yDir3uc0g0G_p5Hj4Gje2aq8Zi6vnnRa4j5Q,142
+vgs_cli-1.34.0.dev2.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
+vgs_cli-1.34.0.dev2.data/data/vgscli/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
+vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-no-pci.yaml,sha256=7-31MJewfRI8VVveobdLjeusYE1Edk1xRrWplU3VMow,770
+vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
+vgs_cli-1.34.0.dev2.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
+vgs_cli-1.34.0.dev2.data/data/vgscli/tenant-template.yaml,sha256=Q0z5_ds5UWign6ndBodLtXVZHWWCV-VsUVMnvJAhqPM,388
+vgs_cli-1.34.0.dev2.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
+vgs_cli-1.34.0.dev2.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
+vgs_cli-1.34.0.dev2.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
+vgs_cli-1.34.0.dev2.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
 vgscli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-vgscli/_version.py,sha256=jSgEG5ngMCbPHjsKfIz3Kd6tsEFJ6WBXqEyoHrQosqg,1681
+vgscli/_version.py,sha256=LLDTvaySlCanrTjEZQVXiEcbLIGJtg9ZoJOV79fURSM,1681
 vgscli/access_logs.py,sha256=G0GjlLjWiC-N6OzK6-RCvWddcVGQlLCLAcyO9pLWIOM,1928
 vgscli/audits_api.py,sha256=6FjpS1yTALio-DejgIS2eDw75ChjDp4GoAGXh4uZExU,3211
 vgscli/auth.py,sha256=vdUZ12nqtefIuSHNmwCFvxoqwS3m6ZP5TqLZFNwKnSU,2104
@@ -24,7 +23,7 @@ vgscli/auth_utils.py,sha256=aC1VI0dFdFeupLS9Okz4uDz-wHhhFabqiLUg2R5vO2s,600
 vgscli/callback_server.py,sha256=oFFF5AGbbwhF7Hsc5fzS7jeGFzIMbebc9Qdq8uEl1PY,1055
 vgscli/cert_manager_api.py,sha256=ek25BcyGeUo0pBoqineMTYMgmQaYJfimFFHMljZh5yA,1646
 vgscli/cli_utils.py,sha256=NzXK29_yIDrB-3T_XdLLB8NCWneQ-cpZFi9mazQL9tQ,3810
-vgscli/click_extensions.py,sha256=1E0yyAMBn1xmZvi9Gz3FNAp1ir1JTZIVC6eUHz2gPh0,6667
+vgscli/click_extensions.py,sha256=VoaBJpR_ZVNQYTX1x-TZrGAyLiuAGXQq_ZkLU7Y6sZ0,6678
 vgscli/collect_forms.py,sha256=HAg-tvpXxmVq5Zns4v8G0cP-tgYKuWmVFwzuNjieu-A,4619
 vgscli/collect_forms_api.py,sha256=JHnnsOUyStD7yR92LfGqn8DOpnu0l0yqTUMQnWE_NGs,1246
 vgscli/config_file.py,sha256=HB8lANU0qoO09Wnkf-QDzPh2qtrnFcqcetnCaQgtQ3U,1543
@@ -43,7 +42,7 @@ vgscli/cli/commands/__init__.py,sha256=8ptc9-Vzdx0HU3ZeMcKERYjmJyuB5IMjBSF3Igx5y
 vgscli/cli/commands/apply.py,sha256=D3YwW9vNxyq25IuObfd_jPM0m-U_GmrNauN0wS1LL0U,20049
 vgscli/cli/commands/certificate.py,sha256=xQV-G8ZWP9uPFqrczlCpCZkHUt2aJflBP2cc5hjobIw,22930
 vgscli/cli/commands/delete.py,sha256=2nuYKhp0FhoGTcmJUECjRnlYrKLdAgIoIp-y25ViwDg,3873
-vgscli/cli/commands/generate.py,sha256=nkS5--kBHbJhUo7QvslGza5c8Cu2ue-bVitDVGwUYFE,4025
+vgscli/cli/commands/generate.py,sha256=k0bw3Cu8Y6qs0sHHnC-CBtlvnl7Rzx2rjlCwTCFaWes,4117
 vgscli/cli/commands/get.py,sha256=5X9CS8FdC33JUwGn-0qaZYDPeNakhfxSU8aX40LPW-M,8818
 vgscli/cli/types/__init__.py,sha256=a-P-SoGHpLzMg7CL1hhg5x_nf6sHq0qAuGm_AtIITmw,107
 vgscli/cli/types/resource_id.py,sha256=7JILR-KjoVGQDHB40tXJfTcU53iR8wM9Zr24fY5le3o,1172
@@ -52,19 +51,18 @@ vgscli/resource-templates/http-route-template.yaml,sha256=HHKoTF4pSGWUTR1lsw6CIB
 vgscli/resource-templates/mft-route-template.yaml,sha256=3TwiVS6yDir3uc0g0G_p5Hj4Gje2aq8Zi6vnnRa4j5Q,142
 vgscli/resource-templates/tenant-template.yaml,sha256=Q0z5_ds5UWign6ndBodLtXVZHWWCV-VsUVMnvJAhqPM,388
 vgscli/resource-templates/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
-vgscli/resource-templates/service-account/calm.yaml,sha256=HyCIHO5LZdPaeczNw_IOSGxzBBhrSa42lWtGm3GF4mY,448
-vgscli/resource-templates/service-account/checkout.yaml,sha256=O2hfGAmgLcM9BGvo4tjIhMe8DX1x6Tbj0Ep6dSxmu2I,555
-vgscli/resource-templates/service-account/payments-admin.yaml,sha256=zMTRLAeuSrMdDZau7AdHr2GVBbvblwxrj1hCZfR4zE8,700
-vgscli/resource-templates/service-account/sub-account-checkout.yaml,sha256=bTYscQeNxU2nfNzSeZ3ffmVFni4Iuigh1rxd2_uKn3M,629
-vgscli/resource-templates/service-account/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
+vgscli/resource-templates/service-account/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
+vgscli/resource-templates/service-account/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
+vgscli/resource-templates/service-account/read-credentials-no-pci.yaml,sha256=7-31MJewfRI8VVveobdLjeusYE1Edk1xRrWplU3VMow,770
+vgscli/resource-templates/service-account/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
 vgscli/validation-schemas/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
 vgscli/validation-schemas/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
 vgscli/validation-schemas/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
 vgscli/validation-schemas/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
 vgscli/validation-schemas/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
 vgscli/validation-schemas/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.34.0.dev1.dist-info/METADATA,sha256=o_FK_V1YOjifeIbViaTjn4uVWcO54H-WN1V3_qrzF5g,7050
-vgs_cli-1.34.0.dev1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-vgs_cli-1.34.0.dev1.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
-vgs_cli-1.34.0.dev1.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
-vgs_cli-1.34.0.dev1.dist-info/RECORD,,
+vgs_cli-1.34.0.dev2.dist-info/METADATA,sha256=xUPQHj1GSm6f6bBcNqliRrHQEDwNBgnx_elm2S38jWg,8226
+vgs_cli-1.34.0.dev2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+vgs_cli-1.34.0.dev2.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
+vgs_cli-1.34.0.dev2.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
+vgs_cli-1.34.0.dev2.dist-info/RECORD,,

vgscli/_version.py

@@ -6,7 +6,7 @@ from packaging.version import InvalidVersion, Version
 
 from vgscli.text import bold, green
 
-__version__ = "1.34.0.dev1"
+__version__ = "1.34.0.dev2"
 
 
 # noinspection PyBroadException

vgscli/cli/commands/generate.py

@@ -98,7 +98,12 @@ def generate_route():
     "--template",
     "-t",
     type=click.Choice(
-        ["vgs-cli", "calm", "checkout", "sub-account-checkout", "payments-admin"]
+        [
+            "public-credential-collect",
+            "read-credentials-no-pci",
+            "read-credentials-with-pci",
+            "credentials-admin",
+        ]
     ),
     help="Predefined service account template configuration",
     required=True,

vgscli/click_extensions.py

@@ -106,7 +106,7 @@ def tenant_selection_option(command):
         "tenants",
         type=click.STRING,
         multiple=True,
-        help="Tenant the Service Account may access. Repeat for multiple tenants.",
+        help="Tenant the Service Account may access. Built-in templates require exactly one.",
     )(wrapper)
     return click.option(
         "--vault",

vgscli/resource-templates/service-account/credentials-admin.yaml

@@ -0,0 +1,26 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read
+    - name: cards:write
+    - name: card-attributes:read
+    - name: network-tokens:read
+    - name: network-tokens:write
+    - name: 3ds:write
+    - name: 3ds:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgscli/resource-templates/service-account/{calm.yaml → public-credential-collect.yaml}

@@ -1,7 +1,10 @@
 apiVersion: 1.0.0
 kind: ServiceAccount
 data:
-  name: calm
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
   {%- if vaults | length == 0 %}
       {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
   {% elif vaults | length == 1 %}
@@ -12,5 +15,7 @@ data:
   {% endif %}
   scopes:
     - name: cards:write
+    - name: card-attributes:read
     - name: network-tokens:write
-    - name: merchants:write
+    - name: 3ds:write
+    - name: 3ds:read

vgscli/resource-templates/service-account/read-credentials-no-pci.yaml

@@ -0,0 +1,22 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read
+    - name: cards-attributes:read
+    - name: network-tokens:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgscli/resource-templates/service-account/read-credentials-with-pci.yaml

@@ -0,0 +1,23 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read-pci
+    - name: cards:read
+    - name: card-attributes:read
+    - name: network-tokens:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgs_cli-1.34.0.dev1.data/data/vgscli/checkout.yaml

@@ -1,21 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  name: {{ name }}
-  {%- if vaults | length == 0 %}
-      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
-  {% elif vaults | length == 1 %}
-  vaults:
-    - {{ vaults[0] }}
-  {%- else %}
-      {{ cli_fail("This template doesn't allow multiple tenants.") }}
-  {% endif %}
-  scopes:
-    - name: financial-instruments:write
-      optional: true
-    - name: transfers:write
-      optional: true
-    - name: orders:write
-      optional: true
-
-  accessTokenLifespan: 28800

vgs_cli-1.34.0.dev1.data/data/vgscli/payments-admin.yaml

@@ -1,25 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  {%- if vaults | length == 0 %}
-      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
-  {%- elif vaults | length == 1 %}
-  name: payments-{{ vaults[0] }}
-  vaults:
-    - {{ vaults[0] }}
-  {%- else %}
-      {{ cli_fail("This template doesn't allow multiple tenants.") }}
-  {% endif %}
-  scopes:
-    - name: financial-instruments:admin
-    - name: gateways:admin
-    - name: rules:admin
-    - name: transfers:admin
-    - name: orders:admin
-    - name: threeds:admin
-    - name: sub-accounts:admin
-    - name: cards:write
-    - name: network-tokens:write
-    - name: merchants:write
-
-  accessTokenLifespan: 28800

vgs_cli-1.34.0.dev1.data/data/vgscli/sub-account-checkout.yaml

@@ -1,23 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  name: {{ sub_account_id }}
-  annotations:
-    "vgs.io/sub-account": "{{ sub_account_id }}"
-  {%- if vaults | length == 0 %}
-      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
-  {% elif vaults | length == 1 %}
-  vaults:
-    - {{ vaults[0] }}
-  {%- else %}
-      {{ cli_fail("This template doesn't allow multiple tenants.") }}
-  {% endif %}
-  scopes:
-    - name: financial-instruments:write
-      optional: true
-    - name: transfers:write
-      optional: true
-    - name: orders:write
-      optional: true
-
-  accessTokenLifespan: 28800

vgs_cli-1.34.0.dev1.data/data/vgscli/vgs-cli.yaml

@@ -1,17 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  name: vgs-cli
-  {%- if vaults | length == 0 %}
-      {{- cli_warn("Service Account won't have access to any tenants inside the organization. If it needs tenant access, use --tenant <TENANT_ID>.") or "" }}
-  {%- else %}
-  vaults:
-    {%- for vault_id in vaults %}
-    - {{ vault_id }}
-    {%- endfor %}
-  {%- endif %}
-  scopes:
-    - name: access-logs:read
-    - name: organizations:read
-    - name: routes:write
-    - name: vaults:write

vgscli/resource-templates/service-account/checkout.yaml

@@ -1,21 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  name: {{ name }}
-  {%- if vaults | length == 0 %}
-      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
-  {% elif vaults | length == 1 %}
-  vaults:
-    - {{ vaults[0] }}
-  {%- else %}
-      {{ cli_fail("This template doesn't allow multiple tenants.") }}
-  {% endif %}
-  scopes:
-    - name: financial-instruments:write
-      optional: true
-    - name: transfers:write
-      optional: true
-    - name: orders:write
-      optional: true
-
-  accessTokenLifespan: 28800

vgscli/resource-templates/service-account/payments-admin.yaml

@@ -1,25 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  {%- if vaults | length == 0 %}
-      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
-  {%- elif vaults | length == 1 %}
-  name: payments-{{ vaults[0] }}
-  vaults:
-    - {{ vaults[0] }}
-  {%- else %}
-      {{ cli_fail("This template doesn't allow multiple tenants.") }}
-  {% endif %}
-  scopes:
-    - name: financial-instruments:admin
-    - name: gateways:admin
-    - name: rules:admin
-    - name: transfers:admin
-    - name: orders:admin
-    - name: threeds:admin
-    - name: sub-accounts:admin
-    - name: cards:write
-    - name: network-tokens:write
-    - name: merchants:write
-
-  accessTokenLifespan: 28800

vgscli/resource-templates/service-account/sub-account-checkout.yaml

@@ -1,23 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  name: {{ sub_account_id }}
-  annotations:
-    "vgs.io/sub-account": "{{ sub_account_id }}"
-  {%- if vaults | length == 0 %}
-      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
-  {% elif vaults | length == 1 %}
-  vaults:
-    - {{ vaults[0] }}
-  {%- else %}
-      {{ cli_fail("This template doesn't allow multiple tenants.") }}
-  {% endif %}
-  scopes:
-    - name: financial-instruments:write
-      optional: true
-    - name: transfers:write
-      optional: true
-    - name: orders:write
-      optional: true
-
-  accessTokenLifespan: 28800

vgscli/resource-templates/service-account/vgs-cli.yaml

@@ -1,17 +0,0 @@
-apiVersion: 1.0.0
-kind: ServiceAccount
-data:
-  name: vgs-cli
-  {%- if vaults | length == 0 %}
-      {{- cli_warn("Service Account won't have access to any tenants inside the organization. If it needs tenant access, use --tenant <TENANT_ID>.") or "" }}
-  {%- else %}
-  vaults:
-    {%- for vault_id in vaults %}
-    - {{ vault_id }}
-    {%- endfor %}
-  {%- endif %}
-  scopes:
-    - name: access-logs:read
-    - name: organizations:read
-    - name: routes:write
-    - name: vaults:write