gcp.secretmanager.secret.grant-access

Grant one or more principals access to read a Secret Manager secret.

Overview

Property	Value
Workflow type	Linear
Library	Base-gcp
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	GCP CloudConnection UUID.
project_id	string	No	—	GCP project override.
secret_id	string	Yes	—	Secret Manager secret id.
members	list	Yes	—	IAM members such as serviceAccount:name@example.iam.gserviceaccount.com.
role	string	No	—	IAM role, default roles/secretmanager.secretAccessor.
condition	json	No	—	Optional IAM condition.
merge	boolean	No	—	Merge bindings instead of replacing.

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	Echoed connection UUID.
project_id	string	No	—	Effective project id.
secret_id	string	No	—	Secret id.
role	string	No	—	IAM role applied.
members	list	No	—	Members granted by the workflow.
condition	json	No	—	Optional IAM condition.
merge	boolean	No	—	Merge bindings instead of replacing.
etag	string	No	—	Resulting IAM policy etag.
changed	boolean	No	—	True when policy changed.
failure_reason	string	No	—	Human-readable failure reason.
failed_step	string	No	—	Failed logical step.
failed_layer	json	No	—	Engine failed layer envelope.
failed_at_state	string	No	—	State where failure occurred.
error	string	No	—	Error message.
error_type	string	No	—	Error class.

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	preflight	—
granting	No	No	—	complete	—
preflighting	No	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	preflight	preflighting	—
preflighting	execute	granting	—
granting	complete	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "gcp.secretmanager.secret.grant-access",
  "initial_data": {
    "connection_uuid": "value",
    "secret_id": "value",
    "members": "value"
  }
}