# dfe CLI reference

> Rendered from the `dfe` command tree of `ghcr.io/hyperi-io/dfe-engine:v1.22.90`.

dfe - the Data Fusion Engine CLI. Command tree generated from the engine OpenAPI spec.

**Usage**:

```console
$ dfe [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.  [env var: DFE_ENGINE_OUTPUT]
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `-v, --verbose`: Print each request and its answer's status on stderr.  [default: 0]
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--help`: Show this message and exit.

**Commands**:

* `login`: Authenticate and store credentials for...
* `logout`: Clear the stored credential + active...
* `config`: Read and write CLI configuration...
* `local`: Break-glass direct gitops CRUD for when...
* `schema`: Plan, apply and read the DFE ClickHouse...
* `alerts`
* `app-contracts`
* `apps`
* `auth`
* `authoring`
* `backing-services`
* `cel`
* `deployment`
* `field-maps`
* `gitops`
* `governance`
* `helm`
* `hunts`
* `hyperdx`
* `ingest`
* `kafka`
* `library`
* `lifecycle`
* `operations`
* `orgs`
* `pipeline`
* `queries`
* `rules`
* `sample`
* `samples`
* `schemas`
* `scim`
* `services`
* `sources`
* `synthetic-data`
* `system`
* `transforms`
* `usage`

## `dfe login`

Authenticate and store credentials for later commands.

Either pass --api-key, or --username/--password to exchange for a JWT. With no
new credentials but a valid stored one, just re-activates the profile.

**Usage**:

```console
$ dfe login [OPTIONS]
```

**Options**:

* `--url <str>`: Engine base URL, e.g. https://engine.example:8000
* `--api-key <str>`: Authenticate with a static API key.
* `-u, --username <str>`: Username for password login.
* `-p, --password <str>`: Password for password login.
* `--profile <str>`: Named configuration (profile) to write to.
* `--help`: Show this message and exit.

## `dfe logout`

Clear the stored credential + active account for a profile.

**Usage**:

```console
$ dfe logout [OPTIONS]
```

**Options**:

* `--profile <str>`: Named configuration (profile) to clear.
* `--help`: Show this message and exit.

## `dfe config`

Read and write CLI configuration (INI-backed profiles).

**Usage**:

```console
$ dfe config [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `set`: Set a config KEY to VALUE in the active...
* `get`: Print a single config KEY from the active...
* `list`: Print all config keys for the active profile.
* `configurations`: Manage named configurations (profiles).

### `dfe config set`

Set a config KEY to VALUE in the active profile.

**Usage**:

```console
$ dfe config set [OPTIONS] {key} {value}
```

**Arguments**:

* `key`: [required]
* `value`: [required]

**Options**:

* `--help`: Show this message and exit.

### `dfe config get`

Print a single config KEY from the active profile.

**Usage**:

```console
$ dfe config get [OPTIONS] {key}
```

**Arguments**:

* `key`: [required]

**Options**:

* `--help`: Show this message and exit.

### `dfe config list`

Print all config keys for the active profile.

**Usage**:

```console
$ dfe config list [OPTIONS]
```

**Options**:

* `--help`: Show this message and exit.

### `dfe config configurations`

Manage named configurations (profiles).

**Usage**:

```console
$ dfe config configurations [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List named configurations, marking the...
* `activate`: Make NAME the active configuration.
* `create`: Create a new (empty) named configuration.
* `delete`: Delete a named configuration.

#### `dfe config configurations list`

List named configurations, marking the active one.

**Usage**:

```console
$ dfe config configurations list [OPTIONS]
```

**Options**:

* `--help`: Show this message and exit.

#### `dfe config configurations activate`

Make NAME the active configuration.

**Usage**:

```console
$ dfe config configurations activate [OPTIONS] {name}
```

**Arguments**:

* `name`: [required]

**Options**:

* `--help`: Show this message and exit.

#### `dfe config configurations create`

Create a new (empty) named configuration.

**Usage**:

```console
$ dfe config configurations create [OPTIONS] {name}
```

**Arguments**:

* `name`: [required]

**Options**:

* `--help`: Show this message and exit.

#### `dfe config configurations delete`

Delete a named configuration.

**Usage**:

```console
$ dfe config configurations delete [OPTIONS] {name}
```

**Arguments**:

* `name`: [required]

**Options**:

* `--help`: Show this message and exit.

## `dfe local`

Break-glass direct gitops CRUD for when the dfe-engine daemon is DEAD.

Writes DIRECTLY to the local deploy-repo clone via the same GitCrud engine the
API uses; every write is marked [BREAK-GLASS] and needs a --reason. Headline
case - a rogue pod:

    dfe local set helmvars receiver-default keda.maxReplicaCount 0 --reason "rogue pod"

Read first (classes/ls/get/log/versions/status), fix (set/unset/rm/revert/
restore), then publish (push). Authority here is git access to the clone, not
RBAC - the daemon that enforces RBAC is down.

**Usage**:

```console
$ dfe local [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `classes`: List the resource classes GitCrud can...
* `ls`: List resources in a class, e.g.
* `grep`: Search the gitops repo's YAML for TERM, e.g.
* `get`: Show a resource doc, or one key with...
* `log`: Show the gitcrud audit log, flagging...
* `versions`: List published versions of a versioned...
* `status`: Show working-tree changes +...
* `set`: Set a dot-path via GitCrud.set_key, e.g.
* `unset`: Remove a dot-path via GitCrud.delete_key...
* `rm`: Delete a whole resource via GitCrud.delete...
* `revert`: Create a revert-commit that undoes an...
* `restore`: Roll a versioned resource back to an...
* `push`: Push the clone's local (break-glass)...
* `ch-cloud`: ClickHouse Cloud service lifecycle...

### `dfe local classes`

List the resource classes GitCrud can address (helmvars, governance, ...).

**Usage**:

```console
$ dfe local classes [OPTIONS]
```

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local ls`

List resources in a class, e.g. `dfe local ls helmvars`.

**Usage**:

```console
$ dfe local ls [OPTIONS] {cls}
```

**Arguments**:

* `cls`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local grep`

Search the gitops repo's YAML for TERM, e.g. find every keda.maxReplicaCount dial.

**Usage**:

```console
$ dfe local grep [OPTIONS] {term}
```

**Arguments**:

* `term`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local get`

Show a resource doc, or one key with --path (e.g. keda.maxReplicaCount).

**Usage**:

```console
$ dfe local get [OPTIONS] {cls} {name}
```

**Arguments**:

* `cls`: [required]
* `name`: [required]

**Options**:

* `--path <str>`: Dot-path of a single key, e.g. keda.maxReplicaCount.
* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local log`

Show the gitcrud audit log, flagging break-glass commits with !! BREAK-GLASS.

**Usage**:

```console
$ dfe local log [OPTIONS]
```

**Options**:

* `--limit <int>`: Max entries to show (newest first).  [default: 50]
* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local versions`

List published versions of a versioned resource (e.g. ch_tiers).

**Usage**:

```console
$ dfe local versions [OPTIONS] {cls} {name}
```

**Arguments**:

* `cls`: [required]
* `name`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local status`

Show working-tree changes + unpushed-commit count for the clone.

**Usage**:

```console
$ dfe local status [OPTIONS]
```

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local set`

Set a dot-path via GitCrud.set_key, e.g. scale a rogue pod's keda dial to 0.

dfe local set helmvars receiver-default keda.maxReplicaCount 0 --reason "rogue pod"

**Usage**:

```console
$ dfe local set [OPTIONS] {cls} {name} {path} {value}
```

**Arguments**:

* `cls`: [required]
* `name`: [required]
* `path`: [required]
* `value`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--actor <str>`: Operator identity for the audit trailer (default: OS user).
* `--reason <str>`: REQUIRED break-glass reason (prompted if omitted).
* `-y, --yes`: Skip the confirm prompt (CI). Requires --reason.
* `--push / --no-push`: Push after the local commit (default: prompt).
* `--help`: Show this message and exit.

### `dfe local unset`

Remove a dot-path via GitCrud.delete_key (revert a helm var to its default).

**Usage**:

```console
$ dfe local unset [OPTIONS] {cls} {name} {path}
```

**Arguments**:

* `cls`: [required]
* `name`: [required]
* `path`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--actor <str>`: Operator identity for the audit trailer (default: OS user).
* `--reason <str>`: REQUIRED break-glass reason (prompted if omitted).
* `-y, --yes`: Skip the confirm prompt (CI). Requires --reason.
* `--push / --no-push`: Push after the local commit (default: prompt).
* `--help`: Show this message and exit.

### `dfe local rm`

Delete a whole resource via GitCrud.delete (e.g. remove a helm overlay).

**Usage**:

```console
$ dfe local rm [OPTIONS] {cls} {name}
```

**Arguments**:

* `cls`: [required]
* `name`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--actor <str>`: Operator identity for the audit trailer (default: OS user).
* `--reason <str>`: REQUIRED break-glass reason (prompted if omitted).
* `-y, --yes`: Skip the confirm prompt (CI). Requires --reason.
* `--push / --no-push`: Push after the local commit (default: prompt).
* `--help`: Show this message and exit.

### `dfe local revert`

Create a revert-commit that undoes an earlier commit's file changes.

The one new op (GitCrud has no revert): compute the inverse of the
target commit's tree diff and commit it back through GitopsRepo (dulwich, the
same publish path), marked break-glass.

**Usage**:

```console
$ dfe local revert [OPTIONS] {sha}
```

**Arguments**:

* `sha`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--actor <str>`: Operator identity for the audit trailer (default: OS user).
* `--reason <str>`: REQUIRED break-glass reason (prompted if omitted).
* `-y, --yes`: Skip the confirm prompt (CI). Requires --reason.
* `--push / --no-push`: Push after the local commit (default: prompt).
* `--help`: Show this message and exit.

### `dfe local restore`

Roll a versioned resource back to an earlier published version.

Mirrors VersionedDoc.rollback (point ``current`` at the version, keeping the
immutable version envelope intact) but writes a BREAK-GLASS-marked commit -
rollback itself would emit an ordinary conforming commit with no reason trailer.

**Usage**:

```console
$ dfe local restore [OPTIONS] {cls} {name} {version}
```

**Arguments**:

* `cls`: [required]
* `name`: [required]
* `version`: [required]

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--actor <str>`: Operator identity for the audit trailer (default: OS user).
* `--reason <str>`: REQUIRED break-glass reason (prompted if omitted).
* `-y, --yes`: Skip the confirm prompt (CI). Requires --reason.
* `--push / --no-push`: Push after the local commit (default: prompt).
* `--help`: Show this message and exit.

### `dfe local push`

Push the clone's local (break-glass) commits to the configured remote.

**Usage**:

```console
$ dfe local push [OPTIONS]
```

**Options**:

* `--repo PATH`: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).
* `--help`: Show this message and exit.

### `dfe local ch-cloud`

ClickHouse Cloud service lifecycle (status/start/stop).

**Usage**:

```console
$ dfe local ch-cloud [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `status`: Show the CH Cloud service's control-plane...
* `start`: Start (wake) the CH Cloud service.
* `stop`: Stop the CH Cloud service (saves cost).

#### `dfe local ch-cloud status`

Show the CH Cloud service's control-plane state.

**Usage**:

```console
$ dfe local ch-cloud status [OPTIONS]
```

**Options**:

* `--help`: Show this message and exit.

#### `dfe local ch-cloud start`

Start (wake) the CH Cloud service. BILLABLE + idempotent.

**Usage**:

```console
$ dfe local ch-cloud start [OPTIONS]
```

**Options**:

* `--wait`: Block until the service is running.
* `--timeout <float>`: Wait budget in seconds with --wait.  [default: 600.0]
* `--help`: Show this message and exit.

#### `dfe local ch-cloud stop`

Stop the CH Cloud service (saves cost). Idempotent.

**Usage**:

```console
$ dfe local ch-cloud stop [OPTIONS]
```

**Options**:

* `--help`: Show this message and exit.

## `dfe schema`

Plan, apply and read the DFE ClickHouse schema.

**Usage**:

```console
$ dfe schema [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `plan`: Report what an apply would do.
* `apply`: Run the boot phase by hand, under the same...
* `status`: Which dfe-schemas release each object on...

### `dfe schema plan`

Report what an apply would do. Changes nothing.

**Usage**:

```console
$ dfe schema plan [OPTIONS]
```

**Options**:

* `--json`: Emit the plan as JSON.
* `--help`: Show this message and exit.

### `dfe schema apply`

Run the boot phase by hand, under the same lease.

Exits 1 when the pass failed or another applier held the lease for the whole
wait, and 2 on a refusal.

**Usage**:

```console
$ dfe schema apply [OPTIONS]
```

**Options**:

* `--allow-drift / --no-allow-drift`: Also apply the changes the boot phase refuses: a column type, and a TTL.  [default: no-allow-drift]
* `--json`: Emit the outcome as JSON.
* `--help`: Show this message and exit.

### `dfe schema status`

Which dfe-schemas release each object on this cluster came from.

**Usage**:

```console
$ dfe schema status [OPTIONS]
```

**Options**:

* `--json`: Emit the ledger as JSON.
* `--help`: Show this message and exit.

## `dfe alerts`

**Usage**:

```console
$ dfe alerts [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create-destination`: Create Destination
* `destinations-cmd`: List Destinations
* `destinations`

### `dfe alerts create-destination`

Create Destination

Create an alert destination.

Linking it to a hunt writes the hunt YAML, so in production+team that link is
routed to a review branch and ``X-DFE-Review-Required`` says so.

**Usage**:

```console
$ dfe alerts create-destination [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Unique destination identifier (used as filename) Required.
* `--url <str>`: Apprise notification URL (slack://, mailto://, etc.). Masked on every read; write the mask back to keep the stored URL Required.
* `--description <str>`: Human-readable description
* `--enabled / --no-enabled`: Enabled
* `--url-scheme <str>`: URL scheme (slack, mailto, etc.); read-only, set from the URL
* `--hunt-name <str>`: Hunt file stem when this destination is owned by a hunt (set via API)
* `--help`: Show this message and exit.

Example: dfe alerts create-destination

Calls POST /api/v1/alerts/destinations.

### `dfe alerts destinations-cmd`

List Destinations

List alert destinations.

**Usage**:

```console
$ dfe alerts destinations-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in name/description
* `--hunt <str>`: Hunt file name (YAML stem); only destinations referenced in that hunt's alerts
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over enabled, name, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe alerts destinations

Calls GET /api/v1/alerts/destinations.

### `dfe alerts destinations`

**Usage**:

```console
$ dfe alerts destinations [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Destination
* `delete`: Delete Destination
* `get`: Get Destination

#### `dfe alerts destinations apply`

Update Destination

Update an alert destination.

Linking it to a hunt writes the hunt YAML, so in production+team that link is
routed to a review branch and ``X-DFE-Review-Required`` says so.

**Usage**:

```console
$ dfe alerts destinations apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--body-name <str>`: Unique destination identifier (used as filename) Required.
* `--url <str>`: Apprise notification URL (slack://, mailto://, etc.). Masked on every read; write the mask back to keep the stored URL Required.
* `--description <str>`: Human-readable description
* `--enabled / --no-enabled`: Enabled
* `--url-scheme <str>`: URL scheme (slack, mailto, etc.); read-only, set from the URL
* `--hunt-name <str>`: Hunt file stem when this destination is owned by a hunt (set via API)
* `--help`: Show this message and exit.

Example: dfe alerts destinations apply &lt;name>

Calls PUT /api/v1/alerts/destinations/&#123;name&#125;.

#### `dfe alerts destinations delete`

Delete Destination

Delete an alert destination.

**Usage**:

```console
$ dfe alerts destinations delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe alerts destinations delete &lt;name>

Calls DELETE /api/v1/alerts/destinations/&#123;name&#125;.

#### `dfe alerts destinations get`

Get Destination

Get an alert destination by name.

**Usage**:

```console
$ dfe alerts destinations get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe alerts destinations get &lt;name>

Calls GET /api/v1/alerts/destinations/&#123;name&#125;.

## `dfe app-contracts`

**Usage**:

```console
$ dfe app-contracts [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get App Contract

### `dfe app-contracts get`

Get App Contract

One app's config schema and capability catalogue, or that none is mounted.

**Usage**:

```console
$ dfe app-contracts get [OPTIONS] [service]
```

**Arguments**:

* `service`: Service Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe app-contracts get &lt;service>

Calls GET /api/v1/app-contracts/&#123;service&#125;.

## `dfe apps`

**Usage**:

```console
$ dfe apps [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `delete`: Delete Instance
* `get`: Get App
* `list`: List Apps
* `config`
* `files`
* `history`
* `instances`
* `metrics`
* `routing`
* `scaling`
* `status`
* `values`

### `dfe apps delete`

Delete Instance

Undeploy an instance by removing its values overlay.

**Usage**:

```console
$ dfe apps delete [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--help`: Show this message and exit.

Example: dfe apps delete &lt;service> &lt;instance>

Calls DELETE /api/v1/apps/&#123;service&#125;/&#123;instance&#125;.

### `dfe apps get`

Get App

One instance's identity and shape.

**Usage**:

```console
$ dfe apps get [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe apps get &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;.

### `dfe apps list`

List Apps

Every manageable app, with the instances currently deployed.

**Usage**:

```console
$ dfe apps list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--query-profile <str>`: Deployment profile to judge each app's offer against, so the rule stays in one place rather than being re-derived by every caller. Omit it and this deployment's own profile is used; omit it where the deployment states none and every app is reported as offered.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe apps list

Calls GET /api/v1/apps.

### `dfe apps config`

**Usage**:

```console
$ dfe apps config [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `delete`: Clear App Config
* `list`: Get App Config
* `put`: Set App Config

#### `dfe apps config delete`

Clear App Config

Remove options from the overlay, so the app runs its own default for each.

A cleared option reads back unset with provenance ``default``, so it follows the
default when the default next moves. Writing the default back would instead
leave an override that only matches it today, and a PUT of null stores null,
which many options take as a value of its own.

A path the overlay does not hold is already clear and commits nothing. Clearing
a field beside a stored credential in the same mapping is a 400
``credential_reentry_required``, as the PUT of a new value there is, unless the
request clears that credential too.

**Usage**:

```console
$ dfe apps config delete [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--path <str>`: An option to put back to the app's default, as the config route reports it: `config.<option>` or `extraEnv.<NAME>`. Repeat it to clear several in one commit. Required.
* `--if-match <str>`: If-Match
* `--help`: Show this message and exit.

Example: dfe apps config delete &lt;service> &lt;instance> --path &lt;path>

Calls DELETE /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/config.

#### `dfe apps config list`

Get App Config

Every option the app declares, with this instance's value and where it comes from.

The overlay alone cannot answer this: it holds only what was written, so an
option nobody has touched is invisible in it. The app's own contract supplies
the rest, which is what lets the console show an untouched option with the
default it would run rather than an empty box.

**Usage**:

```console
$ dfe apps config list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe apps config list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/config.

#### `dfe apps config put`

Set App Config

Write options the app declares, and environment keys it does not.

Judged against the app's own contract before anything is committed, so a value
the app would refuse at startup leaves the deploy repo where it was rather than
landing a commit an operator then has to revert.

A secret is written like any other option: it goes into the overlay as the rest
of this surface writes one, and neither this response nor a read route on this
surface says what it is. A masked value written back as it was read keeps the
stored credential. The mask where nothing is stored is a 400 ``masked_value``.
A changed field beside a stored credential, in the same mapping or with the
credential one mapping down (``brokers`` beside ``sasl.password``), is a 400
``credential_reentry_required`` until that mapping is written whole with its
credentials typed again. A setting inside another mapping beside it, such as
``producer.retries``, is not. ``config`` and ``extraEnv`` are roots, so a
setting directly under either never needs one.

409 where the deployment already decides the value: a config path the chart
derives, or an `extraEnv` name the chart sets for this app.

**Usage**:

```console
$ dfe apps config put [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--changes <str>`: One entry per option. A `config.*` key is checked against the app's own schema before anything is committed; an `extraEnv.<NAME>` key is checked as an environment name only, and a null value there removes it. JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe apps config put &lt;service> &lt;instance>

Calls PUT /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/config.

### `dfe apps files`

**Usage**:

```console
$ dfe apps files [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Write App File
* `copy`: Copy App Files
* `delete`: Delete App File
* `dry-run`: Dry Run App File
* `get`: Read App File
* `link`: Link App File
* `list`: List App Files
* `relink`: Relink App Files
* `links`

#### `dfe apps files apply`

Write App File

Add or replace a file the app consumes, up to ``repository.max_object_bytes``.

The file lands in the deploy repo's history for good, so an oversized one is
refused before it is buffered rather than after it is committed.

**Usage**:

```console
$ dfe apps files apply [OPTIONS] [service] [instance] [set_name] [filename]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.
* `filename`: Filename Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--content <str>`: Content Required.
* `--help`: Show this message and exit.

Example: dfe apps files apply &lt;service> &lt;instance> &lt;set-name> &lt;filename>

Calls PUT /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/&#123;filename&#125;.

#### `dfe apps files copy`

Copy App Files

Copy this instance's authored files onto another instance of the same app.

A transform is written against one source. Reusing it on another should not mean
retyping it. Only the files move - the target keeps its own source binding,
scaling and identity.

**Usage**:

```console
$ dfe apps files copy [OPTIONS] [service] [instance] [set_name]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--target-instance <str>`: Instance to copy into. For a source-bound app this is the source. Required.
* `--overwrite / --no-overwrite`: Replace files of the same name in the target instead of refusing.
* `--help`: Show this message and exit.

Example: dfe apps files copy &lt;service> &lt;instance> &lt;set-name>

Calls POST /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/copy.

#### `dfe apps files delete`

Delete App File

Remove a file the app consumes, and any link that produced it.

**Usage**:

```console
$ dfe apps files delete [OPTIONS] [service] [instance] [set_name] [filename]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.
* `filename`: Filename Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--help`: Show this message and exit.

Example: dfe apps files delete &lt;service> &lt;instance> &lt;set-name> &lt;filename>

Calls DELETE /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/&#123;filename&#125;.

#### `dfe apps files dry-run`

Dry Run App File

Run an authored file over real events from the source, and report each one.

Nothing is written: no topic, no table, no commit. ``content`` runs unsaved
content, which is what makes this useful in an editor. Omitted, the file
already in the overlay runs instead.

**Usage**:

```console
$ dfe apps files dry-run [OPTIONS] [service] [instance] [set_name]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: File in the set to run Required.
* `--content <str>`: Unsaved content to run instead of what is committed. Nothing is written.
* `--source <str>`: Source to sample from. Defaults to the instance, which for a source-bound app IS the source.
* `--limit <int>`: Events to sample and run over, at most transform_validation.dry_run_max_events (100 by default), which a larger value is refused against
* `--help`: Show this message and exit.

Example: dfe apps files dry-run &lt;service> &lt;instance> &lt;set-name>

Calls POST /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/dry-run.

#### `dfe apps files get`

Read App File

One file's content, with the revision to write it back against.

**Usage**:

```console
$ dfe apps files get [OPTIONS] [service] [instance] [set_name] [filename]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.
* `filename`: Filename Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe apps files get &lt;service> &lt;instance> &lt;set-name> &lt;filename>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/&#123;filename&#125;.

#### `dfe apps files link`

Link App File

Link a file in the set to a library artefact.

The artefact's content is resolved into the file set, because a chart can only
render what is already in the values, and the provenance is recorded beside it
so the link is recoverable.

**Usage**:

```console
$ dfe apps files link [OPTIONS] [service] [instance] [set_name]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--name <str>`: Filename the artefact's content resolves into. Required.
* `--artifact <str>`: Artifact Required.
* `--version <int>`: Pin this version. Omit for the artefact's current one.
* `--tag <str>`: Follow this tag instead of a version; the resolved version is recorded.
* `--help`: Show this message and exit.

Example: dfe apps files link &lt;service> &lt;instance> &lt;set-name>

Calls POST /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/link.

#### `dfe apps files list`

List App Files

Every file in the set, without their contents.

**Usage**:

```console
$ dfe apps files list [OPTIONS] [service] [instance] [set_name]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe apps files list &lt;service> &lt;instance> &lt;set-name>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;.

#### `dfe apps files relink`

Relink App Files

Re-resolve every link in the set to what its target now names.

A tag link follows its tag. A version-pinned link advances to the artefact's
current version. This is the fix-once-roll-everywhere half of the library.

**Usage**:

```console
$ dfe apps files relink [OPTIONS] [service] [instance] [set_name]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--help`: Show this message and exit.

Example: dfe apps files relink &lt;service> &lt;instance> &lt;set-name>

Calls POST /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/relink.

#### `dfe apps files links`

**Usage**:

```console
$ dfe apps files links [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List App Links

##### `dfe apps files links list`

List App Links

Where each linked file came from, and whether it still matches.

``drift`` means the content beside the link is no longer what the linked
version holds - a local edit over a linked file. ``outdated`` means the link
resolved cleanly but its target has moved since.

**Usage**:

```console
$ dfe apps files links list [OPTIONS] [service] [instance] [set_name]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.
* `set_name`: Set Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe apps files links list &lt;service> &lt;instance> &lt;set-name>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/files/&#123;set_name&#125;/links.

### `dfe apps history`

**Usage**:

```console
$ dfe apps history [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get History

#### `dfe apps history list`

Get History

Every change to this instance, newest first, a page at a time.

Supply the revision Argo has synced as ``applied_revision`` to see which
commits have reached the cluster and which are still pending.

**Usage**:

```console
$ dfe apps history list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--applied-revision <str>`: Applied Revision
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe apps history list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/history.

### `dfe apps instances`

**Usage**:

```console
$ dfe apps instances [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Create Instance

#### `dfe apps instances create`

Create Instance

Deploy an instance by creating its values overlay.

The overlay's presence is what the layer2-apps ApplicationSet turns into an Argo
Application, so this is the whole deployment step. A new instance stores nothing,
so a masked value copied from another instance's read is a 400 ``masked_value``.

**Usage**:

```console
$ dfe apps instances create [OPTIONS] [service]
```

**Arguments**:

* `service`: Service Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--instance <str>`: Instance Required.
* `--values <str>`: Initial helm values as dot-path keys, merged over the defaults. JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe apps instances create &lt;service>

Calls POST /api/v1/apps/&#123;service&#125;/instances.

### `dfe apps metrics`

**Usage**:

```console
$ dfe apps metrics [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Metrics
* `series`: Get Resource Series
* `totals`: Get Totals

#### `dfe apps metrics list`

Get Metrics

Throughput, CPU, memory and saturation for the instance or a process deployed from its image.

**Usage**:

```console
$ dfe apps metrics list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--process <str>`: Process
* `--help`: Show this message and exit.

Example: dfe apps metrics list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/metrics.

#### `dfe apps metrics series`

Get Resource Series

CPU and memory over time as min, max, average and p95 per bucket.

Each bucket aggregates across every pod reporting for this instance, or for
the named process. A per-config app deploys each config under its own
service name, so one instance is already one config.

A ``bucket_seconds`` of 0 reads the window as one bucket and may reach back over the gauge table's whole retention, which a ``window_seconds`` of 0 asks for. A bucketed read stops at a week.

**Usage**:

```console
$ dfe apps metrics series [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--window-seconds <int>`: Window Seconds
* `--bucket-seconds <int>`: Bucket Seconds
* `--process <str>`: Process
* `--help`: Show this message and exit.

Example: dfe apps metrics series &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/metrics/series.

#### `dfe apps metrics totals`

Get Totals

Counter, request and CPU totals over the window, across every run of every pod.

A window of 0 counts everything the metrics tables still keep.

**Usage**:

```console
$ dfe apps metrics totals [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--window-seconds <int>`: Window Seconds
* `--process <str>`: Process
* `--help`: Show this message and exit.

Example: dfe apps metrics totals &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/metrics/totals.

### `dfe apps routing`

**Usage**:

```console
$ dfe apps routing [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get App Routing
* `sync`: Sync App Routing

#### `dfe apps routing list`

Get App Routing

What the sources compile to, against what the overlay actually carries.

An absent block is called out separately from drift: it means the app is
running on its built-in defaults, which is how a receiver silently ignores
every source rule ever defined.

**Usage**:

```console
$ dfe apps routing list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe apps routing list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/routing.

#### `dfe apps routing sync`

Sync App Routing

Rewrite the overlay's routing to what the sources currently compile to.

**Usage**:

```console
$ dfe apps routing sync [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--help`: Show this message and exit.

Example: dfe apps routing sync &lt;service> &lt;instance>

Calls POST /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/routing/sync.

### `dfe apps scaling`

**Usage**:

```console
$ dfe apps scaling [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Scaling
* `put`: Set Scaling

#### `dfe apps scaling list`

Get Scaling

The scaling dials, or why they do not apply here.

**Usage**:

```console
$ dfe apps scaling list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe apps scaling list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/scaling.

#### `dfe apps scaling put`

Set Scaling

Set the scaling dials. Refused when the deploy target has no such dials.

**Usage**:

```console
$ dfe apps scaling put [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--replica-count <int>`: Fixed pod count, for a deployment with KEDA off. Refused unless `keda_enabled` is false in this request or already in the overlay: the chart omits `replicas` while KEDA is on, which it is by default, and the ScaledObject owns the count.
* `--min-replicas <int>`: Min Replicas
* `--max-replicas <int>`: Max Replicas
* `--keda-enabled / --no-keda-enabled`: Keda Enabled
* `--cpu-request <str>`: Cpu Request
* `--memory-request <str>`: Memory Request
* `--cpu-limit <str>`: Cpu Limit
* `--memory-limit <str>`: Memory Limit
* `--help`: Show this message and exit.

Example: dfe apps scaling put &lt;service> &lt;instance>

Calls PUT /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/scaling.

### `dfe apps status`

**Usage**:

```console
$ dfe apps status [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Status

#### `dfe apps status list`

Get Status

Whether the instance, or a process deployed from its image, is reporting, and since when.

**Usage**:

```console
$ dfe apps status list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--process <str>`: Process
* `--help`: Show this message and exit.

Example: dfe apps status list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/status.

### `dfe apps values`

**Usage**:

```console
$ dfe apps values [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Values

#### `dfe apps values list`

Get Values

The instance's overlay document, credentials masked, with the revision to write against.

Masked as the config route hides them: by the app's own secret marker in its
schema, and by name wherever the schema says nothing.

**Usage**:

```console
$ dfe apps values list [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe apps values list &lt;service> &lt;instance>

Calls GET /api/v1/apps/&#123;service&#125;/&#123;instance&#125;/values.

## `dfe auth`

**Usage**:

```console
$ dfe auth [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `login`: Login
* `logout`: Logout
* `refresh`: Refresh Token
* `list`: List configured accounts, marking the...
* `print-access-token`: Print the active token to stdout (for...
* `accounts`
* `api-keys`
* `groups`
* `me`
* `oidc`
* `oidc-providers`
* `permissions`
* `roles`
* `setup`
* `setup-status`

### `dfe auth login`

Login

Authenticate with local credentials and receive a JWT token.

The password check runs off the event loop. Failed attempts back off per
username and per client address (``auth.login_throttle``). A waiting attempt is
refused with 429 before the password is checked.

**Usage**:

```console
$ dfe auth login [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--username <str>`: Account name (admin, operator, viewer) Required.
* `--password <str>`: Plaintext password Required.
* `--help`: Show this message and exit.

Example: dfe auth login

Calls POST /api/v1/auth/login.

### `dfe auth logout`

Logout

End every session of the caller's account, on every device.

Each token minted for the account before this call is refused from now on,
this one included, and the engine's login cookie is cleared. A peer that
verifies engine tokens by signature alone still accepts one until it expires.

**Usage**:

```console
$ dfe auth logout [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth logout

Calls POST /api/v1/auth/logout.

### `dfe auth refresh`

Refresh Token

Refresh the current JWT token. Requires a valid existing token.

The new token keeps the session's sign-in time, so a session renews only until
it is ``api.max_session_minutes`` old, and no token outlives that.

**Usage**:

```console
$ dfe auth refresh [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth refresh

Calls POST /api/v1/auth/refresh.

### `dfe auth list`

List configured accounts, marking the active one.

**Usage**:

```console
$ dfe auth list [OPTIONS]
```

**Options**:

* `--help`: Show this message and exit.

### `dfe auth print-access-token`

Print the active token to stdout (for scripts).

**Usage**:

```console
$ dfe auth print-access-token [OPTIONS]
```

**Options**:

* `--help`: Show this message and exit.

### `dfe auth accounts`

**Usage**:

```console
$ dfe auth accounts [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Account
* `change-password`: Reset Current User Password
* `create`: Create Account
* `delete`: Delete Account
* `get`: Get Account
* `git-status`: Account Git Status
* `list`: List Accounts
* `me`: Get Current User Account
* `reset-password`: Reset Password
* `rotate-password`: Rotate Password
* `update-me`: Update Current User Account
* `attributes`
* `sensitive-attributes`

#### `dfe auth accounts apply`

Update Account

Update account groups, enabled/blocked status, or contact fields (admin only).

Refused when the caller disables or blocks their own account, or when that
(or stripping every system-scope admin group) would leave no usable
system-admin account.

**Usage**:

```console
$ dfe auth accounts apply [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--groups <str>`: Replace group memberships
* `--enabled / --no-enabled`: Enable or disable the account
* `--blocked / --no-blocked`: Block the account from holding a session
* `--email <str>`: Contact email
* `--phone <str>`: Contact phone
* `--name <str>`: Display name
* `--org <str>`: Replace the org binding. The registered org the account belongs to, which its sessions carry as org_id. Empty binds it to none, so it reads no org-bound view. The binding grants nothing itself: such a view also needs the org among those its groups grant.
* `--help`: Show this message and exit.

Example: dfe auth accounts apply &lt;username>

Calls PUT /api/v1/auth/accounts/&#123;username&#125;.

#### `dfe auth accounts change-password`

Reset Current User Password

Change the authenticated user's own password, given the current one.

The username is taken from the session, not the request, so a caller cannot
reset another account through this route. ``current_password`` must be the
account's password, so a stolen session token cannot take the account over;
wrong guesses back off as sign-in failures do. An IdP-owned (``external``)
account is refused: it has no local password. The live store takes the new
password immediately and every session the account held ends, this one
included, so the owner signs in again. The ``git`` block reports whether the
durable mirror merged, is pending review, or is a no-op for a non-git-backed
account.

An account on an issued password may call this and nothing else that
changes state, and the reset clears ``password_change_required``.

**Usage**:

```console
$ dfe auth accounts change-password [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--new-password <str>`: New plaintext password; at least 12 characters and at most 72 bytes Required.
* `--current-password <str>`: The account's password now. A session token alone cannot change it. Required.
* `--help`: Show this message and exit.

Example: dfe auth accounts change-password

Calls POST /api/v1/auth/accounts/reset-password.

#### `dfe auth accounts create`

Create Account

Create a new local user account (admin only).

**Usage**:

```console
$ dfe auth accounts create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--username <str>`: Unique account name Required.
* `--password <str>`: Plaintext password (bcrypt-hashed before storage); at least 12 characters and at most 72 bytes Required.
* `--email <str>`: Contact email
* `--groups <str>`: Group memberships
* `--phone <str>`: Contact phone
* `--name <str>`: Display name
* `--org <str>`: The registered org the account belongs to, which its sessions carry as org_id. Empty binds it to none, so it reads no org-bound view. The binding grants nothing itself: such a view also needs the org among those its groups grant.
* `--help`: Show this message and exit.

Example: dfe auth accounts create

Calls POST /api/v1/auth/accounts.

#### `dfe auth accounts delete`

Delete Account

Delete an account (admin only).

Refused when the caller targets their own account, when the account holds the
system admin role and no other usable admin-role account would remain
(bootstrap admin and break-glass count when they can sign in), or when the
store refuses a recovery credential.

**Usage**:

```console
$ dfe auth accounts delete [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth accounts delete &lt;username>

Calls DELETE /api/v1/auth/accounts/&#123;username&#125;.

#### `dfe auth accounts get`

Get Account

Get a single account by username (admin only).

Soft-deleted (anonymized) accounts answer 404 the same as a missing name.

**Usage**:

```console
$ dfe auth accounts get [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth accounts get &lt;username>

Calls GET /api/v1/auth/accounts/&#123;username&#125;.

#### `dfe auth accounts git-status`

Account Git Status

Poll whether an account's password has merged to the deploy repo's main.

Step 2 of the review-PR path for the local admin and ``breakglass``: the UI
polls this after the operator merges the PR. It fetches remote main and flips
``merged`` true. Durable immediately in the auto-merge and file-share modes. A
regular user is never git-persisted, so it reports not-git-backed (durable in
its own store).

**Usage**:

```console
$ dfe auth accounts git-status [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth accounts git-status &lt;username>

Calls GET /api/v1/auth/accounts/&#123;username&#125;/git-status.

#### `dfe auth accounts list`

List Accounts

List accounts (admin only), paginated. No password hashes returned.

**Usage**:

```console
$ dfe auth accounts list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in username, name, or email
* `--oidc-id <str>`: Exact match on the OIDC provider name last used to log the account in
* `--blocked / --no-blocked`: Filter by blocked status. Omitted returns every account.
* `--include-core / --no-include-core`: Include the local admin and break-glass recovery accounts.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over created_at, updated_at, username, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe auth accounts list

Calls GET /api/v1/auth/accounts.

#### `dfe auth accounts me`

Get Current User Account

Return the authenticated user's account. No extra scope required.

An account on an issued password reads back with no groups: its session holds
no standing until the change, and a console copies this read into its session.

**Usage**:

```console
$ dfe auth accounts me [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth accounts me

Calls GET /api/v1/auth/accounts/me.

#### `dfe auth accounts reset-password`

Reset Password

Reset an account's password (admin only).

An IdP-owned (``external``) account is refused: the password lives at the
identity provider. The live store takes the new password immediately (next
login), and the change is mirrored into the durable deploy repo so it
survives a rebuild. The ``git`` block reports whether that mirror merged
straight away (dev/solo) or is a pending review PR / CLI merge
(production+team), or is a no-op file share.

**Usage**:

```console
$ dfe auth accounts reset-password [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--new-password <str>`: New plaintext password; at least 12 characters and at most 72 bytes Required.
* `--help`: Show this message and exit.

Example: dfe auth accounts reset-password &lt;username>

Calls POST /api/v1/auth/accounts/&#123;username&#125;/reset-password.

#### `dfe auth accounts rotate-password`

Rotate Password

Rotate the local admin's password in the deployment's secret store.

The store that injects ``DFE_ENGINE_AUTH_LOCAL_ADMIN_PASSWORD`` is the source of that
password, so the engine writes the new value through its secrets backend and
never into its own YAML. The next boot reconcile issues the rotated value to
the admin, who must replace it at the following login. Returns 501 with the
command that changes it where it is kept when the deployment has not declared
a secrets path for the password. Every other account, ``breakglass`` included,
changes its password through reset-password.

**Usage**:

```console
$ dfe auth accounts rotate-password [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--new-password <str>`: New plaintext password to write to the secret store; at least 12 characters, at most 72 bytes, and never the shipped default Required.
* `--help`: Show this message and exit.

Example: dfe auth accounts rotate-password &lt;username>

Calls POST /api/v1/auth/accounts/&#123;username&#125;/rotate-password.

#### `dfe auth accounts update-me`

Update Current User Account

Update the authenticated user's contact fields. No extra scope required.

Groups and enabled cannot be changed here: those stay on the admin
``PUT /{username}`` route, which requires ``account:write``.

**Usage**:

```console
$ dfe auth accounts update-me [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--email <str>`: Contact email
* `--phone <str>`: Contact phone
* `--name <str>`: Display name
* `--help`: Show this message and exit.

Example: dfe auth accounts update-me

Calls PUT /api/v1/auth/accounts/me.

#### `dfe auth accounts attributes`

**Usage**:

```console
$ dfe auth accounts attributes [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Put Account Attributes
* `get`: Get Account Attributes

##### `dfe auth accounts attributes apply`

Put Account Attributes

Full-replace an account's non-sensitive attribute blob (404 if missing or soft-deleted).

**Usage**:

```console
$ dfe auth accounts attributes apply [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--attributes <str>`: Attributes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe auth accounts attributes apply &lt;username>

Calls PUT /api/v1/auth/accounts/&#123;username&#125;/attributes.

##### `dfe auth accounts attributes get`

Get Account Attributes

Read an account's non-sensitive attribute blob (404 if missing or soft-deleted).

**Usage**:

```console
$ dfe auth accounts attributes get [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth accounts attributes get &lt;username>

Calls GET /api/v1/auth/accounts/&#123;username&#125;/attributes.

#### `dfe auth accounts sensitive-attributes`

**Usage**:

```console
$ dfe auth accounts sensitive-attributes [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Put Account Sensitive Attributes
* `get`: Get Account Sensitive Attributes

##### `dfe auth accounts sensitive-attributes apply`

Put Account Sensitive Attributes

Full-replace an account's SENSITIVE attribute blob (404 if missing or soft-deleted).

**Usage**:

```console
$ dfe auth accounts sensitive-attributes apply [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--attributes <str>`: Attributes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe auth accounts sensitive-attributes apply &lt;username>

Calls PUT /api/v1/auth/accounts/&#123;username&#125;/sensitive-attributes.

##### `dfe auth accounts sensitive-attributes get`

Get Account Sensitive Attributes

Read an account's SENSITIVE attribute blob from the separate keyed store.

The account must exist first (404 otherwise), so a sensitive read cannot be
used to probe for accounts that are not there. Soft-deleted accounts answer
the same way.

**Usage**:

```console
$ dfe auth accounts sensitive-attributes get [OPTIONS] [username]
```

**Arguments**:

* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth accounts sensitive-attributes get &lt;username>

Calls GET /api/v1/auth/accounts/&#123;username&#125;/sensitive-attributes.

### `dfe auth api-keys`

**Usage**:

```console
$ dfe auth api-keys [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Create Api Key
* `delete`: Revoke Api Key
* `list`: List Api Keys

#### `dfe auth api-keys create`

Create Api Key

Create a new API key. Returns the full key exactly once.

422 ``unknown_org`` when ``org`` names no registered org.

**Usage**:

```console
$ dfe auth api-keys create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Unique human-readable key name Required.
* `--groups <str>`: RBAC group memberships
* `--org <str>`: The org the key's sessions are bound to: a registered org's name, or empty for none. A view held to one org runs only for a key bound to an org its groups grant.
* `--description <str>`: Optional description
* `--expires-at <str>`: Optional ISO-8601 expiry (UTC if no offset given). Omitted, the key expires after auth.api_key_default_ttl_days (90 unless configured; 0 there means it never expires).
* `--help`: Show this message and exit.

Example: dfe auth api-keys create

Calls POST /api/v1/auth/api-keys.

#### `dfe auth api-keys delete`

Revoke Api Key

Revoke (delete) an API key by short token.

**Usage**:

```console
$ dfe auth api-keys delete [OPTIONS] [short_token]
```

**Arguments**:

* `short_token`: Short Token Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth api-keys delete &lt;short-token>

Calls DELETE /api/v1/auth/api-keys/&#123;short_token&#125;.

#### `dfe auth api-keys list`

List Api Keys

List API keys, paginated. No key hashes or full keys returned.

**Usage**:

```console
$ dfe auth api-keys list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in key name/description
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over created_at, expires_at, name, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe auth api-keys list

Calls GET /api/v1/auth/api-keys.

### `dfe auth groups`

**Usage**:

```console
$ dfe auth groups [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Group
* `create`: Create Group
* `delete`: Delete Group
* `get`: Get Group
* `list`: List Groups
* `attributes`
* `members`
* `sensitive-attributes`

#### `dfe auth groups apply`

Update Group

Update group roles, description, members or IdP link (group:write at the group's scope).

**Usage**:

```console
$ dfe auth groups apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--roles <str>`: Replace role list
* `--description <str>`: Replace description
* `--members <str>`: Replace member username list
* `--source-id <str>`: Replace the source ID; omit to keep it. The group identifier the identity provider asserts in its tokens: the group name for Okta, dex and Keycloak groups claims, the object ID for Entra. A login through source_provider asserting it takes this group's roles. Empty for a group managed only here. A non-empty source ID needs a source_provider. At most 512 characters, with no control characters and no leading or trailing whitespace; no other group may carry it.
* `--source-provider <str>`: Replace the source provider; omit to keep it. The provider whose logins the source ID answers, required with a source ID: an OIDC provider name, a key or value of auth.source_provider_bindings, 'scim' or, while auth.trust_proxy_auth_headers is on, auth.proxy_provider. At most 512 characters.
* `--help`: Show this message and exit.

Example: dfe auth groups apply &lt;name>

Calls PUT /api/v1/auth/groups/&#123;name&#125;.

#### `dfe auth groups create`

Create Group

Create a new RBAC group at a scope.

**Usage**:

```console
$ dfe auth groups create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Unique group name Required.
* `--roles <str>`: Roles assigned to all group members Required.
* `--description <str>`: Human-readable description
* `--scope <str>`: 'system' (roles bind system-wide) or 'org:&lt;name>' (group exists only inside that org; roles bind at that org's scope)
* `--members <str>`: Account usernames in this group (local login resolves roles from this list)
* `--source-id <str>`: The group identifier the identity provider asserts in its tokens: the group name for Okta, dex and Keycloak groups claims, the object ID for Entra. A login through source_provider asserting it takes this group's roles. Empty for a group managed only here. A non-empty source ID needs a source_provider. At most 512 characters, with no control characters and no leading or trailing whitespace; no other group may carry it.
* `--source-provider <str>`: The provider whose logins the source ID answers, required with a source ID: an OIDC provider name, a key or value of auth.source_provider_bindings, 'scim' or, while auth.trust_proxy_auth_headers is on, auth.proxy_provider. At most 512 characters.
* `--help`: Show this message and exit.

Example: dfe auth groups create

Calls POST /api/v1/auth/groups.

#### `dfe auth groups delete`

Delete Group

Delete a group (checked at the group's scope).

**Usage**:

```console
$ dfe auth groups delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth groups delete &lt;name>

Calls DELETE /api/v1/auth/groups/&#123;name&#125;.

#### `dfe auth groups get`

Get Group

Get a single group by name (404 when not visible to the caller).

**Usage**:

```console
$ dfe auth groups get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth groups get &lt;name>

Calls GET /api/v1/auth/groups/&#123;name&#125;.

#### `dfe auth groups list`

List Groups

List groups visible to the caller (own memberships + scope grants), paginated.

**Usage**:

```console
$ dfe auth groups list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in group name/description
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over name, scope, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe auth groups list

Calls GET /api/v1/auth/groups.

#### `dfe auth groups attributes`

**Usage**:

```console
$ dfe auth groups attributes [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Put Group Attributes
* `get`: Get Group Attributes

##### `dfe auth groups attributes apply`

Put Group Attributes

Full-replace a group's non-sensitive attribute blob (404 if missing).

**Usage**:

```console
$ dfe auth groups attributes apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--attributes <str>`: Attributes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe auth groups attributes apply &lt;name>

Calls PUT /api/v1/auth/groups/&#123;name&#125;/attributes.

##### `dfe auth groups attributes get`

Get Group Attributes

Read a group's non-sensitive attribute blob (404 if the group is missing).

**Usage**:

```console
$ dfe auth groups attributes get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth groups attributes get &lt;name>

Calls GET /api/v1/auth/groups/&#123;name&#125;/attributes.

#### `dfe auth groups members`

**Usage**:

```console
$ dfe auth groups members [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Add Member
* `delete`: Remove Member

##### `dfe auth groups members create`

Add Member

Add a member to a group (idempotent, checked at the group's scope).

**Usage**:

```console
$ dfe auth groups members create [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--username <str>`: Account username to add Required.
* `--help`: Show this message and exit.

Example: dfe auth groups members create &lt;name>

Calls POST /api/v1/auth/groups/&#123;name&#125;/members.

##### `dfe auth groups members delete`

Remove Member

Remove a member from a group (checked at the group's scope).

**Usage**:

```console
$ dfe auth groups members delete [OPTIONS] [name] [username]
```

**Arguments**:

* `name`: Name Required.
* `username`: Username Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth groups members delete &lt;name> &lt;username>

Calls DELETE /api/v1/auth/groups/&#123;name&#125;/members/&#123;username&#125;.

#### `dfe auth groups sensitive-attributes`

**Usage**:

```console
$ dfe auth groups sensitive-attributes [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Put Group Sensitive Attributes
* `get`: Get Group Sensitive Attributes

##### `dfe auth groups sensitive-attributes apply`

Put Group Sensitive Attributes

Full-replace a group's SENSITIVE attribute blob (404 if the group is missing).

**Usage**:

```console
$ dfe auth groups sensitive-attributes apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--attributes <str>`: Attributes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe auth groups sensitive-attributes apply &lt;name>

Calls PUT /api/v1/auth/groups/&#123;name&#125;/sensitive-attributes.

##### `dfe auth groups sensitive-attributes get`

Get Group Sensitive Attributes

Read a group's SENSITIVE attribute blob from the separate keyed store.

The group must exist first (404 otherwise), so a sensitive read cannot probe
for groups that are not there.

**Usage**:

```console
$ dfe auth groups sensitive-attributes get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth groups sensitive-attributes get &lt;name>

Calls GET /api/v1/auth/groups/&#123;name&#125;/sensitive-attributes.

### `dfe auth me`

**Usage**:

```console
$ dfe auth me [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Me

#### `dfe auth me list`

Get Me

Get the current authenticated user's info.

A session on an issued password reports the flag and no roles, permissions,
groups or orgs, because its token carries none until the change.

``hyperdx_role`` and ``hyperdx_identity`` are what dfe-hyperdx takes a
session's dashboard role and team from. It caches this answer for 30 seconds,
so a group change reaches dfe-hyperdx in that window rather than at token expiry.

**Usage**:

```console
$ dfe auth me list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth me list

Calls GET /api/v1/auth/me.

### `dfe auth oidc`

**Usage**:

```console
$ dfe auth oidc [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `callback`
* `login`

#### `dfe auth oidc callback`

**Usage**:

```console
$ dfe auth oidc callback [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Oidc Callback

##### `dfe auth oidc callback list`

Oidc Callback

Complete the OIDC flow and re-mint the engine token (single issuer).

A login started with ``return_to`` returns there refused as well as admitted,
so a browser never lands on this route's JSON error. Without ``return_to`` a
refusal answers JSON with its status, as any API error does.

**Usage**:

```console
$ dfe auth oidc callback list [OPTIONS] [provider]
```

**Arguments**:

* `provider`: Provider Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth oidc callback list &lt;provider>

Calls GET /api/v1/auth/oidc/&#123;provider&#125;/callback.

#### `dfe auth oidc login`

**Usage**:

```console
$ dfe auth oidc login [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Oidc Login

##### `dfe auth oidc login list`

Oidc Login

Begin OIDC auth-code flow: 302 to the IdP, or JSON authorize URL for SPAs.

**Usage**:

```console
$ dfe auth oidc login list [OPTIONS] [provider]
```

**Arguments**:

* `provider`: Provider Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--redirect / --no-redirect`: When false, return JSON with authorization_url for SPA clients (use credentials: include, then window.location.assign the URL).
* `--return-to <str>`: Where the callback sends the browser after login, with the engine token in the URL fragment (#access_token=...&token_type=bearer&provider=...), or the refusal's code (#error=&lt;code>&provider=...) when the login is refused. A relative path, or an absolute URL on this API's origin or a CORS-allowed origin. Omit to have the callback answer with JSON instead.
* `--help`: Show this message and exit.

Example: dfe auth oidc login list &lt;provider>

Calls GET /api/v1/auth/oidc/&#123;provider&#125;/login.

### `dfe auth oidc-providers`

**Usage**:

```console
$ dfe auth oidc-providers [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Provider
* `create`: Create Provider
* `delete`: Delete Provider
* `get`: Get Provider
* `list`: List Providers
* `sync`: Sync Provider Groups
* `test`: Test Provider
* `verify-login`: Verify Login Config

#### `dfe auth oidc-providers apply`

Update Provider

Update an OIDC provider configuration (admin only).

A secret the body omits, value and env var name alike, keeps what the provider already holds, so an update that only flips ``enabled`` does not strand a stored credential. An empty env var name clears the name and keeps the stored copy. A secret the body names an env var for and sends no value for moves onto that env var and its stored copy is deleted once the update is saved, unless the name is the one already held with nothing stored. A move onto an env var the engine does not set is refused (``env_var_not_set``). Any update that touches more than ``enabled`` or ``display_name`` must leave the provider passing the field rules. Both are checked before a secret is written or deleted.

**Usage**:

```console
$ dfe auth oidc-providers apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--enabled / --no-enabled`: Enable or disable the provider
* `--display-name <str>`: Human-readable label
* `--issuer <str>`: OIDC issuer URL. An empty one is refused, since a login needs it
* `--client-id <str>`: OIDC client ID (not a secret)
* `--client-id-env <str>`: Env var name for OIDC client ID
* `--client-secret <str>`: Rotate the RP client secret. Write-only: it goes to the secret store and only its path is kept in config.
* `--client-secret-env <str>`: Env var name for the RP client secret. Omit it on an update to keep the name and any stored copy or send an empty string to clear the name and keep the stored copy. Naming an env var with no value for the secret moves the secret onto it and the stored copy is deleted once the update is saved; resending the name already held, with nothing stored, changes nothing. When that move, or a create naming an env var with no value for the secret, names one the engine does not set, the request is refused with 422 env_var_not_set on this field and nothing is saved or deleted.
* `--scopes <str>`: Replace the OAuth scopes requested at login, one scope per entry; must include openid. One space-separated string is accepted too, and a blank one leaves the scopes as they are.
* `--groups <str>`: Group resolution config JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers apply &lt;name>

Calls PUT /api/v1/auth/oidc-providers/&#123;name&#125;.

#### `dfe auth oidc-providers create`

Create Provider

Create a new OIDC provider configuration (admin only).

Secret values in the body are written to the secret store before the YAML, and only once the name is free and the provider passes the field rules for its type and mode, so a refused provider leaves nothing behind. A secret named by an env var the engine does not set, with no value sent for it, is refused the same way (``env_var_not_set``).

**Usage**:

```console
$ dfe auth oidc-providers create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Unique provider name (used as filename stem) Required.
* `--type <generic|google|entra_id|okta>`: Provider type: generic, google, entra_id, okta Required.
* `--enabled / --no-enabled`: Whether the provider serves logins
* `--display-name <str>`: Human-readable label
* `--issuer <str>`: OIDC issuer URL
* `--client-id <str>`: OIDC client ID. Not a secret, so it is stored in config.
* `--client-id-env <str>`: Env var name for OIDC client ID
* `--client-secret <str>`: RP client secret used in the auth-code exchange. Write-only: it goes to the secret store and only its path is kept in config.
* `--client-secret-env <str>`: Env var name for the RP client secret used in the auth-code exchange. With no client_secret, one the engine does not set is refused with 422 env_var_not_set on this field and nothing is saved.
* `--scopes <str>`: OAuth scopes requested at login, one scope per entry; must include openid. One space-separated string is accepted too, and a blank one is no override. Omit for the provider type's default: openid email profile, plus groups for generic and okta, and https://www.googleapis.com/auth/cloud-identity.groups.readonly for google, which reads each user's groups with their own token. Google and Entra ID fail a login that asks for groups.
* `--groups <str>`: How a provider's groups resolve: by hand, from a token claim, or from its API. JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers create

Calls POST /api/v1/auth/oidc-providers.

#### `dfe auth oidc-providers delete`

Delete Provider

Detach an OIDC provider and soft-delete its accounts (admin only).

Does NOT delete groups -- they become orphaned with their source_provider
still set to the deleted provider name. Accounts owned by the provider
(``source_provider``) or last logged in through it (``oidc_id``) are
soft-deleted: disabled and renamed to ``{uuid}-deleted`` with contact fields
cleared. The provider's stored credentials ARE removed: nothing is left that
can authenticate as a detached provider.

**Usage**:

```console
$ dfe auth oidc-providers delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers delete &lt;name>

Calls DELETE /api/v1/auth/oidc-providers/&#123;name&#125;.

#### `dfe auth oidc-providers get`

Get Provider

Get a single OIDC provider by name (admin only).

**Usage**:

```console
$ dfe auth oidc-providers get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers get &lt;name>

Calls GET /api/v1/auth/oidc-providers/&#123;name&#125;.

#### `dfe auth oidc-providers list`

List Providers

List OIDC providers (admin only), paginated.

**Usage**:

```console
$ dfe auth oidc-providers list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in provider name/display name
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over created_at, name, type, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers list

Calls GET /api/v1/auth/oidc-providers.

#### `dfe auth oidc-providers sync`

Sync Provider Groups

Force group sync for an OIDC provider (admin only).

**Usage**:

```console
$ dfe auth oidc-providers sync [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers sync &lt;name>

Calls POST /api/v1/auth/oidc-providers/&#123;name&#125;/sync.

#### `dfe auth oidc-providers test`

Test Provider

Test connectivity to an OIDC provider (admin only).

**Usage**:

```console
$ dfe auth oidc-providers test [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers test &lt;name>

Calls GET /api/v1/auth/oidc-providers/&#123;name&#125;/test.

#### `dfe auth oidc-providers verify-login`

Verify Login Config

Verify a provider's OIDC LOGIN config (admin only).

Answers "are the login creds real and is the IdP reachable" WITHOUT
attempting an interactive login - the gap ``/{name}/test`` leaves for
generic providers. Checks: the client_id resolves, the client_secret
resolves, and the issuer's discovery document is reachable and well-formed.

**Usage**:

```console
$ dfe auth oidc-providers verify-login [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth oidc-providers verify-login &lt;name>

Calls GET /api/v1/auth/oidc-providers/&#123;name&#125;/verify-login.

### `dfe auth permissions`

**Usage**:

```console
$ dfe auth permissions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Permissions

#### `dfe auth permissions list`

Get Permissions

Get resolved permissions for the current user's roles.

**Usage**:

```console
$ dfe auth permissions list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth permissions list

Calls GET /api/v1/auth/permissions.

### `dfe auth roles`

**Usage**:

```console
$ dfe auth roles [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Role
* `create`: Create Role
* `delete`: Delete Role
* `get`: Get Role
* `list`: List Roles
* `scopes`: List Casbin Scopes

#### `dfe auth roles apply`

Update Role

Update a role. A change to what it grants needs the caller to hold it before and after.

**Usage**:

```console
$ dfe auth roles apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--description <str>`: Replace description
* `--permissions <str>`: Replace permission patterns
* `--scoped / --no-scoped`: Replace org-scoped flag
* `--help`: Show this message and exit.

Example: dfe auth roles apply &lt;name>

Calls PUT /api/v1/auth/roles/&#123;name&#125;.

#### `dfe auth roles create`

Create Role

Create a new RBAC role granting no more than the caller holds.

**Usage**:

```console
$ dfe auth roles create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Unique role name Required.
* `--description <str>`: Human-readable description
* `--permissions <str>`: Casbin-style permission patterns Required.
* `--scoped / --no-scoped`: When true, role is org-scoped at query time
* `--help`: Show this message and exit.

Example: dfe auth roles create

Calls POST /api/v1/auth/roles.

#### `dfe auth roles delete`

Delete Role

Delete a role no group holds, for a caller holding role:delete.

**Usage**:

```console
$ dfe auth roles delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth roles delete &lt;name>

Calls DELETE /api/v1/auth/roles/&#123;name&#125;.

#### `dfe auth roles get`

Get Role

Get one role by name, for a caller holding role:read.

**Usage**:

```console
$ dfe auth roles get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth roles get &lt;name>

Calls GET /api/v1/auth/roles/&#123;name&#125;.

#### `dfe auth roles list`

List Roles

List roles with pagination, for a caller holding role:read.

**Usage**:

```console
$ dfe auth roles list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--resource-type <core|custom>`: Return only roles with this resource_type (core or custom)
* `--search <str>`: Case-insensitive match on role name or description
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe auth roles list

Calls GET /api/v1/auth/roles.

#### `dfe auth roles scopes`

List Casbin Scopes

Return assignable Casbin permission scopes for role configuration.

**Usage**:

```console
$ dfe auth roles scopes [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Case-insensitive substring match on permission scope strings
* `--prefix <str>`: Return only scopes that start with this prefix (e.g. config:, argo:)
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe auth roles scopes

Calls GET /api/v1/auth/roles/scopes.

### `dfe auth setup`

**Usage**:

```console
$ dfe auth setup [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `retire-admin`: Retire Bootstrap Admin

#### `dfe auth setup retire-admin`

Retire Bootstrap Admin

Retire the bootstrap admin: disable it and record the fact in the deploy repo.

The deployment mints the admin password and the engine reissues it whenever
the injected value changes, so until it is retired anyone able to write the
Secret or ``.env`` can issue themselves the admin at the next boot. Retiring
ends the reseed: the account stays disabled, the password may be deleted, and
``breakglass`` is the recovery path.

The console keeps the bootstrap admin. Retiring it is an operator's policy
choice made here. Refused unless the deployment already has an enabled
admin-role account of its own -- ``retire_admin_available`` on the setup status
is the same predicate. Returns the setup status, which now
reports ``admin_retired``. Reversal is not an API: remove ``admin_retired``
from ``governance/settings/auth.yaml`` in the deploy repo and restart.

**Usage**:

```console
$ dfe auth setup retire-admin [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth setup retire-admin

Calls POST /api/v1/auth/setup/retire-admin.

### `dfe auth setup-status`

**Usage**:

```console
$ dfe auth setup-status [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Setup Status

#### `dfe auth setup-status list`

Get Setup Status

Report first-run setup state and what is configured (no auth -- pre-login UI).

Driven by the setup state machine (``state_machines/setup.py``). The
registries the wizard renders -- OIDC providers and organisations -- are
returned while setup is outstanding and dropped once it completes, so a
configured deployment does not serve its inventory to anonymous callers.
The exception is the name and display name of each enabled OIDC provider,
which stay (no configuration) because the login screen needs to know which
IdPs to offer and what to call them. Accounts are never returned. The
``first_user`` step reports whether a real (non break-glass) user exists.

**Usage**:

```console
$ dfe auth setup-status list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe auth setup-status list

Calls GET /api/v1/auth/setup-status.

## `dfe authoring`

**Usage**:

```console
$ dfe authoring [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `from-hyperdx`: Strip Search Query Time Bounds
* `scaffold`: Scaffold
* `ai`

### `dfe authoring from-hyperdx`

Strip Search Query Time Bounds

Strip a Search query's time bounds -> &#123;window&#125;, ready to save as a rule.

**Usage**:

```console
$ dfe authoring from-hyperdx [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--body-query <str>`: Query Required.
* `--time-fields <str>`: Time Fields
* `--help`: Show this message and exit.

Example: dfe authoring from-hyperdx

Calls POST /api/v1/authoring/from-hyperdx.

### `dfe authoring scaffold`

Scaffold

A starter SELECT over discovered columns (source meta + landed _json keys).

**Usage**:

```console
$ dfe authoring scaffold [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--table <str>`: Table Required.
* `--columns <str>`: Columns
* `--source <str>`: Source
* `--limit <int>`: Limit
* `--help`: Show this message and exit.

Example: dfe authoring scaffold

Calls POST /api/v1/authoring/scaffold.

### `dfe authoring ai`

**Usage**:

```console
$ dfe authoring ai [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Ai Create
* `generate-vrl`: Ai Generate Vrl
* `review`: Ai Review
* `suggest-schema`: Ai Suggest Schema

#### `dfe authoring ai create`

Ai Create

Draft a query from a prompt with the registered query generator module.

**Usage**:

```console
$ dfe authoring ai create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--prompt <str>`: Prompt Required.
* `--source-name <str>`: Source Name
* `--columns <str>`: Columns JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe authoring ai create

Calls POST /api/v1/authoring/ai/create.

#### `dfe authoring ai generate-vrl`

Ai Generate Vrl

Draft VRL from log samples with the registered log parser module.

**Usage**:

```console
$ dfe authoring ai generate-vrl [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--samples <str>`: Samples Required.
* `--source-hint <str>`: Source Hint
* `--help`: Show this message and exit.

Example: dfe authoring ai generate-vrl

Calls POST /api/v1/authoring/ai/generate-vrl.

#### `dfe authoring ai review`

Ai Review

Review rule SQL with the registered query optimiser module.

**Usage**:

```console
$ dfe authoring ai review [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--sql <str>`: Sql Required.
* `--execution-profile <str>`: Execution Profile JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe authoring ai review

Calls POST /api/v1/authoring/ai/review.

#### `dfe authoring ai suggest-schema`

Ai Suggest Schema

Suggest meta-schema changes with the registered schema optimiser module.

**Usage**:

```console
$ dfe authoring ai suggest-schema [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source-name <str>`: Source Name Required.
* `--source-schema <str>`: Source Schema JSON or YAML, or file://&lt;path>.
* `--query-patterns <str>`: Query Patterns
* `--help`: Show this message and exit.

Example: dfe authoring ai suggest-schema

Calls POST /api/v1/authoring/ai/suggest-schema.

## `dfe backing-services`

**Usage**:

```console
$ dfe backing-services [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Backing Service
* `list`: List Backing Services
* `overlays-cmd`: List Overlays
* `overlays`

### `dfe backing-services get`

Get Backing Service

One backing service's DECLARED deploy configuration (see the list route).

**Usage**:

```console
$ dfe backing-services get [OPTIONS] [service]
```

**Arguments**:

* `service`: Service Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe backing-services get &lt;service>

Calls GET /api/v1/backing-services/&#123;service&#125;.

### `dfe backing-services list`

List Backing Services

Every backing service's DECLARED deploy configuration, and who runs it.

Declared, not observed: these are the values the deploy repo asks for, read
from git. The engine runs no Kubernetes client, so a figure here can differ
from the cluster whenever Argo has not synced the declaration yet. A service
DFE does not run (managed_by provider or external) adds ``observed``, read from
its own broker or server and held briefly per service, and ``read_only``, the
values a write is refused on.

**Usage**:

```console
$ dfe backing-services list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe backing-services list

Calls GET /api/v1/backing-services.

### `dfe backing-services overlays-cmd`

List Overlays

List infra overlay resources in the deploy repo's infra/ dir.

**Usage**:

```console
$ dfe backing-services overlays-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe backing-services overlays

Calls GET /api/v1/backing-services/overlays.

### `dfe backing-services overlays`

**Usage**:

```console
$ dfe backing-services overlays [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `vars`

#### `dfe backing-services overlays vars`

**Usage**:

```console
$ dfe backing-services overlays vars [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Set Overlay Var
* `delete`: Delete Overlay Var
* `list`: List Overlay Vars

##### `dfe backing-services overlays vars apply`

Set Overlay Var

Set an infra overlay value.

409 managed_by_provider, before any other check, when DFE does not run the
service and the value is one of its read_only paths. helmvars:override does not
lift it. 403 with the policy that blocked it when the var is protected - the
storage model, the data-layer modes and the disk size are decided at deploy, and
moving one on a live deployment is a data migration. 400 when the value would
lower a declared node or broker count, or leave it undeclared (a parent map that
omits it), which loses data rather than capacity. helmvars:override does not lift it.

**Usage**:

```console
$ dfe backing-services overlays vars apply [OPTIONS] [name] [path]
```

**Arguments**:

* `name`: Name Required.
* `path`: Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--value <str>`: Value Required.
* `--help`: Show this message and exit.

Example: dfe backing-services overlays vars apply &lt;name> &lt;path>

Calls PUT /api/v1/backing-services/overlays/&#123;name&#125;/vars/&#123;path&#125;.

##### `dfe backing-services overlays vars delete`

Delete Overlay Var

Revert an infra overlay value to its chart default. Protected vars refuse.

409 managed_by_provider, before any other check and whatever the caller holds,
when DFE does not run the service and the value is one of its read_only paths.
400 when the revert would lower a declared node or broker count, or leave it
undeclared, unless the caller holds helmvars:override. An undeclared count falls
to the chart or profile default, which the engine cannot read, so a revert that
leaves one undeclared is refused whatever that default is.

**Usage**:

```console
$ dfe backing-services overlays vars delete [OPTIONS] [name] [path]
```

**Arguments**:

* `name`: Name Required.
* `path`: Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe backing-services overlays vars delete &lt;name> &lt;path>

Calls DELETE /api/v1/backing-services/overlays/&#123;name&#125;/vars/&#123;path&#125;.

##### `dfe backing-services overlays vars list`

List Overlay Vars

Flattened dot-path vars for one overlay, each marked protected or not.

Credentials come back masked, as every other read of the deploy repo masks them.

**Usage**:

```console
$ dfe backing-services overlays vars list [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe backing-services overlays vars list &lt;name>

Calls GET /api/v1/backing-services/overlays/&#123;name&#125;/vars.

## `dfe cel`

**Usage**:

```console
$ dfe cel [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `check`: Validate a CEL expression and classify its performance tier
* `check-batch`: Validate multiple CEL expressions in one call

### `dfe cel check`

Validate a CEL expression and classify its performance tier

Returns syntax validity, performance tier, referenced fields, and a human-readable description of what the expression matches. Designed for live UI validation as the user types -- completes in <1ms.

**Usage**:

```console
$ dfe cel check [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--expression <str>`: CEL expression to validate Required.
* `--check-profile / --no-check-profile`: If true, apply DFE profile restrictions (reject regex/iteration/time). Leave false for transport filters -- Tier 3 is classification only, not rejection.
* `--help`: Show this message and exit.

Example: dfe cel check

Calls POST /api/v1/cel/check.

### `dfe cel check-batch`

Validate multiple CEL expressions in one call

Batch version of /cel/check. Use when the UI needs to validate an entire filter list at once (e.g., on form submit). Max 100 expressions.

**Usage**:

```console
$ dfe cel check-batch [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--expressions <str>`: List of CEL expressions to validate Required.
* `--check-profile / --no-check-profile`: Check Profile
* `--help`: Show this message and exit.

Example: dfe cel check-batch

Calls POST /api/v1/cel/check-batch.

## `dfe deployment`

**Usage**:

```console
$ dfe deployment [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `admin-links`

### `dfe deployment admin-links`

**Usage**:

```console
$ dfe deployment admin-links [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List Admin Links

#### `dfe deployment admin-links list`

List Admin Links

Each admin UI this deployment runs, in the order its deployer listed them.

The deployer supplies the list, so an empty one means it listed none. Gated to
the admin-class roles, which hold ``deployment:*`` or ``*``: the list maps the
deployment's consoles. Links only. Nothing here carries a credential.

**Usage**:

```console
$ dfe deployment admin-links list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe deployment admin-links list

Calls GET /api/v1/deployment/admin-links.

## `dfe field-maps`

**Usage**:

```console
$ dfe field-maps [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Create Field Map
* `delete`: Delete Source Field Map
* `get`: Get Default Field Map
* `get-for-source`: Get Source Field Map
* `list`: List Field Maps
* `seed`: Seed Field Maps

### `dfe field-maps create`

Create Field Map

Create or update a field map.

**Usage**:

```console
$ dfe field-maps create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--standard <str>`: Standard identifier (sigma, ecs, cim) Required.
* `--source <str>`: Source name, or None for the default map
* `--version <str>`: Standard version (e.g. '8.11' for ECS)
* `--description <str>`: Human description
* `--inherits <str>`: Reference to base map (declarative)
* `--mappings <str>`: standard_field -> dfe_column_name JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe field-maps create

Calls POST /api/v1/field-maps.

### `dfe field-maps delete`

Delete Source Field Map

Delete a source-specific field map override.

**Usage**:

```console
$ dfe field-maps delete [OPTIONS] [standard] [source]
```

**Arguments**:

* `standard`: Standard Required.
* `source`: Source Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe field-maps delete &lt;standard> &lt;source>

Calls DELETE /api/v1/field-maps/&#123;standard&#125;/&#123;source&#125;.

### `dfe field-maps get`

Get Default Field Map

Get the default field map for a standard (no source-specific overrides).

**Usage**:

```console
$ dfe field-maps get [OPTIONS] [standard]
```

**Arguments**:

* `standard`: Standard Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe field-maps get &lt;standard>

Calls GET /api/v1/field-maps/&#123;standard&#125;.

### `dfe field-maps get-for-source`

Get Source Field Map

Get the source-specific field map override.

**Usage**:

```console
$ dfe field-maps get-for-source [OPTIONS] [standard] [source]
```

**Arguments**:

* `standard`: Standard Required.
* `source`: Source Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe field-maps get-for-source &lt;standard> &lt;source>

Calls GET /api/v1/field-maps/&#123;standard&#125;/&#123;source&#125;.

### `dfe field-maps list`

List Field Maps

List field maps with optional filtering.

**Usage**:

```console
$ dfe field-maps list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--standard <str>`: Filter by mapping standard (e.g. sigma, ecs)
* `--search <str>`: Search in standard/source names
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over mapping_count, source, standard, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe field-maps list

Calls GET /api/v1/field-maps.

### `dfe field-maps seed`

Seed Field Maps

Seed built-in default field maps. Non-destructive.

**Usage**:

```console
$ dfe field-maps seed [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe field-maps seed

Calls POST /api/v1/field-maps/seed.

## `dfe gitops`

**Usage**:

```console
$ dfe gitops [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `auto-merge`
* `classes`
* `log`

### `dfe gitops auto-merge`

**Usage**:

```console
$ dfe gitops auto-merge [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Auto Merge
* `put`: Put Auto Merge

#### `dfe gitops auto-merge list`

Get Auto Merge

Auto-merge status for the UI banner: stored flag, gate verdict, net effect.

**Usage**:

```console
$ dfe gitops auto-merge list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe gitops auto-merge list

Calls GET /api/v1/gitops/auto-merge.

#### `dfe gitops auto-merge put`

Put Auto Merge

Toggle auto-merge. Enabling requires the deployment gate. Disabling always works.

**Usage**:

```console
$ dfe gitops auto-merge put [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--enabled / --no-enabled`: Enabled Required.
* `--help`: Show this message and exit.

Example: dfe gitops auto-merge put

Calls PUT /api/v1/gitops/auto-merge.

### `dfe gitops classes`

**Usage**:

```console
$ dfe gitops classes [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List Classes
* `resources`

#### `dfe gitops classes list`

List Classes

The resource-class registry - what VarChange.cls may legally name.

Registry metadata only (no resource content), so any authenticated caller
may read it. The per-class listings below are gated by each class's grant.

**Usage**:

```console
$ dfe gitops classes list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe gitops classes list

Calls GET /api/v1/gitops/classes.

#### `dfe gitops classes resources`

**Usage**:

```console
$ dfe gitops classes resources [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List Class Resources
* `vars`

##### `dfe gitops classes resources list`

List Class Resources

Resource names in a class - what VarChange.name may legally name.

**Usage**:

```console
$ dfe gitops classes resources list [OPTIONS] [cls]
```

**Arguments**:

* `cls`: Cls Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe gitops classes resources list &lt;cls>

Calls GET /api/v1/gitops/classes/&#123;cls&#125;/resources.

##### `dfe gitops classes resources vars`

**Usage**:

```console
$ dfe gitops classes resources vars [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List Class Resource Vars

###### `dfe gitops classes resources vars list`

List Class Resource Vars

Flattened dot-path vars of one resource - what VarChange.path may name.

Values ride along so a select can show the current value beside each path, with
credentials masked as every other read of the deploy repo masks them.

**Usage**:

```console
$ dfe gitops classes resources vars list [OPTIONS] [cls] [name]
```

**Arguments**:

* `cls`: Cls Required.
* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe gitops classes resources vars list &lt;cls> &lt;name>

Calls GET /api/v1/gitops/classes/&#123;cls&#125;/resources/&#123;name&#125;/vars.

### `dfe gitops log`

**Usage**:

```console
$ dfe gitops log [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Log

#### `dfe gitops log list`

Get Log

Gitcrud audit log: every governed-ops git change, newest-first.

Flat + cursor-paginated by default; ?group_by= buckets the page for
summaries. applied_revision (the Argo-synced SHA) turns state into
applied/pending. Without it every entry is 'committed'.

**Usage**:

```console
$ dfe gitops log list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--limit <int>`: Limit
* `--before <str>`: Before
* `--group-by <str>`: Group By
* `--applied-revision <str>`: Applied Revision
* `--help`: Show this message and exit.

Example: dfe gitops log list

Calls GET /api/v1/gitops/log.

## `dfe governance`

**Usage**:

```console
$ dfe governance [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `actions`
* `admin`
* `ch-rbac`
* `policies`

### `dfe governance actions`

**Usage**:

```console
$ dfe governance actions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Action
* `invoke`: Invoke Action
* `list`: List Actions

#### `dfe governance actions get`

Get Action

One defined action. A credential a legacy definition still carries comes back masked.

**Usage**:

```console
$ dfe governance actions get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe governance actions get &lt;name>

Calls GET /api/v1/governance/actions/&#123;name&#125;.

#### `dfe governance actions invoke`

Invoke Action

Invoke a defined action - gated on the action's OWN required_action.

``body.params`` supplies values for the action's declared params (422 on a
constraint violation. Omitted params take their defaults). A hunt or rule
document the action would leave invalid is 422 ``invalid_document``, with the
hunts API's own message. A change to the infra overlay meets the backing-services
guards on what the action leaves, dry run included, whatever the caller holds:
409 ``managed_by_provider`` for a read-only value of a service DFE does not run,
then 400 ``scale_down_refused`` where it lowers or un-declares a node or broker
count.
Direct commit in dev/solo. A production+team invoke is routed to a review PR (or
409 ``review_required`` when no forge is configured).

**Usage**:

```console
$ dfe governance actions invoke [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Dry Run
* `--params <str>`: Params JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe governance actions invoke &lt;name>

Calls POST /api/v1/governance/actions/&#123;name&#125;/invoke.

#### `dfe governance actions list`

List Actions

List the defined actions by name.

**Usage**:

```console
$ dfe governance actions list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe governance actions list

Calls GET /api/v1/governance/actions.

### `dfe governance admin`

**Usage**:

```console
$ dfe governance admin [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `actions-cmd`: Create Action
* `policies-cmd`: Create Policy
* `actions`
* `policies`

#### `dfe governance admin actions-cmd`

Create Action

Define or replace an action.

400 ``credential_in_action`` where a change targets a credential: the definition
is committed to the deploy repo, so a credential in it is plaintext in history.

**Usage**:

```console
$ dfe governance admin actions-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Name Required.
* `--description <str>`: Description
* `--required-action <str>`: RBAC string checked at invoke time; empty derives action:invoke:&lt;name>
* `--params <str>`: Params JSON or YAML, or file://&lt;path>.
* `--changes <str>`: Changes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe governance admin actions

Calls POST /api/v1/governance/admin/actions.

#### `dfe governance admin policies-cmd`

Create Policy

Define or replace a protected-var policy.

**Usage**:

```console
$ dfe governance admin policies-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Name Required.
* `--description <str>`: Description
* `--protected <str>`: Protected
* `--help`: Show this message and exit.

Example: dfe governance admin policies

Calls POST /api/v1/governance/admin/policies.

#### `dfe governance admin actions`

**Usage**:

```console
$ dfe governance admin actions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `delete`: Delete Action
* `validate`: Validate Action

##### `dfe governance admin actions delete`

Delete Action

Remove a defined action.

**Usage**:

```console
$ dfe governance admin actions delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe governance admin actions delete &lt;name>

Calls DELETE /api/v1/governance/admin/actions/&#123;name&#125;.

##### `dfe governance admin actions validate`

Validate Action

Dry-check an action definition: every violation + the would-be diff.

Nothing is committed - this is the authoring hand-hold, run before the
define endpoint so a wizard can show the full diff and every problem in
one round trip. That includes each change invoke would refuse under the
infra overlay guards (``managed_by_provider``, ``scale_down_refused``), on
every enum map branch, reported by its message.

**Usage**:

```console
$ dfe governance admin actions validate [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Name Required.
* `--description <str>`: Description
* `--required-action <str>`: RBAC string checked at invoke time; empty derives action:invoke:&lt;name>
* `--params <str>`: Params JSON or YAML, or file://&lt;path>.
* `--changes <str>`: Changes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe governance admin actions validate

Calls POST /api/v1/governance/admin/actions/validate.

#### `dfe governance admin policies`

**Usage**:

```console
$ dfe governance admin policies [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `delete`: Delete Policy

##### `dfe governance admin policies delete`

Delete Policy

Remove a protected-var policy.

**Usage**:

```console
$ dfe governance admin policies delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe governance admin policies delete &lt;name>

Calls DELETE /api/v1/governance/admin/policies/&#123;name&#125;.

### `dfe governance ch-rbac`

**Usage**:

```console
$ dfe governance ch-rbac [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `reconcile`: Reconcile Ch Rbac Endpoint

#### `dfe governance ch-rbac reconcile`

Reconcile Ch Rbac Endpoint

Reconcile ClickHouse quota tiers, service roles and per-org row policies.

It mints the service-user secrets in the configured secrets backend, and a repeat run
changes nothing.

**Usage**:

```console
$ dfe governance ch-rbac reconcile [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe governance ch-rbac reconcile

Calls POST /api/v1/governance/ch-rbac/reconcile.

### `dfe governance policies`

**Usage**:

```console
$ dfe governance policies [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Policy
* `list`: List Policies

#### `dfe governance policies get`

Get Policy

Return one protected-var policy.

**Usage**:

```console
$ dfe governance policies get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe governance policies get &lt;name>

Calls GET /api/v1/governance/policies/&#123;name&#125;.

#### `dfe governance policies list`

List Policies

List the protected-var policies by name.

**Usage**:

```console
$ dfe governance policies list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe governance policies list

Calls GET /api/v1/governance/policies.

## `dfe helm`

**Usage**:

```console
$ dfe helm [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `files-cmd`: List Files
* `files`

### `dfe helm files-cmd`

List Files

List helm-var overlay resources.

**Usage**:

```console
$ dfe helm files-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe helm files

Calls GET /api/v1/helm/files.

### `dfe helm files`

**Usage**:

```console
$ dfe helm files [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `vars`

#### `dfe helm files vars`

**Usage**:

```console
$ dfe helm files vars [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Set Var
* `delete`: Delete Var
* `list`: List Vars

##### `dfe helm files vars apply`

Set Var

Set a helm var.

A direct commit in dev or solo, and routed to a review PR (or 409
'review_required') in production+team. 409 on a stale If-Match, 403 if protected.

**Usage**:

```console
$ dfe helm files vars apply [OPTIONS] [name] [path]
```

**Arguments**:

* `name`: Name Required.
* `path`: Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--value <str>`: Value Required.
* `--help`: Show this message and exit.

Example: dfe helm files vars apply &lt;name> &lt;path>

Calls PUT /api/v1/helm/files/&#123;name&#125;/vars/&#123;path&#125;.

##### `dfe helm files vars delete`

Delete Var

Revert a helm var to its chart default.

Routed like set_var (a PR in prod+team). 403 if protected, since reverting a
locked var changes it as surely as setting it.

**Usage**:

```console
$ dfe helm files vars delete [OPTIONS] [name] [path]
```

**Arguments**:

* `name`: Name Required.
* `path`: Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe helm files vars delete &lt;name> &lt;path>

Calls DELETE /api/v1/helm/files/&#123;name&#125;/vars/&#123;path&#125;.

##### `dfe helm files vars list`

List Vars

Flattened dot-path vars for a resource, each marked protected or not.

Credentials come back masked, as the app surface's values route masks them.

**Usage**:

```console
$ dfe helm files vars list [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe helm files vars list &lt;name>

Calls GET /api/v1/helm/files/&#123;name&#125;/vars.

## `dfe hunts`

**Usage**:

```console
$ dfe hunts [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Hunt
* `create`: Create Hunt
* `delete`: Delete Hunt
* `get`: Get Hunt
* `list`: List Hunts
* `run`: Trigger Hunt
* `status`: Get Engine Status

### `dfe hunts apply`

Update Hunt

Replace an existing hunt configuration, resolving its customers afresh.

A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the ``X-DFE-Review-Required`` header says so. 422
``unknown_org`` when a customer names no registered org.

**Usage**:

```console
$ dfe hunts apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--display-name <str>`: Human-readable label (defaults from ``name`` when omitted on write)
* `--cron <str>`: Cron expression or list of expressions Required.
* `--log-buffer <int>`: Log Buffer
* `--global-target-table-name <str>`: Results table override; the rule's query carries its own target when omitted
* `--global-source-table-name <str>`: Global Source Table Name
* `--customers <str>`: Names of the registered orgs the hunt reads. The engine resolves each to its tenant ids when it saves the hunt, and the runner reads no other org's rows. Required.
* `--checkpoint-timestamp-field <str>`: Checkpoint Timestamp Field
* `--scheduling-mode <str>`: Scheduling Mode
* `--min-interval-seconds <int>`: Min Interval Seconds
* `--explain-queries / --no-explain-queries`: Explain Queries
* `--rules <str>`: Rule names, each the ``{name}.yaml`` rule file the hunt runner reads Required.
* `--help`: Show this message and exit.

Example: dfe hunts apply &lt;name>

Calls PUT /api/v1/hunts/&#123;name&#125;.

### `dfe hunts create`

Create Hunt

Create a new hunt configuration YAML.

A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the ``X-DFE-Review-Required`` header says so. 422
``unknown_org`` when a customer names no registered org.

**Usage**:

```console
$ dfe hunts create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--display-name <str>`: Human-readable label (defaults from ``name`` when omitted on write)
* `--cron <str>`: Cron expression or list of expressions Required.
* `--log-buffer <int>`: Log Buffer
* `--global-target-table-name <str>`: Results table override; the rule's query carries its own target when omitted
* `--global-source-table-name <str>`: Global Source Table Name
* `--customers <str>`: Names of the registered orgs the hunt reads. The engine resolves each to its tenant ids when it saves the hunt, and the runner reads no other org's rows. Required.
* `--checkpoint-timestamp-field <str>`: Checkpoint Timestamp Field
* `--scheduling-mode <str>`: Scheduling Mode
* `--min-interval-seconds <int>`: Min Interval Seconds
* `--explain-queries / --no-explain-queries`: Explain Queries
* `--rules <str>`: Rule names, each the ``{name}.yaml`` rule file the hunt runner reads Required.
* `--name <str>`: Hunt file name (YAML stem); must be unique Required.
* `--help`: Show this message and exit.

Example: dfe hunts create

Calls POST /api/v1/hunts.

### `dfe hunts delete`

Delete Hunt

Delete a hunt configuration.

A production+team delete is routed to a review branch, so the runner keeps
executing the hunt until that branch is merged. ``X-DFE-Review-Required`` says so.

**Usage**:

```console
$ dfe hunts delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe hunts delete &lt;name>

Calls DELETE /api/v1/hunts/&#123;name&#125;.

### `dfe hunts get`

Get Hunt

Get full hunt configuration by file name.

**Usage**:

```console
$ dfe hunts get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe hunts get &lt;name>

Calls GET /api/v1/hunts/&#123;name&#125;.

### `dfe hunts list`

List Hunts

List persisted hunt configurations, each with its run state, paginated.

Run state comes from ONE ClickHouse read across every listed hunt: the watermark
(last run), the lease (running now), hunt_state (too aggressive) and hunt_run
(rows the last run wrote). Next due is derived, not stored.

**Usage**:

```console
$ dfe hunts list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Case-insensitive search in name, display_name, customers, rules, source_table, target_table
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over display_name, name, source_table, target_table, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe hunts list

Calls GET /api/v1/hunts.

### `dfe hunts run`

Trigger Hunt

Queue an ad-hoc run: mark the hunt due now for the runner to claim.

The pull model is kept. Nothing is pushed at the runner and no listener is added
-- the fire is written into the coordination state, and the runner that is
already running picks it up on its next poll, through the same claim that stops
a hunt double-running. 202 says it is queued, not that it has run. The response
carries the poll interval so the caller knows the longest wait before it starts.

A hunt with no rate schedule is not something the runner ticks, so a queued run
for one sits unclaimed. That is the schedule's shape, not a failure here.

503 is reserved for ClickHouse actually being unreachable. Any other failure to
write the request is a 500, so a bug here never reads as an outage.

**Usage**:

```console
$ dfe hunts run [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe hunts run &lt;name>

Calls POST /api/v1/hunts/&#123;name&#125;/run.

### `dfe hunts status`

Get Engine Status

Report hunt scheduling status.

Hunts execute in the separate dfe-hunt-runner service (pull-based, coordinated
via ClickHouse), not in this API process, so ``runners`` counts the runners that
beat within their last two polls and ``running`` is whether any did. For "is this
hunt running", read the per-hunt ``running`` on the hunts list. ``hunt_count`` is
the configured-hunt count.

**Usage**:

```console
$ dfe hunts status [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe hunts status

Calls GET /api/v1/hunts/status.

## `dfe hyperdx`

**Usage**:

```console
$ dfe hyperdx [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `connection`: Get Search Connection
* `sources`: List Search Sources

### `dfe hyperdx connection`

Get Search Connection

Return the caller's OWN org connection - never another org's.

A caller granted ``query:execute`` at system scope by a declared, unscoped role
other than ``org_viewer`` gets the platform reader. Any other caller gets its org's pinned
``dfe_org_<org>`` user, whatever roles it holds at that org's scope. A caller
that resolves to zero or several separate orgs is refused (403) so isolation
fails closed rather than guessing.

**Usage**:

```console
$ dfe hyperdx connection [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe hyperdx connection

Calls GET /api/v1/hyperdx/connection.

### `dfe hyperdx sources`

List Search Sources

List every Search team and the DFE sources on it.

A deploy writes its source to every team, so this is the read that says where
it landed. 503 when Search is not deployed or not answering -- an empty list
would read as "the source is missing", which is a different fault.

**Usage**:

```console
$ dfe hyperdx sources [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe hyperdx sources

Calls GET /api/v1/hyperdx/sources.

## `dfe ingest`

**Usage**:

```console
$ dfe ingest [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `compat`
* `compat-profiles`
* `rules`

### `dfe ingest compat`

**Usage**:

```console
$ dfe ingest compat [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Apply Compat
* `get`: Get Compat

#### `dfe ingest compat apply`

Apply Compat

Set the profiles every source binds unless it names its own list.

``If-Match`` is required. Each binding must name a stored profile, a version it
publishes and only opt-in rows it offers, and one version of a profile compiles
per deployment, so a version another source binds differently is refused with
422 ``invalid_binding``. A rules-only change answers ``reload: hot``.

**Usage**:

```console
$ dfe ingest compat apply [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Validate and report the change without committing it
* `--if-match <str>`: The current ETag: the write fails with 412 if it has changed
* `--if-none-match <str>`: `*` to create: the write fails with 412 if the resource exists
* `--profiles <str>`: The deployment's default bindings JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe ingest compat apply

Calls PUT /api/v1/ingest/compat.

#### `dfe ingest compat get`

Get Compat

Get the profiles every source binds unless it names its own list. Its ``ETag`` is an apply's ``If-Match``.

**Usage**:

```console
$ dfe ingest compat get [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe ingest compat get

Calls GET /api/v1/ingest/compat.

### `dfe ingest compat-profiles`

**Usage**:

```console
$ dfe ingest compat-profiles [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Compat Profile
* `list`: List Compat Profiles

#### `dfe ingest compat-profiles get`

Get Compat Profile

Get one compatibility profile with every version it publishes.

**Usage**:

```console
$ dfe ingest compat-profiles get [OPTIONS] [path_profile]
```

**Arguments**:

* `path_profile`: Profile Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe ingest compat-profiles get &lt;path-profile>

Calls GET /api/v1/ingest/compat-profiles/&#123;profile&#125;.

#### `dfe ingest compat-profiles list`

List Compat Profiles

List the stored compatibility profiles by id, each at its current version. Takes no filter or order_by.

**Usage**:

```console
$ dfe ingest compat-profiles list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe ingest compat-profiles list

Calls GET /api/v1/ingest/compat-profiles.

### `dfe ingest rules`

**Usage**:

```console
$ dfe ingest rules [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List Rule Blocks
* `order`: Reorder Rule Blocks

#### `dfe ingest rules list`

List Rule Blocks

List every rule block, ``_source`` first, each field's in the order it runs.

Its ``ETag`` is the ``If-Match`` a reorder takes. Takes no filter or order_by.

**Usage**:

```console
$ dfe ingest rules list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe ingest rules list

Calls GET /api/v1/ingest/rules.

#### `dfe ingest rules order`

Reorder Rule Blocks

Set the order one field's rule blocks run in.

``If-Match`` is required, and a stale one answers 412 with the current ETag.
The pinned ``default`` keeps its place last. A rules-only change is one the
receiver reloads where it stands, so ``reload`` answers ``hot``.

**Usage**:

```console
$ dfe ingest rules order [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Validate and report the change without committing it
* `--if-match <str>`: The current ETag: the write fails with 412 if it has changed
* `--if-none-match <str>`: `*` to create: the write fails with 412 if the resource exists
* `--target <_source|_org_id>`: The header field whose blocks are reordered Required.
* `--blocks <str>`: Every block id GET /ingest/rules lists for target bar the pinned default Required.
* `--help`: Show this message and exit.

Example: dfe ingest rules order

Calls POST /api/v1/ingest/rules/order.

## `dfe kafka`

**Usage**:

```console
$ dfe kafka [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `topics-cmd`: List Topic Status
* `client-config`: Emit ready-to-use client config for...
* `topics`

### `dfe kafka topics-cmd`

List Topic Status

Report each source topic's existence, shape, config and drift.

Read-only: it creates nothing, so a status call against a broker mid-restart
reports that it could not be read rather than reporting every topic missing.
A caller held to its orgs sees the topics of the sources it may read.

**Usage**:

```console
$ dfe kafka topics-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source <str>`: Limit to one source's topics; omitted means every source
* `--help`: Show this message and exit.

Example: dfe kafka topics

Calls GET /api/v1/kafka/topics.

### `dfe kafka client-config`

Emit ready-to-use client config for PROVIDER (kcat / confluent / librdkafka).

**Usage**:

```console
$ dfe kafka client-config [OPTIONS]
```

**Options**:

* `--provider <str>`: Provider: strimzi / redpanda / redpanda-cloud / confluent-cloud / msk / plaintext.  [required]
* `--tool <properties|kcat|kafbat>`: Output shape: librdkafka .properties (default), kcat -F file (same), or kafbat-ui JSON.  [default: properties]
* `--bootstrap <str>`: Bootstrap servers (else from settings/.env).
* `--username <str>`: SASL username (else from settings/.env).
* `--password <str>`: SASL password (else from settings/.env).
* `--schema-registry-url <str>`: Schema registry URL (kafbat only).
* `--out FILE`: Write to FILE (chmod 0600) instead of stdout.
* `--eval`: Print `export KCAT_CONFIG=<0600 temp file>` for `eval "$(...)"` so kcat just works.
* `--help`: Show this message and exit.

### `dfe kafka topics`

**Usage**:

```console
$ dfe kafka topics [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `ensure`: Ensure Source Topics
* `remove`: Remove Source Topics
* `update`: Update Source Topics

#### `dfe kafka topics ensure`

Ensure Source Topics

Create every topic the sources in scope need and do not have.

Idempotent, and it never touches a topic that already exists: widening an
existing topic is ``update``, deliberately, so a re-ensure cannot reshape a
live topic as a side effect.

**Usage**:

```console
$ dfe kafka topics ensure [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source <str>`: Limit to one source's topics; omitted means every source
* `-n, --dry-run`: Report what would change without changing it
* `--help`: Show this message and exit.

Example: dfe kafka topics ensure

Calls POST /api/v1/kafka/topics/ensure.

#### `dfe kafka topics remove`

Remove Source Topics

Delete one source's topics. DESTRUCTIVE - the records on them are gone.

Guarded twice over: a source name is required (there is no remove-everything
call), and ``confirm`` must be set. A dry run needs neither the confirmation
nor a broker write, so it is the safe way to see what would go.

**Usage**:

```console
$ dfe kafka topics remove [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source <str>`: The source whose topics go; never every source at once Required.
* `--confirm / --no-confirm`: Must be true: the topic's records go with it and do not come back
* `-n, --dry-run`: Report what would change without changing it
* `--help`: Show this message and exit.

Example: dfe kafka topics remove --source &lt;source>

Calls POST /api/v1/kafka/topics/remove.

#### `dfe kafka topics update`

Update Source Topics

Converge existing topics onto their spec: alter configs, widen partitions.

A topic that does not exist is reported as absent rather than created, so a
source that never deployed shows up here instead of being quietly fixed.

**Usage**:

```console
$ dfe kafka topics update [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source <str>`: Limit to one source's topics; omitted means every source
* `-n, --dry-run`: Report what would change without changing it
* `--help`: Show this message and exit.

Example: dfe kafka topics update

Calls POST /api/v1/kafka/topics/update.

## `dfe library`

**Usage**:

```console
$ dfe library [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Create Artifact
* `delete`: Delete Artifact
* `get`: Get Artifact
* `kinds`: List Kinds
* `list`: List Artifacts
* `rollback`: Rollback
* `update`: Patch Artifact
* `state`
* `tags`
* `usage`
* `versions`

### `dfe library create`

Create Artifact

Create an artefact, with or without its first version.

Creating one empty is what lets its kind, group and labels be settled before
any content can enter.

**Usage**:

```console
$ dfe library create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Name Required.
* `--kind <str>`: A kind declared in the app manifest. Required.
* `--group <str>`: Optional namespace, e.g. 'network'.
* `--description <str>`: Description
* `--labels <str>`: Labels JSON or YAML, or file://&lt;path>.
* `--content <str>`: Publish this as version 1. Omit to create the artefact empty.
* `--message <str>`: Message
* `--help`: Show this message and exit.

Example: dfe library create

Calls POST /api/v1/library.

### `dfe library delete`

Delete Artifact

Remove an artefact. Refused while any instance links to it.

Retiring an artefact that is still in use is a state change, not a delete, so
the history behind a deployed file is never destroyed.

**Usage**:

```console
$ dfe library delete [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe library delete &lt;artifact>

Calls DELETE /api/v1/library/&#123;artifact&#125;.

### `dfe library get`

Get Artifact

One artefact's metadata and pointers.

**Usage**:

```console
$ dfe library get [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe library get &lt;artifact>

Calls GET /api/v1/library/&#123;artifact&#125;.

### `dfe library kinds`

List Kinds

Every artefact kind the manifest declares.

**Usage**:

```console
$ dfe library kinds [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe library kinds

Calls GET /api/v1/library/kinds.

### `dfe library list`

List Artifacts

Every artefact, filtered. Different filters AND together.

**Usage**:

```console
$ dfe library list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--kind <str>`: Kind
* `--group <str>`: Group
* `--state <str>`: State
* `--label <str>`: Repeatable 'key' or 'key=value' selector; all must match.
* `--q <str>`: Substring of the name or the description.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe library list

Calls GET /api/v1/library.

### `dfe library rollback`

Rollback

Point ``current`` back at an earlier version, keeping the newer ones.

**Usage**:

```console
$ dfe library rollback [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <int>`: Version Required.
* `--help`: Show this message and exit.

Example: dfe library rollback &lt;artifact>

Calls POST /api/v1/library/&#123;artifact&#125;/rollback.

### `dfe library update`

Patch Artifact

Edit the classification metadata. Never produces a version.

**Usage**:

```console
$ dfe library update [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--description <str>`: Description
* `--labels <str>`: Labels JSON or YAML, or file://&lt;path>.
* `--group <str>`: Group
* `--help`: Show this message and exit.

Example: dfe library update &lt;artifact>

Calls PATCH /api/v1/library/&#123;artifact&#125;.

### `dfe library state`

**Usage**:

```console
$ dfe library state [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Set State

#### `dfe library state apply`

Set State

Set the lifecycle state.

**Usage**:

```console
$ dfe library state apply [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--state <str>`: enabled | disabled | deprecated Required.
* `--help`: Show this message and exit.

Example: dfe library state apply &lt;artifact>

Calls PUT /api/v1/library/&#123;artifact&#125;/state.

### `dfe library tags`

**Usage**:

```console
$ dfe library tags [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Set Tag
* `delete`: Delete Tag

#### `dfe library tags apply`

Set Tag

Point a tag at a version. Repointing is explicit, never a side effect.

**Usage**:

```console
$ dfe library tags apply [OPTIONS] [artifact] [tag]
```

**Arguments**:

* `artifact`: Artifact Required.
* `tag`: Tag Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <int>`: Version Required.
* `--help`: Show this message and exit.

Example: dfe library tags apply &lt;artifact> &lt;tag>

Calls PUT /api/v1/library/&#123;artifact&#125;/tags/&#123;tag&#125;.

#### `dfe library tags delete`

Delete Tag

Remove a tag. The versions it named are untouched.

**Usage**:

```console
$ dfe library tags delete [OPTIONS] [artifact] [tag]
```

**Arguments**:

* `artifact`: Artifact Required.
* `tag`: Tag Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe library tags delete &lt;artifact> &lt;tag>

Calls DELETE /api/v1/library/&#123;artifact&#125;/tags/&#123;tag&#125;.

### `dfe library usage`

**Usage**:

```console
$ dfe library usage [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Usage

#### `dfe library usage get`

Get Usage

Every instance file that links to this artefact.

**Usage**:

```console
$ dfe library usage get [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe library usage get &lt;artifact>

Calls GET /api/v1/library/&#123;artifact&#125;/usage.

### `dfe library versions`

**Usage**:

```console
$ dfe library versions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Publish Version
* `get`: Get Version
* `list`: List Versions

#### `dfe library versions create`

Publish Version

Publish content as a version.

Re-sending identical content is a no-op naming the version that already holds
it. Sending different content at an existing version number is refused.

**Usage**:

```console
$ dfe library versions create [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--if-match <str>`: If-Match
* `--content <str>`: Content Required.
* `--description <str>`: Fixed to this version at publish.
* `--message <str>`: Message
* `--version <int>`: Publish at this exact version. Omit for the next in the series.
* `--help`: Show this message and exit.

Example: dfe library versions create &lt;artifact>

Calls POST /api/v1/library/&#123;artifact&#125;/versions.

#### `dfe library versions get`

Get Version

One immutable version, with its digest as a strong ETag.

**Usage**:

```console
$ dfe library versions get [OPTIONS] [artifact] [version]
```

**Arguments**:

* `artifact`: Artifact Required.
* `version`: Version Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe library versions get &lt;artifact> &lt;version>

Calls GET /api/v1/library/&#123;artifact&#125;/versions/&#123;version&#125;.

#### `dfe library versions list`

List Versions

Every version, oldest first, without their content.

**Usage**:

```console
$ dfe library versions list [OPTIONS] [artifact]
```

**Arguments**:

* `artifact`: Artifact Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe library versions list &lt;artifact>

Calls GET /api/v1/library/&#123;artifact&#125;/versions.

## `dfe lifecycle`

**Usage**:

```console
$ dfe lifecycle [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: List Services
* `post`: Set Lifecycle

### `dfe lifecycle list`

List Services

List services with their tier and current lifecycle state.

**Usage**:

```console
$ dfe lifecycle list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe lifecycle list

Calls GET /api/v1/lifecycle.

### `dfe lifecycle post`

Set Lifecycle

Set a service's lifecycle state - per-service RBAC. Pinned services are 404.

**Usage**:

```console
$ dfe lifecycle post [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--state <running|paused|stopped>`: The gitops state dial value. Required.
* `--help`: Show this message and exit.

Example: dfe lifecycle post &lt;name>

Calls POST /api/v1/lifecycle/&#123;name&#125;.

## `dfe operations`

**Usage**:

```console
$ dfe operations [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `cancel`: Cancel Operation
* `get`: Get Operation
* `list`: List Operations

### `dfe operations cancel`

Cancel Operation

Cancel a running operation.

**Usage**:

```console
$ dfe operations cancel [OPTIONS] [operation]
```

**Arguments**:

* `operation`: Operation Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe operations cancel &lt;operation>

Calls POST /api/v1/operations/&#123;operation&#125;/cancel.

### `dfe operations get`

Get Operation

Get an operation: ``done`` with its ``response`` or ``error``, else its progress.

**Usage**:

```console
$ dfe operations get [OPTIONS] [operation]
```

**Arguments**:

* `operation`: Operation Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe operations get &lt;operation>

Calls GET /api/v1/operations/&#123;operation&#125;.

### `dfe operations list`

List Operations

List the operations the caller may see, optionally filtered by kind.

**Usage**:

```console
$ dfe operations list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--kind <str>`: Filter by task kind
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe operations list

Calls GET /api/v1/operations.

## `dfe orgs`

**Usage**:

```console
$ dfe orgs [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Org
* `available-ids`: Available Org Ids
* `create`: Create Org
* `delete`: Delete Org
* `get`: Get Org
* `list`: List Orgs
* `ingest-credentials`

### `dfe orgs apply`

Update Org

Update an organisation (admin only).

The org's tenant ids are stored afresh in every hunt naming it before the org is
written, which also repairs a hunt holding stale ones. A production+team posture
routes that hunt change to review, and the ``X-DFE-Review-Required`` header says
so. An org's name is its identity, so it cannot be changed here.

**Usage**:

```console
$ dfe orgs apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--display-name <str>`: Human-readable label
* `--org-ids <str>`: Tenant IDs
* `--enabled / --no-enabled`: Enable or disable the org
* `--help`: Show this message and exit.

Example: dfe orgs apply &lt;name>

Calls PUT /api/v1/orgs/&#123;name&#125;.

### `dfe orgs available-ids`

Available Org Ids

Tenant ids the deployment's data actually carries (admin only).

Suggestions for the org form's Organisation IDs field, so an operator picks
an id that matches rows rather than typing one that matches none. Declared
above ``/{name}`` so the literal path wins the match.

**Usage**:

```console
$ dfe orgs available-ids [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--limit <int>`: Most tenant ids to return -- a suggestion list, not an export. Unset takes orgs.available_ids_limit (200 by default)
* `--help`: Show this message and exit.

Example: dfe orgs available-ids

Calls GET /api/v1/orgs/available-ids.

### `dfe orgs create`

Create Org

Create a new customer organisation (admin only).

If the Search integration is enabled, the lifecycle manager handles
team creation as part of org provisioning.  Failure is non-fatal.

A hunt already naming the org, such as one whose org was deleted, has the new
org's tenant ids stored first. A production+team posture routes that hunt
change to review, and the ``X-DFE-Review-Required`` header says so.

**Usage**:

```console
$ dfe orgs create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--name <str>`: Unique org name (used as identifier) Required.
* `--display-name <str>`: Human-readable label
* `--org-ids <str>`: Tenant IDs for ClickHouse row-level security
* `--help`: Show this message and exit.

Example: dfe orgs create

Calls POST /api/v1/orgs.

### `dfe orgs delete`

Delete Org

Delete an organisation (admin only), and the ingest credentials it owns.

Every hunt naming the org loses its stored tenant ids first and keeps the name,
so it fails as ``unknown_customers`` and holds its watermark until it is edited,
rather than reading the rows the org left behind. A production+team posture
routes that hunt change to review, and the ``X-DFE-Review-Required`` header says so.

The reserved ``default`` org cannot be deleted, nor can an org another org's
ingest credential binds or a fetched source names: each answers 409.

**Usage**:

```console
$ dfe orgs delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe orgs delete &lt;name>

Calls DELETE /api/v1/orgs/&#123;name&#125;.

### `dfe orgs get`

Get Org

Get a single organisation by name (org:read at that org's scope).

**Usage**:

```console
$ dfe orgs get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe orgs get &lt;name>

Calls GET /api/v1/orgs/&#123;name&#125;.

### `dfe orgs list`

List Orgs

List organisations visible to the caller, paginated.

System-scope org:read holders see every org. Org-scope holders see
only the orgs their grants cover.

**Usage**:

```console
$ dfe orgs list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in org name/display name
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over display_name, name, updated_at, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe orgs list

Calls GET /api/v1/orgs.

### `dfe orgs ingest-credentials`

**Usage**:

```console
$ dfe orgs ingest-credentials [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Apply Ingest Credential
* `delete`: Delete Ingest Credential
* `get`: Get Ingest Credential
* `list`: List Ingest Credentials
* `rotate`: Rotate Ingest Credential

#### `dfe orgs ingest-credentials apply`

Apply Ingest Credential

Create an ingest credential and mint its token, or change what it binds.

``If-None-Match: *`` creates it and answers 201 with the token, once.
``If-Match: <etag>`` updates its orgs, default org and listeners and keeps its
token. A credential id is unique across every org, so creating one another org
holds answers 409 ``credential_id_taken``. A binding the receiver could not
hold answers 422 ``invalid_binding`` with a field error for each problem. A write
another one got to first answers 412 where its precondition no longer holds, else
409 ``conflict``, and changes nothing.

**Usage**:

```console
$ dfe orgs ingest-credentials apply [OPTIONS] [org] [credential]
```

**Arguments**:

* `org`: Org Required.
* `credential`: Credential Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Validate and report the change without committing it
* `--if-match <str>`: The current ETag: the write fails with 412 if it has changed
* `--if-none-match <str>`: `*` to create: the write fails with 412 if the resource exists
* `--orgs <str>`: The orgs its records may land in, the owning org among them. Unset is the owning org alone
* `--default-org <str>`: The org a record takes when no rule picks one of orgs. Unset is the owning org
* `--listeners <str>`: The receiver listeners that accept its token. Unset is every one
* `--help`: Show this message and exit.

Example: dfe orgs ingest-credentials apply &lt;org> &lt;credential>

Calls PUT /api/v1/orgs/&#123;org&#125;/ingest-credentials/&#123;credential&#125;.

#### `dfe orgs ingest-credentials delete`

Delete Ingest Credential

Delete an ingest credential. Its token stops working once the receiver rereads its secret.

One another write got to first answers 412 where its ``If-Match`` no longer holds,
else 409 ``conflict``, and changes nothing.

**Usage**:

```console
$ dfe orgs ingest-credentials delete [OPTIONS] [org] [credential]
```

**Arguments**:

* `org`: Org Required.
* `credential`: Credential Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Validate and report the change without committing it
* `--if-match <str>`: The current ETag: the write fails with 412 if it has changed
* `--if-none-match <str>`: `*` to create: the write fails with 412 if the resource exists
* `--help`: Show this message and exit.

Example: dfe orgs ingest-credentials delete &lt;org> &lt;credential>

Calls DELETE /api/v1/orgs/&#123;org&#125;/ingest-credentials/&#123;credential&#125;.

#### `dfe orgs ingest-credentials get`

Get Ingest Credential

Get one ingest credential, never its token. Its ``ETag`` is an apply's ``If-Match``.

**Usage**:

```console
$ dfe orgs ingest-credentials get [OPTIONS] [org] [credential]
```

**Arguments**:

* `org`: Org Required.
* `credential`: Credential Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe orgs ingest-credentials get &lt;org> &lt;credential>

Calls GET /api/v1/orgs/&#123;org&#125;/ingest-credentials/&#123;credential&#125;.

#### `dfe orgs ingest-credentials list`

List Ingest Credentials

List the ingest credentials an org owns, by id. Takes no filter or order_by.

**Usage**:

```console
$ dfe orgs ingest-credentials list [OPTIONS] [org]
```

**Arguments**:

* `org`: Org Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe orgs ingest-credentials list &lt;org>

Calls GET /api/v1/orgs/&#123;org&#125;/ingest-credentials.

#### `dfe orgs ingest-credentials rotate`

Rotate Ingest Credential

Mint a new token for an ingest credential. The old one stops working and the binding stays.

The new token comes back in this response and never again. ``If-Match`` is
honoured when sent. A rotate the secrets backend refuses answers 503 and leaves the
old token working. One another write got to first answers 412 where its
``If-Match`` no longer holds, else 409 ``conflict``, and changes nothing.

**Usage**:

```console
$ dfe orgs ingest-credentials rotate [OPTIONS] [org] [credential]
```

**Arguments**:

* `org`: Org Required.
* `credential`: Credential Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Validate and report the change without committing it
* `--if-match <str>`: The current ETag: the write fails with 412 if it has changed
* `--if-none-match <str>`: `*` to create: the write fails with 412 if the resource exists
* `--help`: Show this message and exit.

Example: dfe orgs ingest-credentials rotate &lt;org> &lt;credential>

Calls POST /api/v1/orgs/&#123;org&#125;/ingest-credentials/&#123;credential&#125;/rotate.

## `dfe pipeline`

**Usage**:

```console
$ dfe pipeline [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `build`: Build Pipeline
* `templates`: List Templates

### `dfe pipeline build`

Build Pipeline

Start pipeline manifest generation, answering the operation to poll.

**Usage**:

```console
$ dfe pipeline build [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--config-path <str>`: Path to dfe_package.yaml (uses default if not provided)
* `--output-path <str>`: Output directory for rendered manifests
* `--build-core / --no-build-core`: Build core templates (vs custom only)
* `--help`: Show this message and exit.

Example: dfe pipeline build

Calls POST /api/v1/pipeline/build.

### `dfe pipeline templates`

List Templates

List available Vector pipeline templates.

**Usage**:

```console
$ dfe pipeline templates [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe pipeline templates

Calls GET /api/v1/pipeline/templates.

## `dfe queries`

**Usage**:

```console
$ dfe queries [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `cost-leaderboard`: Query Cost Leaderboard
* `raw`: Execute Raw Query
* `views-cmd`: List Views
* `views`

### `dfe queries cost-leaderboard`

Query Cost Leaderboard

Top query-cost consumers from ``dfe.query_log_archive``, heaviest first.

Groups by the attribution id (the hunt id for feature='hunts') and returns the
query count + summed read rows/bytes + duration + peak memory. Reads the MV the
CH wrapper's log_comment attribution feeds - returns [] until it has data.

**Usage**:

```console
$ dfe queries cost-leaderboard [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--feature <str>`: Attribution feature to rank (e.g. 'hunts')
* `--days <int>`: Lookback window in days
* `--limit <int>`: Max rows
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe queries cost-leaderboard

Calls GET /api/v1/queries/cost-leaderboard.

### `dfe queries raw`

Execute Raw Query

Execute a raw query against a registered datasource adapter.

This is the lower-level query path -- for ad-hoc queries against
datasource adapters rather than parameterized views. The SQL runs as the
engine's own ClickHouse user, so it requires ``raw_query:execute``, which no
built-in role but ``admin`` holds, and ClickHouse runs it read-only.

It returns at most ``options.limit`` rows, or ``query_views.default_limit``,
capped at ``query_views.max_limit``, with ``has_more`` set when the query had
more. The datasource stops reading past the cap.

**Usage**:

```console
$ dfe queries raw [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--datasource <str>`: Datasource URI (e.g. 'clickhouse:default') Required.
* `--body-query <str>`: Query label or identifier Required.
* `--params <str>`: Query parameters JSON or YAML, or file://&lt;path>.
* `--options <str>`: Execution options (limit, timeout, etc.) JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe queries raw

Calls POST /api/v1/queries/raw.

### `dfe queries views-cmd`

List Views

List available parameterized views.

**Usage**:

```console
$ dfe queries views-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--namespace <str>`: Filter by namespace
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe queries views

Calls GET /api/v1/queries/views.

### `dfe queries views`

**Usage**:

```console
$ dfe queries views [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `execute`: Execute View
* `get`: Get View
* `namespaces`: List Namespaces

#### `dfe queries views execute`

Execute View

Execute a parameterized view and return JSON results.

The ``org_id`` parameter is always injected from the authenticated
user's context -- it cannot be overridden by the client. It is the org the
session's account is bound to, and a view taking it runs only when the caller's
groups grant that org or it reads every org (``granted_bound_org``).

**Usage**:

```console
$ dfe queries views execute [OPTIONS] [label]
```

**Arguments**:

* `label`: Label Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--params <str>`: View parameters (validated against view definition) JSON or YAML, or file://&lt;path>.
* `--options <str>`: Execution options (limit, offset, timeout, etc.) JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe queries views execute &lt;label>

Calls POST /api/v1/queries/views/&#123;label&#125;/execute.

#### `dfe queries views get`

Get View

Get a specific view definition with parameters and metadata.

**Usage**:

```console
$ dfe queries views get [OPTIONS] [label]
```

**Arguments**:

* `label`: Label Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe queries views get &lt;label>

Calls GET /api/v1/queries/views/&#123;label&#125;.

#### `dfe queries views namespaces`

List Namespaces

List available view namespaces.

**Usage**:

```console
$ dfe queries views namespaces [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe queries views namespaces

Calls GET /api/v1/queries/views/namespaces.

## `dfe rules`

**Usage**:

```console
$ dfe rules [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Rule
* `create`: Create Rule
* `delete`: Delete Rule
* `from-hyperdx`: Create Rule From Search
* `get`: Get Rule
* `list`: List Rules
* `validate`: Validate Rule Sql

### `dfe rules apply`

Update Rule

Replace a detection rule (re-runs creation pipeline, preserves created_at).

A replacement the hunt runner could not compile is refused with 422 and the
stored rule is left as it was. A production+team write is routed to a review
branch instead of the branch the runner git-syncs, and the
``X-DFE-Review-Required`` header says so.

**Usage**:

```console
$ dfe rules apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--display-name <str>`: Human-readable label (defaults from ``name`` when omitted on create)
* `--severity <str>`: low|medium|high|critical
* `--user-sql <str>`: Full detection query: SELECT ... FROM &lt;db>.&lt;table> WHERE ... (the FROM names the source table) Required.
* `--cel-filter <str>`: CEL expression filter
* `--hunt-name <str>`: Parent hunt name
* `--source <str>`: Source label (e.g. windows_audit)
* `--estimate-cost / --no-estimate-cost`: Return the alert-volume preview's measurement as cost_estimate. The preview and its warnings on the rule follow the deployment's detection guard either way.
* `--cost-window-minutes <int>`: Lookback window in minutes the preview counts over. Absent or 0 uses the deployment's preview window.
* `--help`: Show this message and exit.

Example: dfe rules apply &lt;name>

Calls PUT /api/v1/rules/&#123;name&#125;.

### `dfe rules create`

Create Rule

Create a new hunt rule via RuleCreationService.

The service sanitizes the SQL, applies CEL->SQL transpilation,
validates column references, and optionally estimates query cost. A rule
whose SQL the hunt runner could not compile is refused with 422. The cost
preview counts only the orgs the hunts running the rule read, cut to the orgs
its author may read.

A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the ``X-DFE-Review-Required`` header says so.

**Usage**:

```console
$ dfe rules create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--display-name <str>`: Human-readable label (defaults from ``name`` when omitted on create)
* `--severity <str>`: low|medium|high|critical
* `--user-sql <str>`: Full detection query: SELECT ... FROM &lt;db>.&lt;table> WHERE ... (the FROM names the source table) Required.
* `--cel-filter <str>`: CEL expression filter
* `--hunt-name <str>`: Parent hunt name
* `--source <str>`: Source label (e.g. windows_audit)
* `--estimate-cost / --no-estimate-cost`: Return the alert-volume preview's measurement as cost_estimate. The preview and its warnings on the rule follow the deployment's detection guard either way.
* `--cost-window-minutes <int>`: Lookback window in minutes the preview counts over. Absent or 0 uses the deployment's preview window.
* `--name <str>`: Rule file name (YAML stem); must be unique Required.
* `--source-type <raw|hyperdx>`: 'raw' (plain SQL) or 'hyperdx' (Search saved search format)
* `--help`: Show this message and exit.

Example: dfe rules create

Calls POST /api/v1/rules.

### `dfe rules delete`

Delete Rule

Delete a detection rule.

A production+team delete is routed to a review branch, so the runner keeps
compiling the rule until that branch is merged, which ``X-DFE-Review-Required`` says.

**Usage**:

```console
$ dfe rules delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe rules delete &lt;name>

Calls DELETE /api/v1/rules/&#123;name&#125;.

### `dfe rules from-hyperdx`

Create Rule From Search

Create a hunt rule from the SQL a Search view renders to.

Wraps the create pipeline with ``source_type='hyperdx'`` and auto-derives a
unique rule id from the saved-search name, so the caller need not supply one.
A view whose SQL the hunt runner could not compile, or that matches every
event, is refused with 422. RBAC: ``rule:write`` (data_analyst) --
``org_viewer`` has neither this grant nor the UI button.

**Usage**:

```console
$ dfe rules from-hyperdx [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--raw-sql <str>`: The ClickHouse SELECT the Search view renders to Required.
* `--saved-search-name <str>`: Search saved-search name; seeds the rule id and label
* `--severity <str>`: low|medium|high|critical
* `--hunt-name <str>`: Parent hunt name
* `--source <str>`: Source label (e.g. windows_audit)
* `--help`: Show this message and exit.

Example: dfe rules from-hyperdx

Calls POST /api/v1/rules/from-hyperdx.

### `dfe rules get`

Get Rule

Get a detection rule by file name.

**Usage**:

```console
$ dfe rules get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe rules get &lt;name>

Calls GET /api/v1/rules/&#123;name&#125;.

### `dfe rules list`

List Rules

List detection rules with pagination and search.

**Usage**:

```console
$ dfe rules list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Case-insensitive search in name, display_name, source, hunt_name, severity
* `--severity <str>`: Filter by severity
* `--source <str>`: Filter by source label
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over created_at, display_name, hunt_name, name, severity, source, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe rules list

Calls GET /api/v1/rules.

### `dfe rules validate`

Validate Rule Sql

Validate a detection query (SELECT ... FROM ...) without creating a rule.

Returns any syntax errors or validation issues found.

**Usage**:

```console
$ dfe rules validate [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--sql <str>`: Full SELECT ... FROM ... query to validate Required.
* `--help`: Show this message and exit.

Example: dfe rules validate

Calls POST /api/v1/rules/validate.

## `dfe sample`

**Usage**:

```console
$ dfe sample [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `create`: Sample Adhoc

### `dfe sample create`

Sample Adhoc

Ad-hoc sample - supply an explicit ``table``/``topic`` (or a ``source``).

**Usage**:

```console
$ dfe sample create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--mode <recent|random|smart|anomaly>`: How to pick the sample.

- ``recent``  - newest rows first (fast tail, ClickHouse ORDER BY ts DESC,
  Kafka reads from the partition high-watermark backwards).
- ``random``  - uniform-ish random rows (fair distribution, no recency bias).
- ``smart``   - logreducer representative/diverse sample (default). Gated.
- ``anomaly`` - logreducer isolation-forest outliers (the weird events). Gated.
* `--backend <clickhouse|kafka>`: Where the data is read from.
* `--limit <int>`: Rows to return (defaults to sampler.default_limit)
* `--source <str>`: Registered source name
* `--table <str>`: Explicit ClickHouse table (overrides source's table)
* `--topic <str>`: Explicit Kafka topic (overrides source's land topic)
* `--filter <str>`: One ClickHouse condition over the sampled table's columns (ClickHouse backend only). No subquery, alias, query parameter, table function, or dictionary, Join table or file read.
* `--since <str>`: Lower time bound (ISO 8601) on the timestamp column
* `--until <str>`: Upper time bound (ISO 8601) on the timestamp column
* `--seed <int>`: Seed for random mode (determinism)
* `--level <str>`: logreducer level override: standard | enhanced | maximum
* `--wait <float>`: Seconds to block for inline completion before returning pending
* `--help`: Show this message and exit.

Example: dfe sample create

Calls POST /api/v1/sample.

## `dfe samples`

**Usage**:

```console
$ dfe samples [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Sample
* `list`: List Samples

### `dfe samples get`

Get Sample

Poll a sample task's status and result.

A caller held to its orgs gets 404 for a task not held to them, as for one that
does not exist.

**Usage**:

```console
$ dfe samples get [OPTIONS] [task_id]
```

**Arguments**:

* `task_id`: Task Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe samples get &lt;task-id>

Calls GET /api/v1/samples/&#123;task_id&#125;.

### `dfe samples list`

List Samples

List recent sample tasks (most recent first). A caller held to its orgs sees only theirs.

**Usage**:

```console
$ dfe samples list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe samples list

Calls GET /api/v1/samples.

## `dfe schemas`

**Usage**:

```console
$ dfe schemas [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `build`: Build Schema
* `elastic-converter`: Elastic Converter
* `import`: Import Meta Schema
* `json-paths`: Discover Json Paths
* `list`: List Schemas
* `promote-field`: Promote Field
* `sample-rows`: Sample Source Rows
* `vocabulary`: Get Schema Vocabulary
* `columns`
* `definitions`

### `dfe schemas build`

Build Schema

Build complete schema (DDL) from a source version snapshot.

Runs the v2 YAML -> DDL pipeline and returns the generated DDL
without executing it against ClickHouse.

**Usage**:

```console
$ dfe schemas build [OPTIONS] [source_name]
```

**Arguments**:

* `source_name`: Source Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Source version id (defaults to deployed_version)
* `--help`: Show this message and exit.

Example: dfe schemas build &lt;source-name>

Calls POST /api/v1/schemas/&#123;source_name&#125;/build.

### `dfe schemas elastic-converter`

Elastic Converter

Extract meta-schema columns from an Elasticsearch index template JSON file.

Accepts Beat-style exports with ``template.mappings.properties`` or API-style
``mappings.properties``. Column layout follows curated YAML conventions
(snake_case ``name``, ``@source:`` dotted ``expr``).

Upload size is capped by ``api.elastic_converter_max_upload_bytes`` (reject with 413 and
``upload_too_large`` when exceeded). Override with ``DFE_ENGINE_API_ELASTIC_CONVERTER_*``.

**Usage**:

```console
$ dfe schemas elastic-converter [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe schemas elastic-converter

Calls POST /api/v1/schemas/elastic-converter.

### `dfe schemas import`

Import Meta Schema

Import a meta-schema document exported from another deployment.

A custom document is written through the schema registry. A core document
names a schema dfe-schemas already put here: it is RESOLVED against the local
registry at its pinned version and nothing is written, so the read-only
definition is never forked.

**Usage**:

```console
$ dfe schemas import [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--kind <str>`: Kind
* `--format <int>`: Document format version
* `--path <str>`: Registry path (e.g. meta/cisco_ios) Required.
* `--resource-type <core|custom>`: core travels as a reference; custom travels in full
* `--current <str>`: Current version (custom schemas only)
* `--versions <str>`: Full version history (custom schemas only) JSON or YAML, or file://&lt;path>.
* `--reference <str>`: Path and version pin (core schemas only) JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe schemas import

Calls POST /api/v1/schemas/import.

### `dfe schemas json-paths`

Discover Json Paths

Discover JSON paths inside a source's ``_json`` column.

Resolves the requested ``version`` (or the source's current version). If that
version defines a ``meta_schema`` it uses ``db.<source>`` only after deploy;
until then discovery runs on ``db.<landing>`` filtered by the version's
match rule. Versions without ``meta_schema`` always use the landing table.

Returns one record per path with observed types, a suggested column name,
and whether the path is already promoted. ``?samples=N`` adds random
distinct example values. ``?stats=true`` adds coverage + distinct counts.

A caller without a platform grant holding ``schema:read`` reads only its own
orgs' rows, as the sampler holds it, and a table it cannot be held on is 403.

**Usage**:

```console
$ dfe schemas json-paths [OPTIONS] [source_name]
```

**Arguments**:

* `source_name`: Source Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--samples <int>`: Random distinct example values per path
* `--stats / --no-stats`: Include coverage_pct + distinct_count (expensive, opt-in)
* `--paths <str>`: Comma-separated paths to restrict discovery + sampling
* `--version <str>`: Source version to discover against (defaults to current)
* `--help`: Show this message and exit.

Example: dfe schemas json-paths &lt;source-name>

Calls GET /api/v1/schemas/&#123;source_name&#125;/json-paths.

### `dfe schemas list`

List Schemas

List all meta schemas with optional filtering.

**Usage**:

```console
$ dfe schemas list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in path
* `--schema-type <str>`: Filter by top-level schema path segment (repeat param for multiple), e.g. meta, common-header, additional, hunt-results
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over current, path, updated_at, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe schemas list

Calls GET /api/v1/schemas.

### `dfe schemas promote-field`

Promote Field

Promote JSON path(s) into dedicated typed columns.

Creates a new schema version on the source's meta-schema (or on ``schema_path``
when the source has none), adding one column per path with an ``@source`` directive
naming the bare record path, which is what dfe-loader reads to fill the column on
the next ingest. Existing rows are not backfilled. Core meta-schemas are forked to
``{source_name}_{schema_stem}`` under the same parent path before promoting.
``?dry_run=true`` returns the proposed diff and DDL without forking core schemas,
adding meta-schema versions, or updating the source. A core source, such as the
landing source ``main``, is refused with 409 before any schema is resolved or
written, dry run included. Its ``json-paths`` and ``sample-rows`` reads stay open.

**Usage**:

```console
$ dfe schemas promote-field [OPTIONS] [source_name]
```

**Arguments**:

* `source_name`: Source Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `-n, --dry-run`: Return the proposed diff without committing
* `--json-path <str>`: JSON path (e.g. user.email) or a list of paths for batch promotion Required.
* `--column-name <str>`: Target column name (single promotion only; batch uses suggested names)
* `--data-type <str>`: DFE primitive override; auto-derived from the JSON type when omitted
* `--use-case <str>`: The question the promoted column is asked, which decides the index generated for it (dimension, exact_match, range, word_search, substring_search, key_search, similarity_search(&lt;dims>)), or null for no index. Validated against the type registry dfe-schemas ships as registries/types.yaml, so it follows the registry rather than a list held here.
* `--atomic / --no-atomic`: When true, all paths succeed or none commit; else best-effort
* `--schema-path <str>`: Meta-schema path when the source version has no meta_schema assigned (forbidden if meta_schema is already set on the source)
* `--help`: Show this message and exit.

Example: dfe schemas promote-field &lt;source-name>

Calls POST /api/v1/schemas/&#123;source_name&#125;/promote-field.

### `dfe schemas sample-rows`

Sample Source Rows

Return random sample rows for a source, scoped to its match rule.

Resolves the requested ``version`` (or the source's current version). A
version with a ``meta_schema`` uses ``db.<source>`` only after that version
is deployed and the table exists. Otherwise rows are read from
``db.<landing>`` filtered by the version's match rule.

Intended for inspecting real data while authoring a match condition or CEL
before promoting any JSON path -- a row-level companion to the per-path
``?samples=N`` on ``/json-paths``.

A caller without a platform grant holding ``schema:read`` reads only its own
orgs' rows, as the sampler holds it, and a table it cannot be held on is 403.

**Usage**:

```console
$ dfe schemas sample-rows [OPTIONS] [source_name]
```

**Arguments**:

* `source_name`: Source Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--limit <int>`: Number of random rows to sample
* `--version <str>`: Source version to sample against (defaults to current)
* `--help`: Show this message and exit.

Example: dfe schemas sample-rows &lt;source-name>

Calls GET /api/v1/schemas/&#123;source_name&#125;/sample-rows.

### `dfe schemas vocabulary`

Get Schema Vocabulary

The primitives, use cases, attributes and override types a column may use.

**Usage**:

```console
$ dfe schemas vocabulary [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe schemas vocabulary

Calls GET /api/v1/schemas/vocabulary.

### `dfe schemas columns`

**Usage**:

```console
$ dfe schemas columns [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Schema Columns

#### `dfe schemas columns list`

Get Schema Columns

Get composed schema columns for a source version (profile + meta/derived/additional).

**Usage**:

```console
$ dfe schemas columns list [OPTIONS] [source_name]
```

**Arguments**:

* `source_name`: Source Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--version <str>`: Source version id (defaults to deployed_version)
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe schemas columns list &lt;source-name>

Calls GET /api/v1/schemas/&#123;source_name&#125;/columns.

### `dfe schemas definitions`

**Usage**:

```console
$ dfe schemas definitions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `delete`: Delete Meta Schema
* `export`: Export Meta Schema
* `post`: Create Meta Schema
* `update`: Update Meta Schema
* `derived-cmd`: List Derived Schemas
* `derived`
* `versions`

#### `dfe schemas definitions delete`

Delete Meta Schema

Delete a meta-schema definition by registry path.

**Usage**:

```console
$ dfe schemas definitions delete [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe schemas definitions delete &lt;schema-path>

Calls DELETE /api/v1/schemas/definitions/&#123;schema_path&#125;.

#### `dfe schemas definitions export`

Export Meta Schema

Export one meta schema as a document another deployment can import.

A ``resource_type: core`` schema exports as a REFERENCE -- its path and the
version it was read at -- and never as a copy of its columns: dfe-schemas ships
and updates those definitions, so an embedded copy would fork the read-only
schema on every import.

**Usage**:

```console
$ dfe schemas definitions export [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Single version to export. Omitted exports the whole history of a custom schema, and pins a core one at its current version.
* `--help`: Show this message and exit.

Example: dfe schemas definitions export &lt;schema-path>

Calls GET /api/v1/schemas/definitions/&#123;schema_path&#125;/export.

#### `dfe schemas definitions post`

Create Meta Schema

Create a new meta-schema at the given registry path (parent path + schema name).

**Usage**:

```console
$ dfe schemas definitions post [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--current <str>`: Current version of the schema Required.
* `--versions <str>`: JSON or YAML, or file://&lt;path>. Required.
* `--path <str>`: DirectoryConfigStore table key / relative path (must match URL when set)
* `--help`: Show this message and exit.

Example: dfe schemas definitions post &lt;schema-path>

Calls POST /api/v1/schemas/definitions/&#123;schema_path&#125;.

#### `dfe schemas definitions update`

Update Meta Schema

Update meta-schema metadata: current pointer or a version summary.

**Usage**:

```console
$ dfe schemas definitions update [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Version to update summary for (required when summary is set)
* `--current <str>`: Set the schema's current version pointer
* `--summary <str>`: Update summary on the version selected via query parameter
* `--help`: Show this message and exit.

Example: dfe schemas definitions update &lt;schema-path>

Calls PATCH /api/v1/schemas/definitions/&#123;schema_path&#125;.

#### `dfe schemas definitions derived-cmd`

List Derived Schemas

List every stored derived schema.

**Usage**:

```console
$ dfe schemas definitions derived-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in path and base
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over base, current, path, updated_at, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe schemas definitions derived

Calls GET /api/v1/schemas/definitions/derived.

#### `dfe schemas definitions derived`

**Usage**:

```console
$ dfe schemas definitions derived [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Derived Schema
* `delete`: Delete Derived Schema
* `get`: Get Derived Schema
* `post`: Create Derived Schema

##### `dfe schemas definitions derived apply`

Update Derived Schema

Replace a derived schema. The body is the whole document, as on create.

**Usage**:

```console
$ dfe schemas definitions derived apply [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--path <str>`: Registry path (derived/&lt;group>/&lt;name>); must match the URL when set
* `--base <str>`: Meta-schema registry path, extensionless (e.g. meta/beats/filebeat) Required.
* `--base-version <str>`: Version of the base meta schema Required.
* `--current <str>`: Version of this derived schema to make current Required.
* `--versions <str>`: Version id -> selection JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe schemas definitions derived apply &lt;schema-path>

Calls PUT /api/v1/schemas/definitions/derived/&#123;schema_path&#125;.

##### `dfe schemas definitions derived delete`

Delete Derived Schema

Delete a derived schema by registry path.

**Usage**:

```console
$ dfe schemas definitions derived delete [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe schemas definitions derived delete &lt;schema-path>

Calls DELETE /api/v1/schemas/definitions/derived/&#123;schema_path&#125;.

##### `dfe schemas definitions derived get`

Get Derived Schema

Read one derived schema by registry path (e.g. ``beats/filebeat_auth``).

**Usage**:

```console
$ dfe schemas definitions derived get [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe schemas definitions derived get &lt;schema-path>

Calls GET /api/v1/schemas/definitions/derived/&#123;schema_path&#125;.

##### `dfe schemas definitions derived post`

Create Derived Schema

Create a derived schema at the given registry path.

**Usage**:

```console
$ dfe schemas definitions derived post [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--path <str>`: Registry path (derived/&lt;group>/&lt;name>); must match the URL when set
* `--base <str>`: Meta-schema registry path, extensionless (e.g. meta/beats/filebeat) Required.
* `--base-version <str>`: Version of the base meta schema Required.
* `--current <str>`: Version of this derived schema to make current Required.
* `--versions <str>`: Version id -> selection JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe schemas definitions derived post &lt;schema-path>

Calls POST /api/v1/schemas/definitions/derived/&#123;schema_path&#125;.

#### `dfe schemas definitions versions`

**Usage**:

```console
$ dfe schemas definitions versions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `columns`: Get Meta Schema
* `create`: Add Meta Schema Version
* `delete`: Delete Meta Schema Version

##### `dfe schemas definitions versions columns`

Get Meta Schema

Get one meta-schema definition by registry path (e.g. ``aws/cloudtrail``).

``items`` is a page of the selected version's columns, after search and filters.

**Usage**:

```console
$ dfe schemas definitions versions columns [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--version <str>`: Schema version to return (required) Required.
* `--search <str>`: Case-insensitive substring search across all column fields
* `--name <str>`: Filter by name (substring)
* `--type <str>`: Filter by type (substring)
* `--use-case <str>`: Filter by use_case (substring)
* `--expr <str>`: Filter by expr (substring)
* `--comment <str>`: Filter by comment (substring)
* `--attribute <str>`: Filter by attribute (substring)
* `--searchable-columns <str>`: Fields to apply ``search`` against (name, type, type_filter, use_case, expr, comment, attribute). Defaults to all column fields.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe schemas definitions versions columns &lt;schema-path> --version &lt;version>

Calls GET /api/v1/schemas/definitions/&#123;schema_path&#125;/versions/columns.

##### `dfe schemas definitions versions create`

Add Meta Schema Version

Add a new meta-schema version (bumps semver from current and sets it current).

**Usage**:

```console
$ dfe schemas definitions versions create [OPTIONS] [schema_path]
```

**Arguments**:

* `schema_path`: Schema Path Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--type <model|addition|revision>`: Change category (semver bump from current) Required.
* `--summary <str>`: Human-readable summary stored on the new version
* `--columns <str>`: JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe schemas definitions versions create &lt;schema-path>

Calls POST /api/v1/schemas/definitions/&#123;schema_path&#125;/versions.

##### `dfe schemas definitions versions delete`

Delete Meta Schema Version

Delete a specific meta-schema version.

Core schemas are blocked by the core-resource guard (HTTP 409). The last
remaining version cannot be deleted -- delete the schema instead.

**Usage**:

```console
$ dfe schemas definitions versions delete [OPTIONS] [schema_path] [version]
```

**Arguments**:

* `schema_path`: Schema Path Required.
* `version`: Version Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe schemas definitions versions delete &lt;schema-path> &lt;version>

Calls DELETE /api/v1/schemas/definitions/&#123;schema_path&#125;/versions/&#123;version&#125;.

## `dfe scim`

**Usage**:

```console
$ dfe scim [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `v2`

### `dfe scim v2`

**Usage**:

```console
$ dfe scim v2 [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `groups`
* `resource-types`
* `schemas`
* `service-provider-config`
* `users`

#### `dfe scim v2 groups`

**Usage**:

```console
$ dfe scim v2 groups [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Replace Group
* `create`: Create Group
* `delete`: Delete Group
* `get`: Get Group
* `list`: List Groups
* `update`: Patch Group

##### `dfe scim v2 groups apply`

Replace Group

Replace a group's member set (SCIM PUT).

**Usage**:

```console
$ dfe scim v2 groups apply [OPTIONS] [group_id]
```

**Arguments**:

* `group_id`: Group Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 groups apply &lt;group-id>

Calls PUT /api/v1/scim/v2/Groups/&#123;group_id&#125;.

##### `dfe scim v2 groups create`

Create Group

Provision a group with its member set (member Account.groups kept in sync).

**Usage**:

```console
$ dfe scim v2 groups create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 groups create

Calls POST /api/v1/scim/v2/Groups.

##### `dfe scim v2 groups delete`

Delete Group

Delete a group. Members are detached first so the store permits removal.

**Usage**:

```console
$ dfe scim v2 groups delete [OPTIONS] [group_id]
```

**Arguments**:

* `group_id`: Group Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 groups delete &lt;group-id>

Calls DELETE /api/v1/scim/v2/Groups/&#123;group_id&#125;.

##### `dfe scim v2 groups get`

Get Group

Fetch a single group by id (name).

**Usage**:

```console
$ dfe scim v2 groups get [OPTIONS] [group_id]
```

**Arguments**:

* `group_id`: Group Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 groups get &lt;group-id>

Calls GET /api/v1/scim/v2/Groups/&#123;group_id&#125;.

##### `dfe scim v2 groups list`

List Groups

List groups (SCIM ListResponse). Supports ``displayName eq``, ``id eq`` + paging.

``id eq`` may add ``and members[value eq]``, which lists the group only for a member.

**Usage**:

```console
$ dfe scim v2 groups list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 groups list

Calls GET /api/v1/scim/v2/Groups.

##### `dfe scim v2 groups update`

Patch Group

Apply a PatchOp on group membership (add/remove/replace members).

**Usage**:

```console
$ dfe scim v2 groups update [OPTIONS] [group_id]
```

**Arguments**:

* `group_id`: Group Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 groups update &lt;group-id>

Calls PATCH /api/v1/scim/v2/Groups/&#123;group_id&#125;.

#### `dfe scim v2 resource-types`

**Usage**:

```console
$ dfe scim v2 resource-types [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Resource Types

##### `dfe scim v2 resource-types list`

Resource Types

Advertise the User and Group resource types.

**Usage**:

```console
$ dfe scim v2 resource-types list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 resource-types list

Calls GET /api/v1/scim/v2/ResourceTypes.

#### `dfe scim v2 schemas`

**Usage**:

```console
$ dfe scim v2 schemas [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Schemas

##### `dfe scim v2 schemas list`

Schemas

Advertise the User and Group core schemas (generated from scim2-models).

**Usage**:

```console
$ dfe scim v2 schemas list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 schemas list

Calls GET /api/v1/scim/v2/Schemas.

#### `dfe scim v2 service-provider-config`

**Usage**:

```console
$ dfe scim v2 service-provider-config [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Service Provider Config

##### `dfe scim v2 service-provider-config list`

Service Provider Config

Static SCIM capability advertisement (RFC 7643 s5).

**Usage**:

```console
$ dfe scim v2 service-provider-config list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 service-provider-config list

Calls GET /api/v1/scim/v2/ServiceProviderConfig.

#### `dfe scim v2 users`

**Usage**:

```console
$ dfe scim v2 users [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Replace User
* `create`: Create User
* `delete`: Delete User
* `get`: Get User
* `list`: List Users
* `update`: Patch User

##### `dfe scim v2 users apply`

Replace User

Replace a user's writable attributes (SCIM PUT).

**Usage**:

```console
$ dfe scim v2 users apply [OPTIONS] [user_id]
```

**Arguments**:

* `user_id`: User Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 users apply &lt;user-id>

Calls PUT /api/v1/scim/v2/Users/&#123;user_id&#125;.

##### `dfe scim v2 users create`

Create User

Provision a user. IdP-owned. Local password is randomised when omitted.

A password the IdP does send is held to the same length floor as every other
password the API sets, and one under it is refused rather than replaced.

**Usage**:

```console
$ dfe scim v2 users create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 users create

Calls POST /api/v1/scim/v2/Users.

##### `dfe scim v2 users delete`

Delete User

Delete a user (SCIM 204).

**Usage**:

```console
$ dfe scim v2 users delete [OPTIONS] [user_id]
```

**Arguments**:

* `user_id`: User Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 users delete &lt;user-id>

Calls DELETE /api/v1/scim/v2/Users/&#123;user_id&#125;.

##### `dfe scim v2 users get`

Get User

Fetch a single user by id (username).

**Usage**:

```console
$ dfe scim v2 users get [OPTIONS] [user_id]
```

**Arguments**:

* `user_id`: User Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 users get &lt;user-id>

Calls GET /api/v1/scim/v2/Users/&#123;user_id&#125;.

##### `dfe scim v2 users list`

List Users

List users (SCIM ListResponse). Supports ``userName eq``, ``externalId eq`` + paging.

**Usage**:

```console
$ dfe scim v2 users list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 users list

Calls GET /api/v1/scim/v2/Users.

##### `dfe scim v2 users update`

Patch User

Apply a PatchOp - primarily the ``active`` toggle IdPs use to deprovision.

**Usage**:

```console
$ dfe scim v2 users update [OPTIONS] [user_id]
```

**Arguments**:

* `user_id`: User Id Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe scim v2 users update &lt;user-id>

Calls PATCH /api/v1/scim/v2/Users/&#123;user_id&#125;.

## `dfe services`

**Usage**:

```console
$ dfe services [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Save Service Config
* `delete`: Delete Service Config
* `get`: Get Service Config
* `list`: List Service Configs
* `seed`: Seed Service Configs
* `validate`: Validate Service Config

### `dfe services apply`

Save Service Config

Create or update a service config.

Each top-level section in the body replaces the stored one, and a section the
body leaves out is kept as stored, so a form that sends some sections cannot
drop the rest and the secrets in them. A section written as ``null`` is removed.

A read shows every set secret masked, so a masked value written back keeps the
secret stored there, matched as the app surface matches one. A mask with nothing
stored behind it, or in a list entry that cannot be told apart, is a 400
``masked_value`` and nothing is saved. A changed field beside a masked secret,
in the same mapping or with the secret one mapping down, is a 400
``credential_reentry_required``: the secret is typed again. A value the app's
contract refuses is a 422 ``invalid_config``.

**Usage**:

```console
$ dfe services apply [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe services apply &lt;service> &lt;instance>

Calls PUT /api/v1/services/&#123;service&#125;/&#123;instance&#125;.

### `dfe services delete`

Delete Service Config

Delete a service config.

**Usage**:

```console
$ dfe services delete [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe services delete &lt;service> &lt;instance>

Calls DELETE /api/v1/services/&#123;service&#125;/&#123;instance&#125;.

### `dfe services get`

Get Service Config

A service config as its instance runs it, every credential masked.

The stored keys over the app's own defaults, read from its mounted contract.
With no contract mounted only the stored keys are shown.

**Usage**:

```console
$ dfe services get [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe services get &lt;service> &lt;instance>

Calls GET /api/v1/services/&#123;service&#125;/&#123;instance&#125;.

### `dfe services list`

List Service Configs

List service configs with optional filtering.

**Usage**:

```console
$ dfe services list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--service <str>`: Filter by service type
* `--search <str>`: Search in service/instance names
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over instance, service, updated_at, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe services list

Calls GET /api/v1/services.

### `dfe services seed`

Seed Service Configs

Seed built-in default service configs. Non-destructive.

**Usage**:

```console
$ dfe services seed [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe services seed

Calls POST /api/v1/services/seed.

### `dfe services validate`

Validate Service Config

Dry-run validate a service config without saving.

**Usage**:

```console
$ dfe services validate [OPTIONS] [service] [instance]
```

**Arguments**:

* `service`: Service Required.
* `instance`: Instance Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe services validate &lt;service> &lt;instance>

Calls POST /api/v1/services/&#123;service&#125;/&#123;instance&#125;/validate.

## `dfe sources`

**Usage**:

```console
$ dfe sources [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Update Source
* `build`: Build Source Schema
* `bulk`: Bulk Action
* `catalogue`: List Catalogue
* `catalogue-tags`: List Catalogue Tags
* `create`: Create Source
* `delete`: Delete Source
* `deploy`: Deploy Source Schema
* `engines`: List Table Engines
* `export`: Export Source
* `flow`: Get Source Flow
* `from-catalogue`: Create Sources From Catalogue
* `get`: Get Source
* `import`: Import Source
* `lag`: Get External Lag
* `list`: List Sources
* `plan`: Plan Source Deploy
* `reconcile-apps`: Reconcile Apps
* `sample`: Sample Source
* `seed`: Seed Sources
* `signals`: Get Source Signals
* `update`: Patch Source Enabled
* `columns`
* `versions`

### `dfe sources apply`

Update Source

Update a source from a flat revision body.

Before the first deploy, edits update the working version in place. After deploy, a new
major version is created only when ``current`` equals ``deployed_version`` and a
table-shaping field changes: schema pins (``meta_schema``, ``meta_schema_version``,
``derived_schema``, ``additional_fields``), ``ttl_days``, ``engine``, common-header
type/version, ``views``, or ``transform``. Draft versions (``current`` not deployed)
update in place.

Origin (receiver vs fetcher) cannot change, and a pinned ``meta_schema`` cannot be
cleared: once a source owns its own table it cannot move back onto ``main``.

A field the body omits keeps its stored value (``header``, ``schema``, ``views``,
``transform``, ``transport``, ``archive``, ``aliases``, ``compat_profiles``), and
``null``, ``[]`` or ``false`` clears it. ``compat_profiles: null`` returns the source
to the deployment's profiles.

A schema pin naming nothing is accepted here so a source can be written before
its schema, while ``/sources/import`` refuses one because an exported bundle
brings every schema it pins.

**Usage**:

```console
$ dfe sources apply [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source <str>`: Source name (_source label); required on create
* `--display-name <str>`: Human-readable display name
* `--description <str>`: Source description
* `--enabled / --no-enabled`: Compat boolean lifecycle (True -> active, False -> disabled); ``state`` wins when both are sent
* `--state <active|dormant|disabled>`: Tri-state lifecycle (active | dormant | disabled); overrides ``enabled``
* `--match <str>`: Receiver match rule. One of match, when or fetcher is set JSON or YAML, or file://&lt;path>.
* `--when <str>`: A CEL Fast condition the receiver tests each record with, in place of match. It is checked at save under the profile the receiver compiles it with
* `--aliases <str>`: Per compatibility profile, the values its lookup rows map to this source, e.g. the DFE 2.x categories under dfe-legacy-2x. Read only while the source binds that profile JSON or YAML, or file://&lt;path>.
* `--compat-profiles <str>`: The compatibility profiles bound to this source. Unset takes the deployment's list, and an empty list binds none JSON or YAML, or file://&lt;path>.
* `--header <str>`: Common schema header configuration for this revision JSON or YAML, or file://&lt;path>.
* `--schema <str>`: Schema configuration for this revision JSON or YAML, or file://&lt;path>.
* `--transform <str>`: Transform stage (optional, top-level) JSON or YAML, or file://&lt;path>.
* `--fetcher <str>`: Fetcher-based origin. One of match, when, fetcher or external is set JSON or YAML, or file://&lt;path>.
* `--external <str>`: External origin: the customer's own pipeline writes the landing topic. One of match, when, fetcher or external is set JSON or YAML, or file://&lt;path>.
* `--transport <bus|direct>`: bus or direct; null takes the deployment default
* `--archive / --no-archive`: Keep the raw record as it arrived, on either transport
* `--from-catalogue-item <str>`: Catalogue entry this source was created from; absent when written by hand
* `--from-catalogue-intake <beats|receiver|fetcher>`: Intake selected for that catalogue entry: beats, receiver or fetcher
* `--views <str>`: Naming-standard views for this revision (sigma, ecs, cim, ocsf) JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe sources apply &lt;name>

Calls PUT /api/v1/sources/&#123;name&#125;.

### `dfe sources build`

Build Source Schema

Build complete schema (DDL) from a source version snapshot.

Runs the v2 YAML -> DDL pipeline and returns the generated DDL
without executing it against ClickHouse.

**Usage**:

```console
$ dfe sources build [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Source version id (defaults to deployed_version)
* `--help`: Show this message and exit.

Example: dfe sources build &lt;name>

Calls POST /api/v1/sources/&#123;name&#125;/build.

### `dfe sources bulk`

Bulk Action

Perform a bulk action on multiple sources.

``enable`` / ``disable`` / ``dormant`` / ``delete`` apply immediately.
``deploy`` submits one ``source:deploy`` background task per accepted source
(poll ``GET /operations/{operation}``). Refused names land in ``failed``.

An action that applies immediately reports the one reconcile it ends with, as
a single-source write does.

**Usage**:

```console
$ dfe sources bulk [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--action <str>`: Action: enable, disable, dormant, delete, deploy Required.
* `--sources <str>`: Sources to act on. Plain name strings are accepted. JSON or YAML, or file://&lt;path>. Required.
* `--dry-run / --no-dry-run`: Deploy only: plan/validate DDL without applying it. Ignored otherwise.
* `--help`: Show this message and exit.

Example: dfe sources bulk

Calls POST /api/v1/sources/bulk.

### `dfe sources catalogue`

List Catalogue

List the sources the installed dfe-schemas catalogue ships ready to create.

``tags`` keeps an entry whose holding directory is one of the names given.
``untagged`` is a file that sits in the catalogue root, and omitting ``tags``
lists every entry. ``engine`` keeps an entry whose transform engine is that
one, without regard to case, and an engine no entry uses lists nothing. An
entry already stored as a source is left out unless ``include_stored`` is set,
matched on the catalogue entry name even when the source was given a different
one. A source written by hand does not hide an entry. Each entry says whether
the deployed transform ships its default variant, read off that app's mounted
contract, so a console can hold back an entry the create would refuse. It also
says whether this deployment can run the entry at all: a source that needs a
per-source app (a fetcher or a transform) is refused on a gRPC deployment.

**Usage**:

```console
$ dfe sources catalogue [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--intake <str>`: Only entries that arrive this way (beats, receiver, fetcher)
* `--search <str>`: Search the entry name, package and data stream
* `--tags <str>`: Only entries in one of these holding directories. Repeat the param for more than one. untagged is the files that sit in the catalogue root. Omit it to list the whole catalogue
* `--engine <str>`: Only entries whose transform engine is this one, matched without regard to case. An engine no entry uses lists nothing. Omit it to list every engine
* `--include-stored / --no-include-stored`: List entries already stored as a source too. Off by default, so the create-from-catalogue page offers only what is left to create
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe sources catalogue

Calls GET /api/v1/sources/catalogue.

### `dfe sources catalogue-tags`

List Catalogue Tags

List the directories under the catalogue that hold source files.

A tag is one directory directly under ``catalogue/``. Files that sit in the
catalogue root, rather than in one of those directories, are the tag
``untagged``. ``id`` is the directory key. ``name`` and ``description`` come
from ``registries/catalogue-tags.yaml`` beside that catalogue. ``name`` keeps
a tag whose key or display name starts with it, so ``act`` matches
``active-mq`` and does not match a name that only contains those letters later.

**Usage**:

```console
$ dfe sources catalogue-tags [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--name <str>`: Keep tags whose directory key or display name starts with this. The match ignores case
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe sources catalogue-tags

Calls GET /api/v1/sources/catalogue-tags.

### `dfe sources create`

Create Source

Create a new source from a flat source definition (initial version ``1.0.0``).

``header`` is optional: when omitted, no common-header profile is stored on the
version (DDL compose uses meta/derived columns only until a header is set).

A schema pin naming nothing is accepted here so a source can be written before
its schema, while ``/sources/import`` refuses one because an exported bundle
brings every schema it pins.

201 when the apps follow the new source, 202 when the source is stored and the
reconcile that brings the apps into step with it did not complete, or when
production+team sent it to review (``review_required``).

**Usage**:

```console
$ dfe sources create [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--source <str>`: Source name (_source label); required on create
* `--display-name <str>`: Human-readable display name
* `--description <str>`: Source description
* `--enabled / --no-enabled`: Compat boolean lifecycle (True -> active, False -> disabled); ``state`` wins when both are sent
* `--state <active|dormant|disabled>`: Tri-state lifecycle (active | dormant | disabled); overrides ``enabled``
* `--match <str>`: Receiver match rule. One of match, when or fetcher is set JSON or YAML, or file://&lt;path>.
* `--when <str>`: A CEL Fast condition the receiver tests each record with, in place of match. It is checked at save under the profile the receiver compiles it with
* `--aliases <str>`: Per compatibility profile, the values its lookup rows map to this source, e.g. the DFE 2.x categories under dfe-legacy-2x. Read only while the source binds that profile JSON or YAML, or file://&lt;path>.
* `--compat-profiles <str>`: The compatibility profiles bound to this source. Unset takes the deployment's list, and an empty list binds none JSON or YAML, or file://&lt;path>.
* `--header <str>`: Common schema header configuration for this revision JSON or YAML, or file://&lt;path>.
* `--schema <str>`: Schema configuration for this revision JSON or YAML, or file://&lt;path>.
* `--transform <str>`: Transform stage (optional, top-level) JSON or YAML, or file://&lt;path>.
* `--fetcher <str>`: Fetcher-based origin. One of match, when, fetcher or external is set JSON or YAML, or file://&lt;path>.
* `--external <str>`: External origin: the customer's own pipeline writes the landing topic. One of match, when, fetcher or external is set JSON or YAML, or file://&lt;path>.
* `--transport <bus|direct>`: bus or direct; null takes the deployment default
* `--archive / --no-archive`: Keep the raw record as it arrived, on either transport
* `--from-catalogue-item <str>`: Catalogue entry this source was created from; absent when written by hand
* `--from-catalogue-intake <beats|receiver|fetcher>`: Intake selected for that catalogue entry: beats, receiver or fetcher
* `--views <str>`: Naming-standard views for this revision (sigma, ecs, cim, ocsf) JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe sources create

Calls POST /api/v1/sources.

### `dfe sources delete`

Delete Source

Delete a source by name. Its fetcher instance, receiver rule and topics go with it.

An engine-owned source -- the landing table's own -- is refused with 409
``conflict``, the same answer PUT and PATCH give.

The answer reports the reconcile as a create or an update does: on a
deployment that renders the app config itself, ``restart_required`` names the
command that takes away the containers the source's instances ran in.

A delete production+team sends to review answers ``review_required`` and
touches nothing else: main still carries the source, so its topics, records and
Search source stay until the branch is merged.

**Usage**:

```console
$ dfe sources delete [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources delete &lt;name>

Calls DELETE /api/v1/sources/&#123;name&#125;.

### `dfe sources deploy`

Deploy Source Schema

Plan (``dry_run=true``) or deploy a source version's schema to ClickHouse.

Runs the v2 YAML -> DDL pipeline. In plan mode the CREATE TABLE (+ any standard
views) and validation errors are returned for review WITHOUT touching
ClickHouse. In deploy mode the DDL is applied: an absent table is created, and
an existing one gains the columns it lacks and moves to the version's TTL, so a
re-deploy changes only what differs. The engine and the type of an existing
column are left as created. A schema that failed validation is never deployed.
A source on the bus transport whose Kafka topics the broker did not create is
not marked deployed either, and the call answers 502 naming each topic.

**Usage**:

```console
$ dfe sources deploy [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Source version id (defaults to the source's current version)
* `-n, --dry-run`: Plan only: generate + validate the DDL without applying it
* `--help`: Show this message and exit.

Example: dfe sources deploy &lt;name>

Calls POST /api/v1/sources/&#123;name&#125;/deploy.

### `dfe sources engines`

List Table Engines

List the table engines a source may select, from dfe-schemas ``registries/engines.yaml``.

**Usage**:

```console
$ dfe sources engines [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe sources engines

Calls GET /api/v1/sources/engines.

### `dfe sources export`

Export Source

Export one source version as a bundle another deployment can import.

The bundle carries the version's routing, schema and transform, each only
where the source declares it, plus one document per meta schema the schema
pins name. A pinned schema with ``resource_type: core`` travels as a
REFERENCE and a version pin rather than a copy of its columns, so importing
the bundle cannot fork the read-only definition dfe-schemas ships.

**Usage**:

```console
$ dfe sources export [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Version id to export; omitted takes the source's current
* `--help`: Show this message and exit.

Example: dfe sources export &lt;name>

Calls GET /api/v1/sources/&#123;name&#125;/export.

### `dfe sources flow`

Get Source Flow

The stages this source's records travel, resolved against this deployment.

The console draws the flow from this rather than from the source's fields,
for the same reason the compilers write from it: the topics, the endpoints
and the instance running each stage follow from the source plus the
deployment, and one resolver is what keeps the drawing and the deployed
config the same answer.

**Usage**:

```console
$ dfe sources flow [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources flow &lt;name>

Calls GET /api/v1/sources/&#123;name&#125;/flow.

### `dfe sources from-catalogue`

Create Sources From Catalogue

Create a source for each catalogue entry, on the intake it arrives by.

Each entry's file is the write body for its default intake, and another intake
swaps in the match rule that intake derives. A variant the deployed transform's
contract does not list is refused for that entry, and one whose contract is not
mounted is allowed. The source records the catalogue entry and the intake that
was selected, and a later edit leaves both in place.

At most 50 entries. A longer or empty selection is refused before anything is
stored, as ``{code, message}``. Entries are stored in the order given. One
entry's refusal is recorded in ``failed`` and the rest continue. The response
is 200 when any entry was refused for a reason other than a conflict, including
when nothing was stored. Nothing stored is 409 when every refusal is a conflict
or a missing variant. The apps are reconciled once, after the entries that
could be stored.

**Usage**:

```console
$ dfe sources from-catalogue [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--entries <str>`: Entries to create, in the order given. At most 50. JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe sources from-catalogue

Calls POST /api/v1/sources/from-catalogue.

### `dfe sources get`

Get Source

Get a full source definition by name, including build/deploy per version.

**Usage**:

```console
$ dfe sources get [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources get &lt;name>

Calls GET /api/v1/sources/&#123;name&#125;.

### `dfe sources import`

Import Source

Import a source bundle exported from another deployment.

The bundle's meta-schema definitions are written first, then the source, both
through their registries. A definition marked ``resource_type: core`` is
resolved against what dfe-schemas already put here and never written, so the
read-only schema is not forked.

Every check runs before the first write: a bundle applied halfway would leave
the source's schema pins with no definitions behind them. A schema pin, or a
version it pins, that neither the bundle nor this deployment defines is a 422
``unresolved_reference``.

**Usage**:

```console
$ dfe sources import [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--kind <str>`: Kind
* `--format <int>`: Document format version
* `--source <str>`: The _source label Required.
* `--resource-type <core|custom>`: core travels as a reference; custom travels in full
* `--reference <str>`: Name and version pin (core sources only) JSON or YAML, or file://&lt;path>.
* `--version <str>`: Version id of the snapshot this bundle carries
* `--date-time <str>`: Creation date of the exported snapshot; absent takes the import date
* `--display-name <str>`: Human-readable display name
* `--description <str>`: Source description
* `--state <active|dormant|disabled>`: Lifecycle state
* `--routing <str>`: Receiver match rule (receiver-based sources) JSON or YAML, or file://&lt;path>.
* `--when <str>`: CEL Fast condition the receiver tests records with, in place of routing
* `--aliases <str>`: Per compatibility profile, the values its lookup rows map to this source JSON or YAML, or file://&lt;path>.
* `--compat-profiles <str>`: The compatibility profiles the source binds. Absent takes the deployment's JSON or YAML, or file://&lt;path>.
* `--fetcher <str>`: Fetcher origin (fetcher-based sources) JSON or YAML, or file://&lt;path>.
* `--schema <str>`: Schema pins, header and the definitions they name JSON or YAML, or file://&lt;path>.
* `--transform <str>`: Transform stage, when the version declares one JSON or YAML, or file://&lt;path>.
* `--transport <bus|direct>`: bus or direct; absent takes the importing deployment's default
* `--archive / --no-archive`: Keep the record as it arrived
* `--views <str>`: Naming-standard views the version exposes JSON or YAML, or file://&lt;path>.
* `--help`: Show this message and exit.

Example: dfe sources import

Calls POST /api/v1/sources/import.

### `dfe sources lag`

Get External Lag

How far the customer's own transform is behind on this source's landing topic.

Read from the broker on each call. A broker that cannot be reached answers 200
with nulls and the reason, because "no lag" and "could not look" call for
opposite reactions.

**Usage**:

```console
$ dfe sources lag [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources lag &lt;name>

Calls GET /api/v1/sources/&#123;name&#125;/lag.

### `dfe sources list`

List Sources

List sources with pagination, search, filtering, and a full object tree.

The landing source (``main``) is always the first item when it is in the
result set. Remaining sources keep the requested sort. A caller held to its
orgs does not see a fetcher source bound to another org.

**Usage**:

```console
$ dfe sources list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in source name and description
* `--enabled / --no-enabled`: Filter by enabled status
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--order-by <str>`: Ordering over current, deployed_version, display_name, enabled, source, updated_at, each optionally followed by desc
* `--help`: Show this message and exit.

Example: dfe sources list

Calls GET /api/v1/sources.

### `dfe sources plan`

Plan Source Deploy

Dry-run ClickHouse deploy: DDL statements and validation errors (not persisted).

**Usage**:

```console
$ dfe sources plan [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--version <str>`: Source version id (defaults to current working version)
* `--help`: Show this message and exit.

Example: dfe sources plan &lt;name>

Calls POST /api/v1/sources/&#123;name&#125;/plan.

### `dfe sources reconcile-apps`

Reconcile Apps

Bring the deploy repo's derived app state into step with the sources.

Recompiles every stack-scoped routing block (receiver, loader, archiver) and
deploys, syncs or removes the instances of every instance-scoped app (a fetcher
per active fetcher-based source). Every source write does this on its own. This
route is the retry when one reported ``apps_sync_error``, and the pass that
deletes a stranded ``_load`` topic a deploy reported in ``topics_pending_removal``.

**Usage**:

```console
$ dfe sources reconcile-apps [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources reconcile-apps

Calls POST /api/v1/sources/reconcile-apps.

### `dfe sources sample`

Sample Source

Sample a registered source. The path ``source`` wins over any in the body.

**Usage**:

```console
$ dfe sources sample [OPTIONS] [source]
```

**Arguments**:

* `source`: Source Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--mode <recent|random|smart|anomaly>`: How to pick the sample.

- ``recent``  - newest rows first (fast tail, ClickHouse ORDER BY ts DESC,
  Kafka reads from the partition high-watermark backwards).
- ``random``  - uniform-ish random rows (fair distribution, no recency bias).
- ``smart``   - logreducer representative/diverse sample (default). Gated.
- ``anomaly`` - logreducer isolation-forest outliers (the weird events). Gated.
* `--backend <clickhouse|kafka>`: Where the data is read from.
* `--limit <int>`: Rows to return (defaults to sampler.default_limit)
* `--body-source <str>`: Registered source name
* `--table <str>`: Explicit ClickHouse table (overrides source's table)
* `--topic <str>`: Explicit Kafka topic (overrides source's land topic)
* `--filter <str>`: One ClickHouse condition over the sampled table's columns (ClickHouse backend only). No subquery, alias, query parameter, table function, or dictionary, Join table or file read.
* `--since <str>`: Lower time bound (ISO 8601) on the timestamp column
* `--until <str>`: Upper time bound (ISO 8601) on the timestamp column
* `--seed <int>`: Seed for random mode (determinism)
* `--level <str>`: logreducer level override: standard | enhanced | maximum
* `--wait <float>`: Seconds to block for inline completion before returning pending
* `--help`: Show this message and exit.

Example: dfe sources sample &lt;source>

Calls POST /api/v1/sources/&#123;source&#125;/sample.

### `dfe sources seed`

Seed Sources

Seed built-in default source definitions. Non-destructive (skips existing).

**Usage**:

```console
$ dfe sources seed [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources seed

Calls POST /api/v1/sources/seed.

### `dfe sources signals`

Get Source Signals

Whether this source's records are arriving, and how fast.

Reads the loader's per-table counter out of the otel tables over a bounded
five-minute window, so the console can put a number beside a source without
the operator opening Search. It answers 200 with nulls where the series is
absent: a source that was only just defined has nothing to report, and that
is not an error.

**Usage**:

```console
$ dfe sources signals [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources signals &lt;name>

Calls GET /api/v1/sources/&#123;name&#125;/signals.

### `dfe sources update`

Patch Source Enabled

Set a source's lifecycle state without changing versioned configuration.

Does not create a new source version. Activating may return ``409
match_conflict`` if another non-disabled source already uses the same
receiver match rule.

**Usage**:

```console
$ dfe sources update [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--enabled / --no-enabled`: Compat boolean lifecycle (True -> active, False -> disabled)
* `--state <active|dormant|disabled>`: Tri-state lifecycle (active | dormant | disabled); wins over enabled
* `--help`: Show this message and exit.

Example: dfe sources update &lt;name>

Calls PATCH /api/v1/sources/&#123;name&#125;.

### `dfe sources columns`

**Usage**:

```console
$ dfe sources columns [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Source Schema Columns

#### `dfe sources columns list`

Get Source Schema Columns

Get composed schema columns for a source version (profile + meta/derived/additional).

**Usage**:

```console
$ dfe sources columns list [OPTIONS] [name]
```

**Arguments**:

* `name`: Name Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--version <str>`: Source version id (defaults to deployed_version)
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe sources columns list &lt;name>

Calls GET /api/v1/sources/&#123;name&#125;/columns.

### `dfe sources versions`

**Usage**:

```console
$ dfe sources versions [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Source Version

#### `dfe sources versions get`

Get Source Version

Get one immutable source version snapshot by id, with build/deploy status.

**Usage**:

```console
$ dfe sources versions get [OPTIONS] [name] [version]
```

**Arguments**:

* `name`: Name Required.
* `version`: Version Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe sources versions get &lt;name> &lt;version>

Calls GET /api/v1/sources/&#123;name&#125;/versions/&#123;version&#125;.

## `dfe synthetic-data`

**Usage**:

```console
$ dfe synthetic-data [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `generate`: Generate
* `lookalike`: Lookalike
* `packs`: List Packs
* `stream`: Start Stream
* `streams-cmd`: List Streams
* `streams`

### `dfe synthetic-data generate`

Generate

Generate a bounded batch of synthetic events inline.

Sync handler by design: a ceiling-sized batch is pure CPU, so FastAPI's
threadpool keeps the event loop responsive while it renders.

**Usage**:

```console
$ dfe synthetic-data generate [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--schema <str>`: Schema ref (e.g. meta/syslog) or path under the schemas root Required.
* `--version <str>`: Schema version (default: current)
* `--count <int>`: Events to generate (capped by settings)
* `--seed <int>`: Determinism seed
* `--rate-eps <float>`: Timestamp spacing rate (events/second)
* `--tags <str>`: Extra tags merged into events (refused for a pack whose tags is a keyword list) JSON or YAML, or file://&lt;path>.
* `--mark-synthetic / --no-mark-synthetic`: Mark events synthetic: tags.synthetic=true for an object tags, or a 'synthetic' keyword in the list for an ECS keyword-array tags
* `--help`: Show this message and exit.

Example: dfe synthetic-data generate

Calls POST /api/v1/synthetic-data/generate.

### `dfe synthetic-data lookalike`

Lookalike

Generate a lookalike batch from a supplied sample (identities scrubbed).

**Usage**:

```console
$ dfe synthetic-data lookalike [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--rows <str>`: Parsed sample events (preferred input) JSON or YAML, or file://&lt;path>.
* `--lines <str>`: Raw sample lines (used when rows is empty)
* `--count <int>`: Events to generate (capped by settings)
* `--seed <int>`: Determinism seed
* `--rate-eps <float>`: Timestamp spacing rate (events/second)
* `--tags <str>`: Extra tags merged into events (refused for a pack whose tags is a keyword list) JSON or YAML, or file://&lt;path>.
* `--mark-synthetic / --no-mark-synthetic`: Mark events synthetic: tags.synthetic=true for an object tags, or a 'synthetic' keyword in the list for an ECS keyword-array tags
* `--help`: Show this message and exit.

Example: dfe synthetic-data lookalike

Calls POST /api/v1/synthetic-data/lookalike.

### `dfe synthetic-data packs`

List Packs

List schema packs the generator can drive.

**Usage**:

```console
$ dfe synthetic-data packs [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe synthetic-data packs

Calls GET /api/v1/synthetic-data/packs.

### `dfe synthetic-data stream`

Start Stream

Start a stream task that posts generated events to an ingest URL.

**Usage**:

```console
$ dfe synthetic-data stream [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--schema <str>`: Schema ref (e.g. meta/syslog) or path under the schemas root Required.
* `--version <str>`: Schema version (default: current)
* `--seed <int>`: Determinism seed
* `--rate-eps <float>`: Events/second (Poisson; capped by settings)
* `--count <int>`: Stop after this many events
* `--duration-s <float>`: Stop after this many seconds (capped by settings)
* `--receiver-url <str>`: Ingest URL to POST events to (dfe-receiver) Required.
* `--headers <str>`: Extra request headers (e.g. receiver auth) JSON or YAML, or file://&lt;path>.
* `--ndjson / --no-ndjson`: POST batches as NDJSON instead of JSON
* `--batch-max <int>`: Events per POST
* `--tags <str>`: Extra tags merged into events (refused for a pack whose tags is a keyword list) JSON or YAML, or file://&lt;path>.
* `--mark-synthetic / --no-mark-synthetic`: Mark events synthetic: tags.synthetic=true for an object tags, or a 'synthetic' keyword in the list for an ECS keyword-array tags
* `--wait <float>`: Seconds to block for inline completion before returning
* `--help`: Show this message and exit.

Example: dfe synthetic-data stream

Calls POST /api/v1/synthetic-data/stream.

### `dfe synthetic-data streams-cmd`

List Streams

List stream operations (most recent first).

**Usage**:

```console
$ dfe synthetic-data streams-cmd [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe synthetic-data streams

Calls GET /api/v1/synthetic-data/streams.

### `dfe synthetic-data streams`

**Usage**:

```console
$ dfe synthetic-data streams [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `cancel`: Cancel Stream
* `get`: Get Stream

#### `dfe synthetic-data streams cancel`

Cancel Stream

Cancel a stream, under the same action that starts it.

**Usage**:

```console
$ dfe synthetic-data streams cancel [OPTIONS] [operation]
```

**Arguments**:

* `operation`: Operation Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe synthetic-data streams cancel &lt;operation>

Calls POST /api/v1/synthetic-data/streams/&#123;operation&#125;/cancel.

#### `dfe synthetic-data streams get`

Get Stream

Poll a stream, under the same action that lists it.

**Usage**:

```console
$ dfe synthetic-data streams get [OPTIONS] [operation]
```

**Arguments**:

* `operation`: Operation Required.

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe synthetic-data streams get &lt;operation>

Calls GET /api/v1/synthetic-data/streams/&#123;operation&#125;.

## `dfe system`

**Usage**:

```console
$ dfe system [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `schema`: Get Schema Status
* `settings`: Get Settings
* `status`: Get System Status
* `version`: Get Version
* `clickhouse-cloud`
* `defaults`
* `deployment`
* `retention`

### `dfe system schema`

Get Schema Status

What the last schema bootstrap pass did, object by object.

This is the operator's record of the schema apply, replacing the completed
ArgoCD Job the engine took over from. ``state`` is what readiness follows:
converged is ready, failed leaves the pod up and NotReady with the stage that
failed here and the cause in the engine log, and observed -- another applier
held the lease for the whole wait -- stays NotReady until a later pass converges.

**Usage**:

```console
$ dfe system schema [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system schema

Calls GET /api/v1/system/schema.

### `dfe system settings`

Get Settings

Get a redacted summary of current settings. No secrets exposed.

**Usage**:

```console
$ dfe system settings [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system settings

Calls GET /api/v1/system/settings.

### `dfe system status`

Get System Status

Conditions that leave the engine degraded while it keeps serving.

A refused YAML write keeps the old file or the old deploy-repo content, so reads
stay correct and readiness is not failed. This is where the refusal shows.

**Usage**:

```console
$ dfe system status [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system status

Calls GET /api/v1/system/status.

### `dfe system version`

Get Version

What this deployment runs.

Authenticated but ungated on purpose: the console footer is on every page, and
the body carries versions only.

**Usage**:

```console
$ dfe system version [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system version

Calls GET /api/v1/system/version.

### `dfe system clickhouse-cloud`

**Usage**:

```console
$ dfe system clickhouse-cloud [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Clickhouse Cloud Status
* `start`: Clickhouse Cloud Start
* `stop`: Clickhouse Cloud Stop

#### `dfe system clickhouse-cloud list`

Clickhouse Cloud Status

CH Cloud service control-plane status (read-only).

**Usage**:

```console
$ dfe system clickhouse-cloud list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system clickhouse-cloud list

Calls GET /api/v1/system/clickhouse-cloud.

#### `dfe system clickhouse-cloud start`

Clickhouse Cloud Start

Start (wake) the CH Cloud service. BILLABLE + admin-gated + audited.

**Usage**:

```console
$ dfe system clickhouse-cloud start [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system clickhouse-cloud start

Calls POST /api/v1/system/clickhouse-cloud/start.

#### `dfe system clickhouse-cloud stop`

Clickhouse Cloud Stop

Stop the CH Cloud service (saves cost). Admin-gated + audited.

**Usage**:

```console
$ dfe system clickhouse-cloud stop [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system clickhouse-cloud stop

Calls POST /api/v1/system/clickhouse-cloud/stop.

### `dfe system defaults`

**Usage**:

```console
$ dfe system defaults [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Apply Defaults
* `drift`: Get Default Drift
* `get`: Get Defaults
* `update`: Patch Defaults

#### `dfe system defaults apply`

Apply Defaults

Pin the current TTL, common header and merge engine onto the named sources and their tables.

Sources that are not in the list are left alone. A source that already stores
these values is unchanged in the deploy repo. A missing or engine-owned name
fails the request before any source is written.

A draft takes the values in place. A deployed version is never rewritten: the
values land on a new major version, which becomes ``current``. Either way the
table takes them when that version is deployed.

A named source whose deployed version already carries the values has its table
brought to them in this request: the TTL moves and the header's missing
columns are added. The engine of an existing table needs a rebuild, so it
reaches new tables only, and existing columns keep their type. ``live``
reports each source: what reached the table, what did not and why. A
ClickHouse failure is reported on that source, and the pin stays committed.

A pin production+team sends to review is listed in ``awaiting_review`` with
``review_required`` and the review headers, and its table is left alone until
the branch merges, since main still carries the source as it was.

**Usage**:

```console
$ dfe system defaults apply [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--sources <str>`: Source names. Only these are written. Required.
* `--help`: Show this message and exit.

Example: dfe system defaults apply

Calls POST /api/v1/system/defaults/apply.

#### `dfe system defaults drift`

Get Default Drift

Sources whose table or current version runs a header, TTL or engine other than the default.

TTL and engine are measured on a deployed source's table, read from ClickHouse,
so a value pinned in the source that the table never took is still drift. An
engine change persists as drift until the table is rebuilt. For a source with
no deployed table, and for the header, the stored value is measured: a field
the source leaves unset inherits the default on its next deploy and is not
drift, nor is a stored value equal to the default. Header types compare as
bare profile names, so ``common-header/timeseries`` is ``timeseries``.

``core`` is true for an engine-owned source, which the apply endpoint will
refuse. The landing source is never listed. ``search`` matches the source
name, a drifted field name, or a stored or live value.

**Usage**:

```console
$ dfe system defaults drift [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--no-paginate`: Fetch one page instead of following next_page_token.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--max-items <int range>`: Most items to print. A cut-short list ends with a next_page_token.  [x>=1]
* `--starting-token <str>`: Resume from the next_page_token an earlier call printed.
* `--search <str>`: Search in source name, drifted field, and stored or live value
* `--page-size <int>`: Items per page: 0 means 50, above 1000 is cut to it
* `--skip <int>`: Items to skip, after page_token
* `--help`: Show this message and exit.

Example: dfe system defaults drift

Calls GET /api/v1/system/defaults/drift.

#### `dfe system defaults get`

Get Defaults

The TTL, common header and merge engine a source inherits when it sets none.

**Usage**:

```console
$ dfe system defaults get [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system defaults get

Calls GET /api/v1/system/defaults.

#### `dfe system defaults update`

Patch Defaults

Store the named defaults. Only ttl_days is applied to live tables.

Omitted fields are left alone. null clears that override. Common-header type,
version and engine are what a source inherits the next time it is deployed.
This request does not rewrite them onto live tables. A patch that names
ttl_days stores it and then runs the same reconcile as PUT /retention.

**Usage**:

```console
$ dfe system defaults update [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--ttl-days <int>`: Retention in days; 0 keeps rows forever. null clears the override.
* `--common-header-type <str>`: Common-header profile name, such as timeseries or minimal. null clears it.
* `--common-header-version <str>`: Common-header profile version. null clears it.
* `--engine <str>`: MergeTree-family variant. null clears it, so the deployment engine applies.
* `--help`: Show this message and exit.

Example: dfe system defaults update

Calls PATCH /api/v1/system/defaults.

### `dfe system deployment`

**Usage**:

```console
$ dfe system deployment [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Deployment

#### `dfe system deployment get`

Get Deployment

What this deployment IS: its profile, transports, backing services and versions.

Authenticated but ungated, for the same reason /version is: every console pane
that must not guess reads this, and the body carries deployment shape and
versions only. Without it the console has to assume the widest deployment and
offer a transport or an app this tier does not run.

**Usage**:

```console
$ dfe system deployment get [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system deployment get

Calls GET /api/v1/system/deployment.

### `dfe system retention`

**Usage**:

```console
$ dfe system retention [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `apply`: Put Retention
* `get`: Get Retention

#### `dfe system retention apply`

Put Retention

Store the override in the deploy repo, then apply it to every table that follows it.

The engine's own tables and every deployed source's table are brought to the new
effective default in this request, with ``ALTER TABLE ... MODIFY TTL`` (or
``REMOVE TTL`` for 0). A table that declares its own TTL is left alone. A
ClickHouse failure answers 502 with the override ALREADY committed. Sending the
same value again applies it.

**Usage**:

```console
$ dfe system retention apply [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--default-ttl-days <int>`: Retention in days for every table that follows the default; 0 keeps rows forever. null clears the override, so deployment_default applies again. Required.
* `--help`: Show this message and exit.

Example: dfe system retention apply

Calls PUT /api/v1/system/retention.

#### `dfe system retention get`

Get Retention

The effective default TTL, the admin's override and the deployment's own value.

**Usage**:

```console
$ dfe system retention get [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe system retention get

Calls GET /api/v1/system/retention.

## `dfe transforms`

**Usage**:

```console
$ dfe transforms [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `compile`: Compile Transform
* `test`: Test Transform

### `dfe transforms compile`

Compile Transform

Compile user source code to a WASM binary.

Proxies to the dfe-transform-compiler service. The response includes
a base64-encoded WASM binary that can be passed directly to /test.

**Usage**:

```console
$ dfe transforms compile [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--language <rust|go|assemblyscript>`: Language Required.
* `--files <str>`: Source files. Key = filename, value = source content. JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe transforms compile

Calls POST /api/v1/transforms/compile.

### `dfe transforms test`

Test Transform

Run a compiled WASM transform against sample records.

Proxies to the dfe-transform-wasm service's /test endpoint.
The wasm_base64 field should come directly from /compile.

**Usage**:

```console
$ dfe transforms test [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--body <str>`: The whole request body as JSON or YAML, or file://&lt;path>. Field options override it.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--wasm-base64 <str>`: Base64-encoded WASM binary from /compile Required.
* `--records <str>`: Sample input records JSON or YAML, or file://&lt;path>. Required.
* `--help`: Show this message and exit.

Example: dfe transforms test

Calls POST /api/v1/transforms/test.

## `dfe usage`

**Usage**:

```console
$ dfe usage [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `get`: Get Usage
* `overview`

### `dfe usage get`

Get Usage

One usage metric per UTC day over a range, for the whole deployment or one org.

Events per second over more than one tenant id is the busiest minute of their
sum, read from the minute table, which keeps 7 days.

**Usage**:

```console
$ dfe usage get [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--metric <cores_deployed|node_cores|ingested_bytes|events_per_second>`: The metric to read Required.
* `--from <str>`: The first UTC day, 29 days before `to` when absent
* `--to <str>`: The last UTC day, today when absent
* `--org <str>`: One org to read. Absent reads the whole deployment, or every org the caller holds
* `--granularity <str>`: Per UTC day, the only granularity the rollup keeps
* `--help`: Show this message and exit.

Example: dfe usage get --metric &lt;metric>

Calls GET /api/v1/usage.

### `dfe usage overview`

**Usage**:

```console
$ dfe usage overview [OPTIONS] COMMAND [ARGS]...
```

**Options**:

* `--help`: Show this message and exit.

**Commands**:

* `list`: Get Usage Overview

#### `dfe usage overview list`

Get Usage Overview

Every usage metric per UTC day over the last 30 days, and its highest in the last 7.

The whole deployment for a caller that reads every org, else the caller's own
orgs combined, with the two core counts ``not_permitted``. Events per second over
more than one tenant id is the busiest minute of their sum, read from the minute
table, which keeps 7 days.

**Usage**:

```console
$ dfe usage overview list [OPTIONS]
```

**Options**:

* `-o, --output <json|yaml|table|text>`: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.
* `--query <str>`: JMESPath expression applied to the answer before it is printed.
* `--endpoint-url <str>`: The API's base URL, over the environment and the profile.
* `--profile <str>`: Named profile to read the endpoint and credential from.
* `-d, --debug`: Show tracebacks instead of one-line errors.
* `-y, --yes`: Skip the confirmation a delete asks for.
* `-v, --verbose`: Print each request and its answer's status on stderr.
* `-q, --quiet`: Print no warnings, and a value or list of values bare, one per line.
* `--no-input`: Never prompt: refuse a delete that has no --yes, even at a terminal.
* `--cli-input-json <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. JSON.
* `--cli-input-yaml <str>`: Every input as one document with path, query, header and body sections, or file://&lt;path>. YAML.
* `--generate-cli-skeleton`: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.
* `--help`: Show this message and exit.

Example: dfe usage overview list

Calls GET /api/v1/usage/overview.