dfe CLI reference
Rendered from the dfe command tree of ghcr.io/hyperi-io/dfe-engine:v1.22.90.
dfe - the Data Fusion Engine CLI. Command tree generated from the engine OpenAPI spec.
Usage:
$ dfe [OPTIONS] COMMAND [ARGS]...
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list. [env var: DFE_ENGINE_OUTPUT]--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.--no-paginate: Fetch one page instead of following next_page_token.-v, --verbose: Print each request and its answer's status on stderr. [default: 0]-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--help: Show this message and exit.
Commands:
login: Authenticate and store credentials for...logout: Clear the stored credential + active...config: Read and write CLI configuration...local: Break-glass direct gitops CRUD for when...schema: Plan, apply and read the DFE ClickHouse...alertsapp-contractsappsauthauthoringbacking-servicesceldeploymentfield-mapsgitopsgovernancehelmhuntshyperdxingestkafkalibrarylifecycleoperationsorgspipelinequeriesrulessamplesamplesschemasscimservicessourcessynthetic-datasystemtransformsusage
dfe login
Authenticate and store credentials for later commands.
Either pass --api-key, or --username/--password to exchange for a JWT. With no new credentials but a valid stored one, just re-activates the profile.
Usage:
$ dfe login [OPTIONS]
Options:
--url <str>: Engine base URL, e.g. https://engine.example:8000--api-key <str>: Authenticate with a static API key.-u, --username <str>: Username for password login.-p, --password <str>: Password for password login.--profile <str>: Named configuration (profile) to write to.--help: Show this message and exit.
dfe logout
Clear the stored credential + active account for a profile.
Usage:
$ dfe logout [OPTIONS]
Options:
--profile <str>: Named configuration (profile) to clear.--help: Show this message and exit.
dfe config
Read and write CLI configuration (INI-backed profiles).
Usage:
$ dfe config [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
set: Set a config KEY to VALUE in the active...get: Print a single config KEY from the active...list: Print all config keys for the active profile.configurations: Manage named configurations (profiles).
dfe config set
Set a config KEY to VALUE in the active profile.
Usage:
$ dfe config set [OPTIONS] {key} {value}
Arguments:
key: [required]value: [required]
Options:
--help: Show this message and exit.
dfe config get
Print a single config KEY from the active profile.
Usage:
$ dfe config get [OPTIONS] {key}
Arguments:
key: [required]
Options:
--help: Show this message and exit.
dfe config list
Print all config keys for the active profile.
Usage:
$ dfe config list [OPTIONS]
Options:
--help: Show this message and exit.
dfe config configurations
Manage named configurations (profiles).
Usage:
$ dfe config configurations [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List named configurations, marking the...activate: Make NAME the active configuration.create: Create a new (empty) named configuration.delete: Delete a named configuration.
dfe config configurations list
List named configurations, marking the active one.
Usage:
$ dfe config configurations list [OPTIONS]
Options:
--help: Show this message and exit.
dfe config configurations activate
Make NAME the active configuration.
Usage:
$ dfe config configurations activate [OPTIONS] {name}
Arguments:
name: [required]
Options:
--help: Show this message and exit.
dfe config configurations create
Create a new (empty) named configuration.
Usage:
$ dfe config configurations create [OPTIONS] {name}
Arguments:
name: [required]
Options:
--help: Show this message and exit.
dfe config configurations delete
Delete a named configuration.
Usage:
$ dfe config configurations delete [OPTIONS] {name}
Arguments:
name: [required]
Options:
--help: Show this message and exit.
dfe local
Break-glass direct gitops CRUD for when the dfe-engine daemon is DEAD.
Writes DIRECTLY to the local deploy-repo clone via the same GitCrud engine the API uses; every write is marked [BREAK-GLASS] and needs a --reason. Headline case - a rogue pod:
dfe local set helmvars receiver-default keda.maxReplicaCount 0 --reason "rogue pod"
Read first (classes/ls/get/log/versions/status), fix (set/unset/rm/revert/ restore), then publish (push). Authority here is git access to the clone, not RBAC - the daemon that enforces RBAC is down.
Usage:
$ dfe local [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
classes: List the resource classes GitCrud can...ls: List resources in a class, e.g.grep: Search the gitops repo's YAML for TERM, e.g.get: Show a resource doc, or one key with...log: Show the gitcrud audit log, flagging...versions: List published versions of a versioned...status: Show working-tree changes +...set: Set a dot-path via GitCrud.set_key, e.g.unset: Remove a dot-path via GitCrud.delete_key...rm: Delete a whole resource via GitCrud.delete...revert: Create a revert-commit that undoes an...restore: Roll a versioned resource back to an...push: Push the clone's local (break-glass)...ch-cloud: ClickHouse Cloud service lifecycle...
dfe local classes
List the resource classes GitCrud can address (helmvars, governance, ...).
Usage:
$ dfe local classes [OPTIONS]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local ls
List resources in a class, e.g. dfe local ls helmvars.
Usage:
$ dfe local ls [OPTIONS] {cls}
Arguments:
cls: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local grep
Search the gitops repo's YAML for TERM, e.g. find every keda.maxReplicaCount dial.
Usage:
$ dfe local grep [OPTIONS] {term}
Arguments:
term: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local get
Show a resource doc, or one key with --path (e.g. keda.maxReplicaCount).
Usage:
$ dfe local get [OPTIONS] {cls} {name}
Arguments:
cls: [required]name: [required]
Options:
--path <str>: Dot-path of a single key, e.g. keda.maxReplicaCount.--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local log
Show the gitcrud audit log, flagging break-glass commits with !! BREAK-GLASS.
Usage:
$ dfe local log [OPTIONS]
Options:
--limit <int>: Max entries to show (newest first). [default: 50]--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local versions
List published versions of a versioned resource (e.g. ch_tiers).
Usage:
$ dfe local versions [OPTIONS] {cls} {name}
Arguments:
cls: [required]name: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local status
Show working-tree changes + unpushed-commit count for the clone.
Usage:
$ dfe local status [OPTIONS]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local set
Set a dot-path via GitCrud.set_key, e.g. scale a rogue pod's keda dial to 0.
dfe local set helmvars receiver-default keda.maxReplicaCount 0 --reason "rogue pod"
Usage:
$ dfe local set [OPTIONS] {cls} {name} {path} {value}
Arguments:
cls: [required]name: [required]path: [required]value: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--actor <str>: Operator identity for the audit trailer (default: OS user).--reason <str>: REQUIRED break-glass reason (prompted if omitted).-y, --yes: Skip the confirm prompt (CI). Requires --reason.--push / --no-push: Push after the local commit (default: prompt).--help: Show this message and exit.
dfe local unset
Remove a dot-path via GitCrud.delete_key (revert a helm var to its default).
Usage:
$ dfe local unset [OPTIONS] {cls} {name} {path}
Arguments:
cls: [required]name: [required]path: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--actor <str>: Operator identity for the audit trailer (default: OS user).--reason <str>: REQUIRED break-glass reason (prompted if omitted).-y, --yes: Skip the confirm prompt (CI). Requires --reason.--push / --no-push: Push after the local commit (default: prompt).--help: Show this message and exit.
dfe local rm
Delete a whole resource via GitCrud.delete (e.g. remove a helm overlay).
Usage:
$ dfe local rm [OPTIONS] {cls} {name}
Arguments:
cls: [required]name: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--actor <str>: Operator identity for the audit trailer (default: OS user).--reason <str>: REQUIRED break-glass reason (prompted if omitted).-y, --yes: Skip the confirm prompt (CI). Requires --reason.--push / --no-push: Push after the local commit (default: prompt).--help: Show this message and exit.
dfe local revert
Create a revert-commit that undoes an earlier commit's file changes.
The one new op (GitCrud has no revert): compute the inverse of the target commit's tree diff and commit it back through GitopsRepo (dulwich, the same publish path), marked break-glass.
Usage:
$ dfe local revert [OPTIONS] {sha}
Arguments:
sha: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--actor <str>: Operator identity for the audit trailer (default: OS user).--reason <str>: REQUIRED break-glass reason (prompted if omitted).-y, --yes: Skip the confirm prompt (CI). Requires --reason.--push / --no-push: Push after the local commit (default: prompt).--help: Show this message and exit.
dfe local restore
Roll a versioned resource back to an earlier published version.
Mirrors VersionedDoc.rollback (point current at the version, keeping the
immutable version envelope intact) but writes a BREAK-GLASS-marked commit -
rollback itself would emit an ordinary conforming commit with no reason trailer.
Usage:
$ dfe local restore [OPTIONS] {cls} {name} {version}
Arguments:
cls: [required]name: [required]version: [required]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--actor <str>: Operator identity for the audit trailer (default: OS user).--reason <str>: REQUIRED break-glass reason (prompted if omitted).-y, --yes: Skip the confirm prompt (CI). Requires --reason.--push / --no-push: Push after the local commit (default: prompt).--help: Show this message and exit.
dfe local push
Push the clone's local (break-glass) commits to the configured remote.
Usage:
$ dfe local push [OPTIONS]
Options:
--repo PATH: Gitops clone path (default: configured DFE_ENGINE_GITOPS_LOCAL_PATH).--help: Show this message and exit.
dfe local ch-cloud
ClickHouse Cloud service lifecycle (status/start/stop).
Usage:
$ dfe local ch-cloud [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
status: Show the CH Cloud service's control-plane...start: Start (wake) the CH Cloud service.stop: Stop the CH Cloud service (saves cost).
dfe local ch-cloud status
Show the CH Cloud service's control-plane state.
Usage:
$ dfe local ch-cloud status [OPTIONS]
Options:
--help: Show this message and exit.
dfe local ch-cloud start
Start (wake) the CH Cloud service. BILLABLE + idempotent.
Usage:
$ dfe local ch-cloud start [OPTIONS]
Options:
--wait: Block until the service is running.--timeout <float>: Wait budget in seconds with --wait. [default: 600.0]--help: Show this message and exit.
dfe local ch-cloud stop
Stop the CH Cloud service (saves cost). Idempotent.
Usage:
$ dfe local ch-cloud stop [OPTIONS]
Options:
--help: Show this message and exit.
dfe schema
Plan, apply and read the DFE ClickHouse schema.
Usage:
$ dfe schema [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
plan: Report what an apply would do.apply: Run the boot phase by hand, under the same...status: Which dfe-schemas release each object on...
dfe schema plan
Report what an apply would do. Changes nothing.
Usage:
$ dfe schema plan [OPTIONS]
Options:
--json: Emit the plan as JSON.--help: Show this message and exit.
dfe schema apply
Run the boot phase by hand, under the same lease.
Exits 1 when the pass failed or another applier held the lease for the whole wait, and 2 on a refusal.
Usage:
$ dfe schema apply [OPTIONS]
Options:
--allow-drift / --no-allow-drift: Also apply the changes the boot phase refuses: a column type, and a TTL. [default: no-allow-drift]--json: Emit the outcome as JSON.--help: Show this message and exit.
dfe schema status
Which dfe-schemas release each object on this cluster came from.
Usage:
$ dfe schema status [OPTIONS]
Options:
--json: Emit the ledger as JSON.--help: Show this message and exit.
dfe alerts
Usage:
$ dfe alerts [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create-destination: Create Destinationdestinations-cmd: List Destinationsdestinations
dfe alerts create-destination
Create Destination
Create an alert destination.
Linking it to a hunt writes the hunt YAML, so in production+team that link is
routed to a review branch and X-DFE-Review-Required says so.
Usage:
$ dfe alerts create-destination [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Unique destination identifier (used as filename) Required.--url <str>: Apprise notification URL (slack://, mailto://, etc.). Masked on every read; write the mask back to keep the stored URL Required.--description <str>: Human-readable description--enabled / --no-enabled: Enabled--url-scheme <str>: URL scheme (slack, mailto, etc.); read-only, set from the URL--hunt-name <str>: Hunt file stem when this destination is owned by a hunt (set via API)--help: Show this message and exit.
Example: dfe alerts create-destination
Calls POST /api/v1/alerts/destinations.
dfe alerts destinations-cmd
List Destinations
List alert destinations.
Usage:
$ dfe alerts destinations-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in name/description--hunt <str>: Hunt file name (YAML stem); only destinations referenced in that hunt's alerts--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over enabled, name, each optionally followed by desc--help: Show this message and exit.
Example: dfe alerts destinations
Calls GET /api/v1/alerts/destinations.
dfe alerts destinations
Usage:
$ dfe alerts destinations [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Destinationdelete: Delete Destinationget: Get Destination
dfe alerts destinations apply
Update Destination
Update an alert destination.
Linking it to a hunt writes the hunt YAML, so in production+team that link is
routed to a review branch and X-DFE-Review-Required says so.
Usage:
$ dfe alerts destinations apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--body-name <str>: Unique destination identifier (used as filename) Required.--url <str>: Apprise notification URL (slack://, mailto://, etc.). Masked on every read; write the mask back to keep the stored URL Required.--description <str>: Human-readable description--enabled / --no-enabled: Enabled--url-scheme <str>: URL scheme (slack, mailto, etc.); read-only, set from the URL--hunt-name <str>: Hunt file stem when this destination is owned by a hunt (set via API)--help: Show this message and exit.
Example: dfe alerts destinations apply <name>
Calls PUT /api/v1/alerts/destinations/{name}.
dfe alerts destinations delete
Delete Destination
Delete an alert destination.
Usage:
$ dfe alerts destinations delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe alerts destinations delete <name>
Calls DELETE /api/v1/alerts/destinations/{name}.
dfe alerts destinations get
Get Destination
Get an alert destination by name.
Usage:
$ dfe alerts destinations get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe alerts destinations get <name>
Calls GET /api/v1/alerts/destinations/{name}.
dfe app-contracts
Usage:
$ dfe app-contracts [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get App Contract
dfe app-contracts get
Get App Contract
One app's config schema and capability catalogue, or that none is mounted.
Usage:
$ dfe app-contracts get [OPTIONS] [service]
Arguments:
service: Service Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe app-contracts get <service>
Calls GET /api/v1/app-contracts/{service}.
dfe apps
Usage:
$ dfe apps [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
delete: Delete Instanceget: Get Applist: List Appsconfigfileshistoryinstancesmetricsroutingscalingstatusvalues
dfe apps delete
Delete Instance
Undeploy an instance by removing its values overlay.
Usage:
$ dfe apps delete [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--help: Show this message and exit.
Example: dfe apps delete <service> <instance>
Calls DELETE /api/v1/apps/{service}/{instance}.
dfe apps get
Get App
One instance's identity and shape.
Usage:
$ dfe apps get [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe apps get <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}.
dfe apps list
List Apps
Every manageable app, with the instances currently deployed.
Usage:
$ dfe apps list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--query-profile <str>: Deployment profile to judge each app's offer against, so the rule stays in one place rather than being re-derived by every caller. Omit it and this deployment's own profile is used; omit it where the deployment states none and every app is reported as offered.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe apps list
Calls GET /api/v1/apps.
dfe apps config
Usage:
$ dfe apps config [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
delete: Clear App Configlist: Get App Configput: Set App Config
dfe apps config delete
Clear App Config
Remove options from the overlay, so the app runs its own default for each.
A cleared option reads back unset with provenance default, so it follows the
default when the default next moves. Writing the default back would instead
leave an override that only matches it today, and a PUT of null stores null,
which many options take as a value of its own.
A path the overlay does not hold is already clear and commits nothing. Clearing
a field beside a stored credential in the same mapping is a 400
credential_reentry_required, as the PUT of a new value there is, unless the
request clears that credential too.
Usage:
$ dfe apps config delete [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--path <str>: An option to put back to the app's default, as the config route reports it:config.<option>orextraEnv.<NAME>. Repeat it to clear several in one commit. Required.--if-match <str>: If-Match--help: Show this message and exit.
Example: dfe apps config delete <service> <instance> --path <path>
Calls DELETE /api/v1/apps/{service}/{instance}/config.
dfe apps config list
Get App Config
Every option the app declares, with this instance's value and where it comes from.
The overlay alone cannot answer this: it holds only what was written, so an option nobody has touched is invisible in it. The app's own contract supplies the rest, which is what lets the console show an untouched option with the default it would run rather than an empty box.
Usage:
$ dfe apps config list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe apps config list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/config.
dfe apps config put
Set App Config
Write options the app declares, and environment keys it does not.
Judged against the app's own contract before anything is committed, so a value the app would refuse at startup leaves the deploy repo where it was rather than landing a commit an operator then has to revert.
A secret is written like any other option: it goes into the overlay as the rest
of this surface writes one, and neither this response nor a read route on this
surface says what it is. A masked value written back as it was read keeps the
stored credential. The mask where nothing is stored is a 400 masked_value.
A changed field beside a stored credential, in the same mapping or with the
credential one mapping down (brokers beside sasl.password), is a 400
credential_reentry_required until that mapping is written whole with its
credentials typed again. A setting inside another mapping beside it, such as
producer.retries, is not. config and extraEnv are roots, so a
setting directly under either never needs one.
409 where the deployment already decides the value: a config path the chart
derives, or an extraEnv name the chart sets for this app.
Usage:
$ dfe apps config put [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--changes <str>: One entry per option. Aconfig.*key is checked against the app's own schema before anything is committed; anextraEnv.<NAME>key is checked as an environment name only, and a null value there removes it. JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe apps config put <service> <instance>
Calls PUT /api/v1/apps/{service}/{instance}/config.
dfe apps files
Usage:
$ dfe apps files [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Write App Filecopy: Copy App Filesdelete: Delete App Filedry-run: Dry Run App Fileget: Read App Filelink: Link App Filelist: List App Filesrelink: Relink App Fileslinks
dfe apps files apply
Write App File
Add or replace a file the app consumes, up to repository.max_object_bytes.
The file lands in the deploy repo's history for good, so an oversized one is refused before it is buffered rather than after it is committed.
Usage:
$ dfe apps files apply [OPTIONS] [service] [instance] [set_name] [filename]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.filename: Filename Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--content <str>: Content Required.--help: Show this message and exit.
Example: dfe apps files apply <service> <instance> <set-name> <filename>
Calls PUT /api/v1/apps/{service}/{instance}/files/{set_name}/{filename}.
dfe apps files copy
Copy App Files
Copy this instance's authored files onto another instance of the same app.
A transform is written against one source. Reusing it on another should not mean retyping it. Only the files move - the target keeps its own source binding, scaling and identity.
Usage:
$ dfe apps files copy [OPTIONS] [service] [instance] [set_name]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--target-instance <str>: Instance to copy into. For a source-bound app this is the source. Required.--overwrite / --no-overwrite: Replace files of the same name in the target instead of refusing.--help: Show this message and exit.
Example: dfe apps files copy <service> <instance> <set-name>
Calls POST /api/v1/apps/{service}/{instance}/files/{set_name}/copy.
dfe apps files delete
Delete App File
Remove a file the app consumes, and any link that produced it.
Usage:
$ dfe apps files delete [OPTIONS] [service] [instance] [set_name] [filename]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.filename: Filename Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--help: Show this message and exit.
Example: dfe apps files delete <service> <instance> <set-name> <filename>
Calls DELETE /api/v1/apps/{service}/{instance}/files/{set_name}/{filename}.
dfe apps files dry-run
Dry Run App File
Run an authored file over real events from the source, and report each one.
Nothing is written: no topic, no table, no commit. content runs unsaved
content, which is what makes this useful in an editor. Omitted, the file
already in the overlay runs instead.
Usage:
$ dfe apps files dry-run [OPTIONS] [service] [instance] [set_name]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: File in the set to run Required.--content <str>: Unsaved content to run instead of what is committed. Nothing is written.--source <str>: Source to sample from. Defaults to the instance, which for a source-bound app IS the source.--limit <int>: Events to sample and run over, at most transform_validation.dry_run_max_events (100 by default), which a larger value is refused against--help: Show this message and exit.
Example: dfe apps files dry-run <service> <instance> <set-name>
Calls POST /api/v1/apps/{service}/{instance}/files/{set_name}/dry-run.
dfe apps files get
Read App File
One file's content, with the revision to write it back against.
Usage:
$ dfe apps files get [OPTIONS] [service] [instance] [set_name] [filename]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.filename: Filename Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe apps files get <service> <instance> <set-name> <filename>
Calls GET /api/v1/apps/{service}/{instance}/files/{set_name}/{filename}.
dfe apps files link
Link App File
Link a file in the set to a library artefact.
The artefact's content is resolved into the file set, because a chart can only render what is already in the values, and the provenance is recorded beside it so the link is recoverable.
Usage:
$ dfe apps files link [OPTIONS] [service] [instance] [set_name]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--name <str>: Filename the artefact's content resolves into. Required.--artifact <str>: Artifact Required.--version <int>: Pin this version. Omit for the artefact's current one.--tag <str>: Follow this tag instead of a version; the resolved version is recorded.--help: Show this message and exit.
Example: dfe apps files link <service> <instance> <set-name>
Calls POST /api/v1/apps/{service}/{instance}/files/{set_name}/link.
dfe apps files list
List App Files
Every file in the set, without their contents.
Usage:
$ dfe apps files list [OPTIONS] [service] [instance] [set_name]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe apps files list <service> <instance> <set-name>
Calls GET /api/v1/apps/{service}/{instance}/files/{set_name}.
dfe apps files relink
Relink App Files
Re-resolve every link in the set to what its target now names.
A tag link follows its tag. A version-pinned link advances to the artefact's current version. This is the fix-once-roll-everywhere half of the library.
Usage:
$ dfe apps files relink [OPTIONS] [service] [instance] [set_name]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--help: Show this message and exit.
Example: dfe apps files relink <service> <instance> <set-name>
Calls POST /api/v1/apps/{service}/{instance}/files/{set_name}/relink.
dfe apps files links
Usage:
$ dfe apps files links [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List App Links
dfe apps files links list
List App Links
Where each linked file came from, and whether it still matches.
drift means the content beside the link is no longer what the linked
version holds - a local edit over a linked file. outdated means the link
resolved cleanly but its target has moved since.
Usage:
$ dfe apps files links list [OPTIONS] [service] [instance] [set_name]
Arguments:
service: Service Required.instance: Instance Required.set_name: Set Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe apps files links list <service> <instance> <set-name>
Calls GET /api/v1/apps/{service}/{instance}/files/{set_name}/links.
dfe apps history
Usage:
$ dfe apps history [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get History
dfe apps history list
Get History
Every change to this instance, newest first, a page at a time.
Supply the revision Argo has synced as applied_revision to see which
commits have reached the cluster and which are still pending.
Usage:
$ dfe apps history list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--applied-revision <str>: Applied Revision--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe apps history list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/history.
dfe apps instances
Usage:
$ dfe apps instances [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Create Instance
dfe apps instances create
Create Instance
Deploy an instance by creating its values overlay.
The overlay's presence is what the layer2-apps ApplicationSet turns into an Argo
Application, so this is the whole deployment step. A new instance stores nothing,
so a masked value copied from another instance's read is a 400 masked_value.
Usage:
$ dfe apps instances create [OPTIONS] [service]
Arguments:
service: Service Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--instance <str>: Instance Required.--values <str>: Initial helm values as dot-path keys, merged over the defaults. JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe apps instances create <service>
Calls POST /api/v1/apps/{service}/instances.
dfe apps metrics
Usage:
$ dfe apps metrics [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Metricsseries: Get Resource Seriestotals: Get Totals
dfe apps metrics list
Get Metrics
Throughput, CPU, memory and saturation for the instance or a process deployed from its image.
Usage:
$ dfe apps metrics list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--process <str>: Process--help: Show this message and exit.
Example: dfe apps metrics list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/metrics.
dfe apps metrics series
Get Resource Series
CPU and memory over time as min, max, average and p95 per bucket.
Each bucket aggregates across every pod reporting for this instance, or for the named process. A per-config app deploys each config under its own service name, so one instance is already one config.
A bucket_seconds of 0 reads the window as one bucket and may reach back over the gauge table's whole retention, which a window_seconds of 0 asks for. A bucketed read stops at a week.
Usage:
$ dfe apps metrics series [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--window-seconds <int>: Window Seconds--bucket-seconds <int>: Bucket Seconds--process <str>: Process--help: Show this message and exit.
Example: dfe apps metrics series <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/metrics/series.
dfe apps metrics totals
Get Totals
Counter, request and CPU totals over the window, across every run of every pod.
A window of 0 counts everything the metrics tables still keep.
Usage:
$ dfe apps metrics totals [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--window-seconds <int>: Window Seconds--process <str>: Process--help: Show this message and exit.
Example: dfe apps metrics totals <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/metrics/totals.
dfe apps routing
Usage:
$ dfe apps routing [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get App Routingsync: Sync App Routing
dfe apps routing list
Get App Routing
What the sources compile to, against what the overlay actually carries.
An absent block is called out separately from drift: it means the app is running on its built-in defaults, which is how a receiver silently ignores every source rule ever defined.
Usage:
$ dfe apps routing list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe apps routing list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/routing.
dfe apps routing sync
Sync App Routing
Rewrite the overlay's routing to what the sources currently compile to.
Usage:
$ dfe apps routing sync [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--help: Show this message and exit.
Example: dfe apps routing sync <service> <instance>
Calls POST /api/v1/apps/{service}/{instance}/routing/sync.
dfe apps scaling
Usage:
$ dfe apps scaling [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Scalingput: Set Scaling
dfe apps scaling list
Get Scaling
The scaling dials, or why they do not apply here.
Usage:
$ dfe apps scaling list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe apps scaling list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/scaling.
dfe apps scaling put
Set Scaling
Set the scaling dials. Refused when the deploy target has no such dials.
Usage:
$ dfe apps scaling put [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--replica-count <int>: Fixed pod count, for a deployment with KEDA off. Refused unlesskeda_enabledis false in this request or already in the overlay: the chart omitsreplicaswhile KEDA is on, which it is by default, and the ScaledObject owns the count.--min-replicas <int>: Min Replicas--max-replicas <int>: Max Replicas--keda-enabled / --no-keda-enabled: Keda Enabled--cpu-request <str>: Cpu Request--memory-request <str>: Memory Request--cpu-limit <str>: Cpu Limit--memory-limit <str>: Memory Limit--help: Show this message and exit.
Example: dfe apps scaling put <service> <instance>
Calls PUT /api/v1/apps/{service}/{instance}/scaling.
dfe apps status
Usage:
$ dfe apps status [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Status
dfe apps status list
Get Status
Whether the instance, or a process deployed from its image, is reporting, and since when.
Usage:
$ dfe apps status list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--process <str>: Process--help: Show this message and exit.
Example: dfe apps status list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/status.
dfe apps values
Usage:
$ dfe apps values [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Values
dfe apps values list
Get Values
The instance's overlay document, credentials masked, with the revision to write against.
Masked as the config route hides them: by the app's own secret marker in its schema, and by name wherever the schema says nothing.
Usage:
$ dfe apps values list [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe apps values list <service> <instance>
Calls GET /api/v1/apps/{service}/{instance}/values.
dfe auth
Usage:
$ dfe auth [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
login: Loginlogout: Logoutrefresh: Refresh Tokenlist: List configured accounts, marking the...print-access-token: Print the active token to stdout (for...accountsapi-keysgroupsmeoidcoidc-providerspermissionsrolessetupsetup-status
dfe auth login
Login
Authenticate with local credentials and receive a JWT token.
The password check runs off the event loop. Failed attempts back off per
username and per client address (auth.login_throttle). A waiting attempt is
refused with 429 before the password is checked.
Usage:
$ dfe auth login [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--username <str>: Account name (admin, operator, viewer) Required.--password <str>: Plaintext password Required.--help: Show this message and exit.
Example: dfe auth login
Calls POST /api/v1/auth/login.
dfe auth logout
Logout
End every session of the caller's account, on every device.
Each token minted for the account before this call is refused from now on, this one included, and the engine's login cookie is cleared. A peer that verifies engine tokens by signature alone still accepts one until it expires.
Usage:
$ dfe auth logout [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth logout
Calls POST /api/v1/auth/logout.
dfe auth refresh
Refresh Token
Refresh the current JWT token. Requires a valid existing token.
The new token keeps the session's sign-in time, so a session renews only until
it is api.max_session_minutes old, and no token outlives that.
Usage:
$ dfe auth refresh [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth refresh
Calls POST /api/v1/auth/refresh.
dfe auth list
List configured accounts, marking the active one.
Usage:
$ dfe auth list [OPTIONS]
Options:
--help: Show this message and exit.
dfe auth print-access-token
Print the active token to stdout (for scripts).
Usage:
$ dfe auth print-access-token [OPTIONS]
Options:
--help: Show this message and exit.
dfe auth accounts
Usage:
$ dfe auth accounts [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Accountchange-password: Reset Current User Passwordcreate: Create Accountdelete: Delete Accountget: Get Accountgit-status: Account Git Statuslist: List Accountsme: Get Current User Accountreset-password: Reset Passwordrotate-password: Rotate Passwordupdate-me: Update Current User Accountattributessensitive-attributes
dfe auth accounts apply
Update Account
Update account groups, enabled/blocked status, or contact fields (admin only).
Refused when the caller disables or blocks their own account, or when that (or stripping every system-scope admin group) would leave no usable system-admin account.
Usage:
$ dfe auth accounts apply [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--groups <str>: Replace group memberships--enabled / --no-enabled: Enable or disable the account--blocked / --no-blocked: Block the account from holding a session--email <str>: Contact email--phone <str>: Contact phone--name <str>: Display name--org <str>: Replace the org binding. The registered org the account belongs to, which its sessions carry as org_id. Empty binds it to none, so it reads no org-bound view. The binding grants nothing itself: such a view also needs the org among those its groups grant.--help: Show this message and exit.
Example: dfe auth accounts apply <username>
Calls PUT /api/v1/auth/accounts/{username}.
dfe auth accounts change-password
Reset Current User Password
Change the authenticated user's own password, given the current one.
The username is taken from the session, not the request, so a caller cannot
reset another account through this route. current_password must be the
account's password, so a stolen session token cannot take the account over;
wrong guesses back off as sign-in failures do. An IdP-owned (external)
account is refused: it has no local password. The live store takes the new
password immediately and every session the account held ends, this one
included, so the owner signs in again. The git block reports whether the
durable mirror merged, is pending review, or is a no-op for a non-git-backed
account.
An account on an issued password may call this and nothing else that
changes state, and the reset clears password_change_required.
Usage:
$ dfe auth accounts change-password [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--new-password <str>: New plaintext password; at least 12 characters and at most 72 bytes Required.--current-password <str>: The account's password now. A session token alone cannot change it. Required.--help: Show this message and exit.
Example: dfe auth accounts change-password
Calls POST /api/v1/auth/accounts/reset-password.
dfe auth accounts create
Create Account
Create a new local user account (admin only).
Usage:
$ dfe auth accounts create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--username <str>: Unique account name Required.--password <str>: Plaintext password (bcrypt-hashed before storage); at least 12 characters and at most 72 bytes Required.--email <str>: Contact email--groups <str>: Group memberships--phone <str>: Contact phone--name <str>: Display name--org <str>: The registered org the account belongs to, which its sessions carry as org_id. Empty binds it to none, so it reads no org-bound view. The binding grants nothing itself: such a view also needs the org among those its groups grant.--help: Show this message and exit.
Example: dfe auth accounts create
Calls POST /api/v1/auth/accounts.
dfe auth accounts delete
Delete Account
Delete an account (admin only).
Refused when the caller targets their own account, when the account holds the system admin role and no other usable admin-role account would remain (bootstrap admin and break-glass count when they can sign in), or when the store refuses a recovery credential.
Usage:
$ dfe auth accounts delete [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth accounts delete <username>
Calls DELETE /api/v1/auth/accounts/{username}.
dfe auth accounts get
Get Account
Get a single account by username (admin only).
Soft-deleted (anonymized) accounts answer 404 the same as a missing name.
Usage:
$ dfe auth accounts get [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth accounts get <username>
Calls GET /api/v1/auth/accounts/{username}.
dfe auth accounts git-status
Account Git Status
Poll whether an account's password has merged to the deploy repo's main.
Step 2 of the review-PR path for the local admin and breakglass: the UI
polls this after the operator merges the PR. It fetches remote main and flips
merged true. Durable immediately in the auto-merge and file-share modes. A
regular user is never git-persisted, so it reports not-git-backed (durable in
its own store).
Usage:
$ dfe auth accounts git-status [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth accounts git-status <username>
Calls GET /api/v1/auth/accounts/{username}/git-status.
dfe auth accounts list
List Accounts
List accounts (admin only), paginated. No password hashes returned.
Usage:
$ dfe auth accounts list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in username, name, or email--oidc-id <str>: Exact match on the OIDC provider name last used to log the account in--blocked / --no-blocked: Filter by blocked status. Omitted returns every account.--include-core / --no-include-core: Include the local admin and break-glass recovery accounts.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over created_at, updated_at, username, each optionally followed by desc--help: Show this message and exit.
Example: dfe auth accounts list
Calls GET /api/v1/auth/accounts.
dfe auth accounts me
Get Current User Account
Return the authenticated user's account. No extra scope required.
An account on an issued password reads back with no groups: its session holds no standing until the change, and a console copies this read into its session.
Usage:
$ dfe auth accounts me [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth accounts me
Calls GET /api/v1/auth/accounts/me.
dfe auth accounts reset-password
Reset Password
Reset an account's password (admin only).
An IdP-owned (external) account is refused: the password lives at the
identity provider. The live store takes the new password immediately (next
login), and the change is mirrored into the durable deploy repo so it
survives a rebuild. The git block reports whether that mirror merged
straight away (dev/solo) or is a pending review PR / CLI merge
(production+team), or is a no-op file share.
Usage:
$ dfe auth accounts reset-password [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--new-password <str>: New plaintext password; at least 12 characters and at most 72 bytes Required.--help: Show this message and exit.
Example: dfe auth accounts reset-password <username>
Calls POST /api/v1/auth/accounts/{username}/reset-password.
dfe auth accounts rotate-password
Rotate Password
Rotate the local admin's password in the deployment's secret store.
The store that injects DFE_ENGINE_AUTH_LOCAL_ADMIN_PASSWORD is the source of that
password, so the engine writes the new value through its secrets backend and
never into its own YAML. The next boot reconcile issues the rotated value to
the admin, who must replace it at the following login. Returns 501 with the
command that changes it where it is kept when the deployment has not declared
a secrets path for the password. Every other account, breakglass included,
changes its password through reset-password.
Usage:
$ dfe auth accounts rotate-password [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--new-password <str>: New plaintext password to write to the secret store; at least 12 characters, at most 72 bytes, and never the shipped default Required.--help: Show this message and exit.
Example: dfe auth accounts rotate-password <username>
Calls POST /api/v1/auth/accounts/{username}/rotate-password.
dfe auth accounts update-me
Update Current User Account
Update the authenticated user's contact fields. No extra scope required.
Groups and enabled cannot be changed here: those stay on the admin
PUT /{username} route, which requires account:write.
Usage:
$ dfe auth accounts update-me [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--email <str>: Contact email--phone <str>: Contact phone--name <str>: Display name--help: Show this message and exit.
Example: dfe auth accounts update-me
Calls PUT /api/v1/auth/accounts/me.
dfe auth accounts attributes
Usage:
$ dfe auth accounts attributes [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Put Account Attributesget: Get Account Attributes
dfe auth accounts attributes apply
Put Account Attributes
Full-replace an account's non-sensitive attribute blob (404 if missing or soft-deleted).
Usage:
$ dfe auth accounts attributes apply [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--attributes <str>: Attributes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe auth accounts attributes apply <username>
Calls PUT /api/v1/auth/accounts/{username}/attributes.
dfe auth accounts attributes get
Get Account Attributes
Read an account's non-sensitive attribute blob (404 if missing or soft-deleted).
Usage:
$ dfe auth accounts attributes get [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth accounts attributes get <username>
Calls GET /api/v1/auth/accounts/{username}/attributes.
dfe auth accounts sensitive-attributes
Usage:
$ dfe auth accounts sensitive-attributes [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Put Account Sensitive Attributesget: Get Account Sensitive Attributes
dfe auth accounts sensitive-attributes apply
Put Account Sensitive Attributes
Full-replace an account's SENSITIVE attribute blob (404 if missing or soft-deleted).
Usage:
$ dfe auth accounts sensitive-attributes apply [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--attributes <str>: Attributes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe auth accounts sensitive-attributes apply <username>
Calls PUT /api/v1/auth/accounts/{username}/sensitive-attributes.
dfe auth accounts sensitive-attributes get
Get Account Sensitive Attributes
Read an account's SENSITIVE attribute blob from the separate keyed store.
The account must exist first (404 otherwise), so a sensitive read cannot be used to probe for accounts that are not there. Soft-deleted accounts answer the same way.
Usage:
$ dfe auth accounts sensitive-attributes get [OPTIONS] [username]
Arguments:
username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth accounts sensitive-attributes get <username>
Calls GET /api/v1/auth/accounts/{username}/sensitive-attributes.
dfe auth api-keys
Usage:
$ dfe auth api-keys [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Create Api Keydelete: Revoke Api Keylist: List Api Keys
dfe auth api-keys create
Create Api Key
Create a new API key. Returns the full key exactly once.
422 unknown_org when org names no registered org.
Usage:
$ dfe auth api-keys create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Unique human-readable key name Required.--groups <str>: RBAC group memberships--org <str>: The org the key's sessions are bound to: a registered org's name, or empty for none. A view held to one org runs only for a key bound to an org its groups grant.--description <str>: Optional description--expires-at <str>: Optional ISO-8601 expiry (UTC if no offset given). Omitted, the key expires after auth.api_key_default_ttl_days (90 unless configured; 0 there means it never expires).--help: Show this message and exit.
Example: dfe auth api-keys create
Calls POST /api/v1/auth/api-keys.
dfe auth api-keys delete
Revoke Api Key
Revoke (delete) an API key by short token.
Usage:
$ dfe auth api-keys delete [OPTIONS] [short_token]
Arguments:
short_token: Short Token Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth api-keys delete <short-token>
Calls DELETE /api/v1/auth/api-keys/{short_token}.
dfe auth api-keys list
List Api Keys
List API keys, paginated. No key hashes or full keys returned.
Usage:
$ dfe auth api-keys list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in key name/description--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over created_at, expires_at, name, each optionally followed by desc--help: Show this message and exit.
Example: dfe auth api-keys list
Calls GET /api/v1/auth/api-keys.
dfe auth groups
Usage:
$ dfe auth groups [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Groupcreate: Create Groupdelete: Delete Groupget: Get Grouplist: List Groupsattributesmemberssensitive-attributes
dfe auth groups apply
Update Group
Update group roles, description, members or IdP link (group:write at the group's scope).
Usage:
$ dfe auth groups apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--roles <str>: Replace role list--description <str>: Replace description--members <str>: Replace member username list--source-id <str>: Replace the source ID; omit to keep it. The group identifier the identity provider asserts in its tokens: the group name for Okta, dex and Keycloak groups claims, the object ID for Entra. A login through source_provider asserting it takes this group's roles. Empty for a group managed only here. A non-empty source ID needs a source_provider. At most 512 characters, with no control characters and no leading or trailing whitespace; no other group may carry it.--source-provider <str>: Replace the source provider; omit to keep it. The provider whose logins the source ID answers, required with a source ID: an OIDC provider name, a key or value of auth.source_provider_bindings, 'scim' or, while auth.trust_proxy_auth_headers is on, auth.proxy_provider. At most 512 characters.--help: Show this message and exit.
Example: dfe auth groups apply <name>
Calls PUT /api/v1/auth/groups/{name}.
dfe auth groups create
Create Group
Create a new RBAC group at a scope.
Usage:
$ dfe auth groups create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Unique group name Required.--roles <str>: Roles assigned to all group members Required.--description <str>: Human-readable description--scope <str>: 'system' (roles bind system-wide) or 'org:<name>' (group exists only inside that org; roles bind at that org's scope)--members <str>: Account usernames in this group (local login resolves roles from this list)--source-id <str>: The group identifier the identity provider asserts in its tokens: the group name for Okta, dex and Keycloak groups claims, the object ID for Entra. A login through source_provider asserting it takes this group's roles. Empty for a group managed only here. A non-empty source ID needs a source_provider. At most 512 characters, with no control characters and no leading or trailing whitespace; no other group may carry it.--source-provider <str>: The provider whose logins the source ID answers, required with a source ID: an OIDC provider name, a key or value of auth.source_provider_bindings, 'scim' or, while auth.trust_proxy_auth_headers is on, auth.proxy_provider. At most 512 characters.--help: Show this message and exit.
Example: dfe auth groups create
Calls POST /api/v1/auth/groups.
dfe auth groups delete
Delete Group
Delete a group (checked at the group's scope).
Usage:
$ dfe auth groups delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth groups delete <name>
Calls DELETE /api/v1/auth/groups/{name}.
dfe auth groups get
Get Group
Get a single group by name (404 when not visible to the caller).
Usage:
$ dfe auth groups get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth groups get <name>
Calls GET /api/v1/auth/groups/{name}.
dfe auth groups list
List Groups
List groups visible to the caller (own memberships + scope grants), paginated.
Usage:
$ dfe auth groups list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in group name/description--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over name, scope, each optionally followed by desc--help: Show this message and exit.
Example: dfe auth groups list
Calls GET /api/v1/auth/groups.
dfe auth groups attributes
Usage:
$ dfe auth groups attributes [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Put Group Attributesget: Get Group Attributes
dfe auth groups attributes apply
Put Group Attributes
Full-replace a group's non-sensitive attribute blob (404 if missing).
Usage:
$ dfe auth groups attributes apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--attributes <str>: Attributes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe auth groups attributes apply <name>
Calls PUT /api/v1/auth/groups/{name}/attributes.
dfe auth groups attributes get
Get Group Attributes
Read a group's non-sensitive attribute blob (404 if the group is missing).
Usage:
$ dfe auth groups attributes get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth groups attributes get <name>
Calls GET /api/v1/auth/groups/{name}/attributes.
dfe auth groups members
Usage:
$ dfe auth groups members [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Add Memberdelete: Remove Member
dfe auth groups members create
Add Member
Add a member to a group (idempotent, checked at the group's scope).
Usage:
$ dfe auth groups members create [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--username <str>: Account username to add Required.--help: Show this message and exit.
Example: dfe auth groups members create <name>
Calls POST /api/v1/auth/groups/{name}/members.
dfe auth groups members delete
Remove Member
Remove a member from a group (checked at the group's scope).
Usage:
$ dfe auth groups members delete [OPTIONS] [name] [username]
Arguments:
name: Name Required.username: Username Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth groups members delete <name> <username>
Calls DELETE /api/v1/auth/groups/{name}/members/{username}.
dfe auth groups sensitive-attributes
Usage:
$ dfe auth groups sensitive-attributes [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Put Group Sensitive Attributesget: Get Group Sensitive Attributes
dfe auth groups sensitive-attributes apply
Put Group Sensitive Attributes
Full-replace a group's SENSITIVE attribute blob (404 if the group is missing).
Usage:
$ dfe auth groups sensitive-attributes apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--attributes <str>: Attributes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe auth groups sensitive-attributes apply <name>
Calls PUT /api/v1/auth/groups/{name}/sensitive-attributes.
dfe auth groups sensitive-attributes get
Get Group Sensitive Attributes
Read a group's SENSITIVE attribute blob from the separate keyed store.
The group must exist first (404 otherwise), so a sensitive read cannot probe for groups that are not there.
Usage:
$ dfe auth groups sensitive-attributes get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth groups sensitive-attributes get <name>
Calls GET /api/v1/auth/groups/{name}/sensitive-attributes.
dfe auth me
Usage:
$ dfe auth me [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Me
dfe auth me list
Get Me
Get the current authenticated user's info.
A session on an issued password reports the flag and no roles, permissions, groups or orgs, because its token carries none until the change.
hyperdx_role and hyperdx_identity are what dfe-hyperdx takes a
session's dashboard role and team from. It caches this answer for 30 seconds,
so a group change reaches dfe-hyperdx in that window rather than at token expiry.
Usage:
$ dfe auth me list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth me list
Calls GET /api/v1/auth/me.
dfe auth oidc
Usage:
$ dfe auth oidc [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
callbacklogin
dfe auth oidc callback
Usage:
$ dfe auth oidc callback [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Oidc Callback
dfe auth oidc callback list
Oidc Callback
Complete the OIDC flow and re-mint the engine token (single issuer).
A login started with return_to returns there refused as well as admitted,
so a browser never lands on this route's JSON error. Without return_to a
refusal answers JSON with its status, as any API error does.
Usage:
$ dfe auth oidc callback list [OPTIONS] [provider]
Arguments:
provider: Provider Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth oidc callback list <provider>
Calls GET /api/v1/auth/oidc/{provider}/callback.
dfe auth oidc login
Usage:
$ dfe auth oidc login [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Oidc Login
dfe auth oidc login list
Oidc Login
Begin OIDC auth-code flow: 302 to the IdP, or JSON authorize URL for SPAs.
Usage:
$ dfe auth oidc login list [OPTIONS] [provider]
Arguments:
provider: Provider Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--redirect / --no-redirect: When false, return JSON with authorization_url for SPA clients (use credentials: include, then window.location.assign the URL).--return-to <str>: Where the callback sends the browser after login, with the engine token in the URL fragment (#access_token=...&token_type=bearer&provider=...), or the refusal's code (#error=<code>&provider=...) when the login is refused. A relative path, or an absolute URL on this API's origin or a CORS-allowed origin. Omit to have the callback answer with JSON instead.--help: Show this message and exit.
Example: dfe auth oidc login list <provider>
Calls GET /api/v1/auth/oidc/{provider}/login.
dfe auth oidc-providers
Usage:
$ dfe auth oidc-providers [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Providercreate: Create Providerdelete: Delete Providerget: Get Providerlist: List Providerssync: Sync Provider Groupstest: Test Providerverify-login: Verify Login Config
dfe auth oidc-providers apply
Update Provider
Update an OIDC provider configuration (admin only).
A secret the body omits, value and env var name alike, keeps what the provider already holds, so an update that only flips enabled does not strand a stored credential. An empty env var name clears the name and keeps the stored copy. A secret the body names an env var for and sends no value for moves onto that env var and its stored copy is deleted once the update is saved, unless the name is the one already held with nothing stored. A move onto an env var the engine does not set is refused (env_var_not_set). Any update that touches more than enabled or display_name must leave the provider passing the field rules. Both are checked before a secret is written or deleted.
Usage:
$ dfe auth oidc-providers apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--enabled / --no-enabled: Enable or disable the provider--display-name <str>: Human-readable label--issuer <str>: OIDC issuer URL. An empty one is refused, since a login needs it--client-id <str>: OIDC client ID (not a secret)--client-id-env <str>: Env var name for OIDC client ID--client-secret <str>: Rotate the RP client secret. Write-only: it goes to the secret store and only its path is kept in config.--client-secret-env <str>: Env var name for the RP client secret. Omit it on an update to keep the name and any stored copy or send an empty string to clear the name and keep the stored copy. Naming an env var with no value for the secret moves the secret onto it and the stored copy is deleted once the update is saved; resending the name already held, with nothing stored, changes nothing. When that move, or a create naming an env var with no value for the secret, names one the engine does not set, the request is refused with 422 env_var_not_set on this field and nothing is saved or deleted.--scopes <str>: Replace the OAuth scopes requested at login, one scope per entry; must include openid. One space-separated string is accepted too, and a blank one leaves the scopes as they are.--groups <str>: Group resolution config JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe auth oidc-providers apply <name>
Calls PUT /api/v1/auth/oidc-providers/{name}.
dfe auth oidc-providers create
Create Provider
Create a new OIDC provider configuration (admin only).
Secret values in the body are written to the secret store before the YAML, and only once the name is free and the provider passes the field rules for its type and mode, so a refused provider leaves nothing behind. A secret named by an env var the engine does not set, with no value sent for it, is refused the same way (env_var_not_set).
Usage:
$ dfe auth oidc-providers create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Unique provider name (used as filename stem) Required.--type <generic|google|entra_id|okta>: Provider type: generic, google, entra_id, okta Required.--enabled / --no-enabled: Whether the provider serves logins--display-name <str>: Human-readable label--issuer <str>: OIDC issuer URL--client-id <str>: OIDC client ID. Not a secret, so it is stored in config.--client-id-env <str>: Env var name for OIDC client ID--client-secret <str>: RP client secret used in the auth-code exchange. Write-only: it goes to the secret store and only its path is kept in config.--client-secret-env <str>: Env var name for the RP client secret used in the auth-code exchange. With no client_secret, one the engine does not set is refused with 422 env_var_not_set on this field and nothing is saved.--scopes <str>: OAuth scopes requested at login, one scope per entry; must include openid. One space-separated string is accepted too, and a blank one is no override. Omit for the provider type's default: openid email profile, plus groups for generic and okta, and https://www.googleapis.com/auth/cloud-identity.groups.readonly for google, which reads each user's groups with their own token. Google and Entra ID fail a login that asks for groups.--groups <str>: How a provider's groups resolve: by hand, from a token claim, or from its API. JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe auth oidc-providers create
Calls POST /api/v1/auth/oidc-providers.
dfe auth oidc-providers delete
Delete Provider
Detach an OIDC provider and soft-delete its accounts (admin only).
Does NOT delete groups -- they become orphaned with their source_provider
still set to the deleted provider name. Accounts owned by the provider
(source_provider) or last logged in through it (oidc_id) are
soft-deleted: disabled and renamed to {uuid}-deleted with contact fields
cleared. The provider's stored credentials ARE removed: nothing is left that
can authenticate as a detached provider.
Usage:
$ dfe auth oidc-providers delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth oidc-providers delete <name>
Calls DELETE /api/v1/auth/oidc-providers/{name}.
dfe auth oidc-providers get
Get Provider
Get a single OIDC provider by name (admin only).
Usage:
$ dfe auth oidc-providers get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth oidc-providers get <name>
Calls GET /api/v1/auth/oidc-providers/{name}.
dfe auth oidc-providers list
List Providers
List OIDC providers (admin only), paginated.
Usage:
$ dfe auth oidc-providers list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in provider name/display name--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over created_at, name, type, each optionally followed by desc--help: Show this message and exit.
Example: dfe auth oidc-providers list
Calls GET /api/v1/auth/oidc-providers.
dfe auth oidc-providers sync
Sync Provider Groups
Force group sync for an OIDC provider (admin only).
Usage:
$ dfe auth oidc-providers sync [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth oidc-providers sync <name>
Calls POST /api/v1/auth/oidc-providers/{name}/sync.
dfe auth oidc-providers test
Test Provider
Test connectivity to an OIDC provider (admin only).
Usage:
$ dfe auth oidc-providers test [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth oidc-providers test <name>
Calls GET /api/v1/auth/oidc-providers/{name}/test.
dfe auth oidc-providers verify-login
Verify Login Config
Verify a provider's OIDC LOGIN config (admin only).
Answers "are the login creds real and is the IdP reachable" WITHOUT
attempting an interactive login - the gap /{name}/test leaves for
generic providers. Checks: the client_id resolves, the client_secret
resolves, and the issuer's discovery document is reachable and well-formed.
Usage:
$ dfe auth oidc-providers verify-login [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth oidc-providers verify-login <name>
Calls GET /api/v1/auth/oidc-providers/{name}/verify-login.
dfe auth permissions
Usage:
$ dfe auth permissions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Permissions
dfe auth permissions list
Get Permissions
Get resolved permissions for the current user's roles.
Usage:
$ dfe auth permissions list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth permissions list
Calls GET /api/v1/auth/permissions.
dfe auth roles
Usage:
$ dfe auth roles [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Rolecreate: Create Roledelete: Delete Roleget: Get Rolelist: List Rolesscopes: List Casbin Scopes
dfe auth roles apply
Update Role
Update a role. A change to what it grants needs the caller to hold it before and after.
Usage:
$ dfe auth roles apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--description <str>: Replace description--permissions <str>: Replace permission patterns--scoped / --no-scoped: Replace org-scoped flag--help: Show this message and exit.
Example: dfe auth roles apply <name>
Calls PUT /api/v1/auth/roles/{name}.
dfe auth roles create
Create Role
Create a new RBAC role granting no more than the caller holds.
Usage:
$ dfe auth roles create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Unique role name Required.--description <str>: Human-readable description--permissions <str>: Casbin-style permission patterns Required.--scoped / --no-scoped: When true, role is org-scoped at query time--help: Show this message and exit.
Example: dfe auth roles create
Calls POST /api/v1/auth/roles.
dfe auth roles delete
Delete Role
Delete a role no group holds, for a caller holding role:delete.
Usage:
$ dfe auth roles delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth roles delete <name>
Calls DELETE /api/v1/auth/roles/{name}.
dfe auth roles get
Get Role
Get one role by name, for a caller holding role:read.
Usage:
$ dfe auth roles get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth roles get <name>
Calls GET /api/v1/auth/roles/{name}.
dfe auth roles list
List Roles
List roles with pagination, for a caller holding role:read.
Usage:
$ dfe auth roles list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--resource-type <core|custom>: Return only roles with this resource_type (core or custom)--search <str>: Case-insensitive match on role name or description--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe auth roles list
Calls GET /api/v1/auth/roles.
dfe auth roles scopes
List Casbin Scopes
Return assignable Casbin permission scopes for role configuration.
Usage:
$ dfe auth roles scopes [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Case-insensitive substring match on permission scope strings--prefix <str>: Return only scopes that start with this prefix (e.g. config:, argo:)--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe auth roles scopes
Calls GET /api/v1/auth/roles/scopes.
dfe auth setup
Usage:
$ dfe auth setup [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
retire-admin: Retire Bootstrap Admin
dfe auth setup retire-admin
Retire Bootstrap Admin
Retire the bootstrap admin: disable it and record the fact in the deploy repo.
The deployment mints the admin password and the engine reissues it whenever
the injected value changes, so until it is retired anyone able to write the
Secret or .env can issue themselves the admin at the next boot. Retiring
ends the reseed: the account stays disabled, the password may be deleted, and
breakglass is the recovery path.
The console keeps the bootstrap admin. Retiring it is an operator's policy
choice made here. Refused unless the deployment already has an enabled
admin-role account of its own -- retire_admin_available on the setup status
is the same predicate. Returns the setup status, which now
reports admin_retired. Reversal is not an API: remove admin_retired
from governance/settings/auth.yaml in the deploy repo and restart.
Usage:
$ dfe auth setup retire-admin [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth setup retire-admin
Calls POST /api/v1/auth/setup/retire-admin.
dfe auth setup-status
Usage:
$ dfe auth setup-status [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Setup Status
dfe auth setup-status list
Get Setup Status
Report first-run setup state and what is configured (no auth -- pre-login UI).
Driven by the setup state machine (state_machines/setup.py). The
registries the wizard renders -- OIDC providers and organisations -- are
returned while setup is outstanding and dropped once it completes, so a
configured deployment does not serve its inventory to anonymous callers.
The exception is the name and display name of each enabled OIDC provider,
which stay (no configuration) because the login screen needs to know which
IdPs to offer and what to call them. Accounts are never returned. The
first_user step reports whether a real (non break-glass) user exists.
Usage:
$ dfe auth setup-status list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe auth setup-status list
Calls GET /api/v1/auth/setup-status.
dfe authoring
Usage:
$ dfe authoring [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
from-hyperdx: Strip Search Query Time Boundsscaffold: Scaffoldai
dfe authoring from-hyperdx
Strip Search Query Time Bounds
Strip a Search query's time bounds -> {window}, ready to save as a rule.
Usage:
$ dfe authoring from-hyperdx [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--body-query <str>: Query Required.--time-fields <str>: Time Fields--help: Show this message and exit.
Example: dfe authoring from-hyperdx
Calls POST /api/v1/authoring/from-hyperdx.
dfe authoring scaffold
Scaffold
A starter SELECT over discovered columns (source meta + landed _json keys).
Usage:
$ dfe authoring scaffold [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--table <str>: Table Required.--columns <str>: Columns--source <str>: Source--limit <int>: Limit--help: Show this message and exit.
Example: dfe authoring scaffold
Calls POST /api/v1/authoring/scaffold.
dfe authoring ai
Usage:
$ dfe authoring ai [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Ai Creategenerate-vrl: Ai Generate Vrlreview: Ai Reviewsuggest-schema: Ai Suggest Schema
dfe authoring ai create
Ai Create
Draft a query from a prompt with the registered query generator module.
Usage:
$ dfe authoring ai create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--prompt <str>: Prompt Required.--source-name <str>: Source Name--columns <str>: Columns JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe authoring ai create
Calls POST /api/v1/authoring/ai/create.
dfe authoring ai generate-vrl
Ai Generate Vrl
Draft VRL from log samples with the registered log parser module.
Usage:
$ dfe authoring ai generate-vrl [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--samples <str>: Samples Required.--source-hint <str>: Source Hint--help: Show this message and exit.
Example: dfe authoring ai generate-vrl
Calls POST /api/v1/authoring/ai/generate-vrl.
dfe authoring ai review
Ai Review
Review rule SQL with the registered query optimiser module.
Usage:
$ dfe authoring ai review [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--sql <str>: Sql Required.--execution-profile <str>: Execution Profile JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe authoring ai review
Calls POST /api/v1/authoring/ai/review.
dfe authoring ai suggest-schema
Ai Suggest Schema
Suggest meta-schema changes with the registered schema optimiser module.
Usage:
$ dfe authoring ai suggest-schema [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source-name <str>: Source Name Required.--source-schema <str>: Source Schema JSON or YAML, or file://<path>.--query-patterns <str>: Query Patterns--help: Show this message and exit.
Example: dfe authoring ai suggest-schema
Calls POST /api/v1/authoring/ai/suggest-schema.
dfe backing-services
Usage:
$ dfe backing-services [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Backing Servicelist: List Backing Servicesoverlays-cmd: List Overlaysoverlays
dfe backing-services get
Get Backing Service
One backing service's DECLARED deploy configuration (see the list route).
Usage:
$ dfe backing-services get [OPTIONS] [service]
Arguments:
service: Service Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe backing-services get <service>
Calls GET /api/v1/backing-services/{service}.
dfe backing-services list
List Backing Services
Every backing service's DECLARED deploy configuration, and who runs it.
Declared, not observed: these are the values the deploy repo asks for, read
from git. The engine runs no Kubernetes client, so a figure here can differ
from the cluster whenever Argo has not synced the declaration yet. A service
DFE does not run (managed_by provider or external) adds observed, read from
its own broker or server and held briefly per service, and read_only, the
values a write is refused on.
Usage:
$ dfe backing-services list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe backing-services list
Calls GET /api/v1/backing-services.
dfe backing-services overlays-cmd
List Overlays
List infra overlay resources in the deploy repo's infra/ dir.
Usage:
$ dfe backing-services overlays-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe backing-services overlays
Calls GET /api/v1/backing-services/overlays.
dfe backing-services overlays
Usage:
$ dfe backing-services overlays [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
vars
dfe backing-services overlays vars
Usage:
$ dfe backing-services overlays vars [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Set Overlay Vardelete: Delete Overlay Varlist: List Overlay Vars
dfe backing-services overlays vars apply
Set Overlay Var
Set an infra overlay value.
409 managed_by_provider, before any other check, when DFE does not run the service and the value is one of its read_only paths. helmvars:override does not lift it. 403 with the policy that blocked it when the var is protected - the storage model, the data-layer modes and the disk size are decided at deploy, and moving one on a live deployment is a data migration. 400 when the value would lower a declared node or broker count, or leave it undeclared (a parent map that omits it), which loses data rather than capacity. helmvars:override does not lift it.
Usage:
$ dfe backing-services overlays vars apply [OPTIONS] [name] [path]
Arguments:
name: Name Required.path: Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--value <str>: Value Required.--help: Show this message and exit.
Example: dfe backing-services overlays vars apply <name> <path>
Calls PUT /api/v1/backing-services/overlays/{name}/vars/{path}.
dfe backing-services overlays vars delete
Delete Overlay Var
Revert an infra overlay value to its chart default. Protected vars refuse.
409 managed_by_provider, before any other check and whatever the caller holds, when DFE does not run the service and the value is one of its read_only paths. 400 when the revert would lower a declared node or broker count, or leave it undeclared, unless the caller holds helmvars:override. An undeclared count falls to the chart or profile default, which the engine cannot read, so a revert that leaves one undeclared is refused whatever that default is.
Usage:
$ dfe backing-services overlays vars delete [OPTIONS] [name] [path]
Arguments:
name: Name Required.path: Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe backing-services overlays vars delete <name> <path>
Calls DELETE /api/v1/backing-services/overlays/{name}/vars/{path}.
dfe backing-services overlays vars list
List Overlay Vars
Flattened dot-path vars for one overlay, each marked protected or not.
Credentials come back masked, as every other read of the deploy repo masks them.
Usage:
$ dfe backing-services overlays vars list [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe backing-services overlays vars list <name>
Calls GET /api/v1/backing-services/overlays/{name}/vars.
dfe cel
Usage:
$ dfe cel [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
check: Validate a CEL expression and classify its performance tiercheck-batch: Validate multiple CEL expressions in one call
dfe cel check
Validate a CEL expression and classify its performance tier
Returns syntax validity, performance tier, referenced fields, and a human-readable description of what the expression matches. Designed for live UI validation as the user types -- completes in <1ms.
Usage:
$ dfe cel check [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--expression <str>: CEL expression to validate Required.--check-profile / --no-check-profile: If true, apply DFE profile restrictions (reject regex/iteration/time). Leave false for transport filters -- Tier 3 is classification only, not rejection.--help: Show this message and exit.
Example: dfe cel check
Calls POST /api/v1/cel/check.
dfe cel check-batch
Validate multiple CEL expressions in one call
Batch version of /cel/check. Use when the UI needs to validate an entire filter list at once (e.g., on form submit). Max 100 expressions.
Usage:
$ dfe cel check-batch [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--expressions <str>: List of CEL expressions to validate Required.--check-profile / --no-check-profile: Check Profile--help: Show this message and exit.
Example: dfe cel check-batch
Calls POST /api/v1/cel/check-batch.
dfe deployment
Usage:
$ dfe deployment [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
admin-links
dfe deployment admin-links
Usage:
$ dfe deployment admin-links [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List Admin Links
dfe deployment admin-links list
List Admin Links
Each admin UI this deployment runs, in the order its deployer listed them.
The deployer supplies the list, so an empty one means it listed none. Gated to
the admin-class roles, which hold deployment:* or *: the list maps the
deployment's consoles. Links only. Nothing here carries a credential.
Usage:
$ dfe deployment admin-links list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe deployment admin-links list
Calls GET /api/v1/deployment/admin-links.
dfe field-maps
Usage:
$ dfe field-maps [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Create Field Mapdelete: Delete Source Field Mapget: Get Default Field Mapget-for-source: Get Source Field Maplist: List Field Mapsseed: Seed Field Maps
dfe field-maps create
Create Field Map
Create or update a field map.
Usage:
$ dfe field-maps create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--standard <str>: Standard identifier (sigma, ecs, cim) Required.--source <str>: Source name, or None for the default map--version <str>: Standard version (e.g. '8.11' for ECS)--description <str>: Human description--inherits <str>: Reference to base map (declarative)--mappings <str>: standard_field -> dfe_column_name JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe field-maps create
Calls POST /api/v1/field-maps.
dfe field-maps delete
Delete Source Field Map
Delete a source-specific field map override.
Usage:
$ dfe field-maps delete [OPTIONS] [standard] [source]
Arguments:
standard: Standard Required.source: Source Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe field-maps delete <standard> <source>
Calls DELETE /api/v1/field-maps/{standard}/{source}.
dfe field-maps get
Get Default Field Map
Get the default field map for a standard (no source-specific overrides).
Usage:
$ dfe field-maps get [OPTIONS] [standard]
Arguments:
standard: Standard Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe field-maps get <standard>
Calls GET /api/v1/field-maps/{standard}.
dfe field-maps get-for-source
Get Source Field Map
Get the source-specific field map override.
Usage:
$ dfe field-maps get-for-source [OPTIONS] [standard] [source]
Arguments:
standard: Standard Required.source: Source Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe field-maps get-for-source <standard> <source>
Calls GET /api/v1/field-maps/{standard}/{source}.
dfe field-maps list
List Field Maps
List field maps with optional filtering.
Usage:
$ dfe field-maps list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--standard <str>: Filter by mapping standard (e.g. sigma, ecs)--search <str>: Search in standard/source names--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over mapping_count, source, standard, each optionally followed by desc--help: Show this message and exit.
Example: dfe field-maps list
Calls GET /api/v1/field-maps.
dfe field-maps seed
Seed Field Maps
Seed built-in default field maps. Non-destructive.
Usage:
$ dfe field-maps seed [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe field-maps seed
Calls POST /api/v1/field-maps/seed.
dfe gitops
Usage:
$ dfe gitops [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
auto-mergeclasseslog
dfe gitops auto-merge
Usage:
$ dfe gitops auto-merge [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Auto Mergeput: Put Auto Merge
dfe gitops auto-merge list
Get Auto Merge
Auto-merge status for the UI banner: stored flag, gate verdict, net effect.
Usage:
$ dfe gitops auto-merge list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe gitops auto-merge list
Calls GET /api/v1/gitops/auto-merge.
dfe gitops auto-merge put
Put Auto Merge
Toggle auto-merge. Enabling requires the deployment gate. Disabling always works.
Usage:
$ dfe gitops auto-merge put [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--enabled / --no-enabled: Enabled Required.--help: Show this message and exit.
Example: dfe gitops auto-merge put
Calls PUT /api/v1/gitops/auto-merge.
dfe gitops classes
Usage:
$ dfe gitops classes [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List Classesresources
dfe gitops classes list
List Classes
The resource-class registry - what VarChange.cls may legally name.
Registry metadata only (no resource content), so any authenticated caller may read it. The per-class listings below are gated by each class's grant.
Usage:
$ dfe gitops classes list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe gitops classes list
Calls GET /api/v1/gitops/classes.
dfe gitops classes resources
Usage:
$ dfe gitops classes resources [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List Class Resourcesvars
dfe gitops classes resources list
List Class Resources
Resource names in a class - what VarChange.name may legally name.
Usage:
$ dfe gitops classes resources list [OPTIONS] [cls]
Arguments:
cls: Cls Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe gitops classes resources list <cls>
Calls GET /api/v1/gitops/classes/{cls}/resources.
dfe gitops classes resources vars
Usage:
$ dfe gitops classes resources vars [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List Class Resource Vars
dfe gitops classes resources vars list
List Class Resource Vars
Flattened dot-path vars of one resource - what VarChange.path may name.
Values ride along so a select can show the current value beside each path, with credentials masked as every other read of the deploy repo masks them.
Usage:
$ dfe gitops classes resources vars list [OPTIONS] [cls] [name]
Arguments:
cls: Cls Required.name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe gitops classes resources vars list <cls> <name>
Calls GET /api/v1/gitops/classes/{cls}/resources/{name}/vars.
dfe gitops log
Usage:
$ dfe gitops log [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Log
dfe gitops log list
Get Log
Gitcrud audit log: every governed-ops git change, newest-first.
Flat + cursor-paginated by default; ?group_by= buckets the page for summaries. applied_revision (the Argo-synced SHA) turns state into applied/pending. Without it every entry is 'committed'.
Usage:
$ dfe gitops log list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--limit <int>: Limit--before <str>: Before--group-by <str>: Group By--applied-revision <str>: Applied Revision--help: Show this message and exit.
Example: dfe gitops log list
Calls GET /api/v1/gitops/log.
dfe governance
Usage:
$ dfe governance [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
actionsadminch-rbacpolicies
dfe governance actions
Usage:
$ dfe governance actions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Actioninvoke: Invoke Actionlist: List Actions
dfe governance actions get
Get Action
One defined action. A credential a legacy definition still carries comes back masked.
Usage:
$ dfe governance actions get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe governance actions get <name>
Calls GET /api/v1/governance/actions/{name}.
dfe governance actions invoke
Invoke Action
Invoke a defined action - gated on the action's OWN required_action.
body.params supplies values for the action's declared params (422 on a
constraint violation. Omitted params take their defaults). A hunt or rule
document the action would leave invalid is 422 invalid_document, with the
hunts API's own message. A change to the infra overlay meets the backing-services
guards on what the action leaves, dry run included, whatever the caller holds:
409 managed_by_provider for a read-only value of a service DFE does not run,
then 400 scale_down_refused where it lowers or un-declares a node or broker
count.
Direct commit in dev/solo. A production+team invoke is routed to a review PR (or
409 review_required when no forge is configured).
Usage:
$ dfe governance actions invoke [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Dry Run--params <str>: Params JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe governance actions invoke <name>
Calls POST /api/v1/governance/actions/{name}/invoke.
dfe governance actions list
List Actions
List the defined actions by name.
Usage:
$ dfe governance actions list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe governance actions list
Calls GET /api/v1/governance/actions.
dfe governance admin
Usage:
$ dfe governance admin [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
actions-cmd: Create Actionpolicies-cmd: Create Policyactionspolicies
dfe governance admin actions-cmd
Create Action
Define or replace an action.
400 credential_in_action where a change targets a credential: the definition
is committed to the deploy repo, so a credential in it is plaintext in history.
Usage:
$ dfe governance admin actions-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Name Required.--description <str>: Description--required-action <str>: RBAC string checked at invoke time; empty derives action:invoke:<name>--params <str>: Params JSON or YAML, or file://<path>.--changes <str>: Changes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe governance admin actions
Calls POST /api/v1/governance/admin/actions.
dfe governance admin policies-cmd
Create Policy
Define or replace a protected-var policy.
Usage:
$ dfe governance admin policies-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Name Required.--description <str>: Description--protected <str>: Protected--help: Show this message and exit.
Example: dfe governance admin policies
Calls POST /api/v1/governance/admin/policies.
dfe governance admin actions
Usage:
$ dfe governance admin actions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
delete: Delete Actionvalidate: Validate Action
dfe governance admin actions delete
Delete Action
Remove a defined action.
Usage:
$ dfe governance admin actions delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe governance admin actions delete <name>
Calls DELETE /api/v1/governance/admin/actions/{name}.
dfe governance admin actions validate
Validate Action
Dry-check an action definition: every violation + the would-be diff.
Nothing is committed - this is the authoring hand-hold, run before the
define endpoint so a wizard can show the full diff and every problem in
one round trip. That includes each change invoke would refuse under the
infra overlay guards (managed_by_provider, scale_down_refused), on
every enum map branch, reported by its message.
Usage:
$ dfe governance admin actions validate [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Name Required.--description <str>: Description--required-action <str>: RBAC string checked at invoke time; empty derives action:invoke:<name>--params <str>: Params JSON or YAML, or file://<path>.--changes <str>: Changes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe governance admin actions validate
Calls POST /api/v1/governance/admin/actions/validate.
dfe governance admin policies
Usage:
$ dfe governance admin policies [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
delete: Delete Policy
dfe governance admin policies delete
Delete Policy
Remove a protected-var policy.
Usage:
$ dfe governance admin policies delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe governance admin policies delete <name>
Calls DELETE /api/v1/governance/admin/policies/{name}.
dfe governance ch-rbac
Usage:
$ dfe governance ch-rbac [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
reconcile: Reconcile Ch Rbac Endpoint
dfe governance ch-rbac reconcile
Reconcile Ch Rbac Endpoint
Reconcile ClickHouse quota tiers, service roles and per-org row policies.
It mints the service-user secrets in the configured secrets backend, and a repeat run changes nothing.
Usage:
$ dfe governance ch-rbac reconcile [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe governance ch-rbac reconcile
Calls POST /api/v1/governance/ch-rbac/reconcile.
dfe governance policies
Usage:
$ dfe governance policies [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Policylist: List Policies
dfe governance policies get
Get Policy
Return one protected-var policy.
Usage:
$ dfe governance policies get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe governance policies get <name>
Calls GET /api/v1/governance/policies/{name}.
dfe governance policies list
List Policies
List the protected-var policies by name.
Usage:
$ dfe governance policies list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe governance policies list
Calls GET /api/v1/governance/policies.
dfe helm
Usage:
$ dfe helm [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
files-cmd: List Filesfiles
dfe helm files-cmd
List Files
List helm-var overlay resources.
Usage:
$ dfe helm files-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe helm files
Calls GET /api/v1/helm/files.
dfe helm files
Usage:
$ dfe helm files [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
vars
dfe helm files vars
Usage:
$ dfe helm files vars [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Set Vardelete: Delete Varlist: List Vars
dfe helm files vars apply
Set Var
Set a helm var.
A direct commit in dev or solo, and routed to a review PR (or 409 'review_required') in production+team. 409 on a stale If-Match, 403 if protected.
Usage:
$ dfe helm files vars apply [OPTIONS] [name] [path]
Arguments:
name: Name Required.path: Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--value <str>: Value Required.--help: Show this message and exit.
Example: dfe helm files vars apply <name> <path>
Calls PUT /api/v1/helm/files/{name}/vars/{path}.
dfe helm files vars delete
Delete Var
Revert a helm var to its chart default.
Routed like set_var (a PR in prod+team). 403 if protected, since reverting a locked var changes it as surely as setting it.
Usage:
$ dfe helm files vars delete [OPTIONS] [name] [path]
Arguments:
name: Name Required.path: Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe helm files vars delete <name> <path>
Calls DELETE /api/v1/helm/files/{name}/vars/{path}.
dfe helm files vars list
List Vars
Flattened dot-path vars for a resource, each marked protected or not.
Credentials come back masked, as the app surface's values route masks them.
Usage:
$ dfe helm files vars list [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe helm files vars list <name>
Calls GET /api/v1/helm/files/{name}/vars.
dfe hunts
Usage:
$ dfe hunts [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Huntcreate: Create Huntdelete: Delete Huntget: Get Huntlist: List Huntsrun: Trigger Huntstatus: Get Engine Status
dfe hunts apply
Update Hunt
Replace an existing hunt configuration, resolving its customers afresh.
A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the X-DFE-Review-Required header says so. 422
unknown_org when a customer names no registered org.
Usage:
$ dfe hunts apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--display-name <str>: Human-readable label (defaults fromnamewhen omitted on write)--cron <str>: Cron expression or list of expressions Required.--log-buffer <int>: Log Buffer--global-target-table-name <str>: Results table override; the rule's query carries its own target when omitted--global-source-table-name <str>: Global Source Table Name--customers <str>: Names of the registered orgs the hunt reads. The engine resolves each to its tenant ids when it saves the hunt, and the runner reads no other org's rows. Required.--checkpoint-timestamp-field <str>: Checkpoint Timestamp Field--scheduling-mode <str>: Scheduling Mode--min-interval-seconds <int>: Min Interval Seconds--explain-queries / --no-explain-queries: Explain Queries--rules <str>: Rule names, each the{name}.yamlrule file the hunt runner reads Required.--help: Show this message and exit.
Example: dfe hunts apply <name>
Calls PUT /api/v1/hunts/{name}.
dfe hunts create
Create Hunt
Create a new hunt configuration YAML.
A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the X-DFE-Review-Required header says so. 422
unknown_org when a customer names no registered org.
Usage:
$ dfe hunts create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--display-name <str>: Human-readable label (defaults fromnamewhen omitted on write)--cron <str>: Cron expression or list of expressions Required.--log-buffer <int>: Log Buffer--global-target-table-name <str>: Results table override; the rule's query carries its own target when omitted--global-source-table-name <str>: Global Source Table Name--customers <str>: Names of the registered orgs the hunt reads. The engine resolves each to its tenant ids when it saves the hunt, and the runner reads no other org's rows. Required.--checkpoint-timestamp-field <str>: Checkpoint Timestamp Field--scheduling-mode <str>: Scheduling Mode--min-interval-seconds <int>: Min Interval Seconds--explain-queries / --no-explain-queries: Explain Queries--rules <str>: Rule names, each the{name}.yamlrule file the hunt runner reads Required.--name <str>: Hunt file name (YAML stem); must be unique Required.--help: Show this message and exit.
Example: dfe hunts create
Calls POST /api/v1/hunts.
dfe hunts delete
Delete Hunt
Delete a hunt configuration.
A production+team delete is routed to a review branch, so the runner keeps
executing the hunt until that branch is merged. X-DFE-Review-Required says so.
Usage:
$ dfe hunts delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe hunts delete <name>
Calls DELETE /api/v1/hunts/{name}.
dfe hunts get
Get Hunt
Get full hunt configuration by file name.
Usage:
$ dfe hunts get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe hunts get <name>
Calls GET /api/v1/hunts/{name}.
dfe hunts list
List Hunts
List persisted hunt configurations, each with its run state, paginated.
Run state comes from ONE ClickHouse read across every listed hunt: the watermark (last run), the lease (running now), hunt_state (too aggressive) and hunt_run (rows the last run wrote). Next due is derived, not stored.
Usage:
$ dfe hunts list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Case-insensitive search in name, display_name, customers, rules, source_table, target_table--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over display_name, name, source_table, target_table, each optionally followed by desc--help: Show this message and exit.
Example: dfe hunts list
Calls GET /api/v1/hunts.
dfe hunts run
Trigger Hunt
Queue an ad-hoc run: mark the hunt due now for the runner to claim.
The pull model is kept. Nothing is pushed at the runner and no listener is added -- the fire is written into the coordination state, and the runner that is already running picks it up on its next poll, through the same claim that stops a hunt double-running. 202 says it is queued, not that it has run. The response carries the poll interval so the caller knows the longest wait before it starts.
A hunt with no rate schedule is not something the runner ticks, so a queued run for one sits unclaimed. That is the schedule's shape, not a failure here.
503 is reserved for ClickHouse actually being unreachable. Any other failure to write the request is a 500, so a bug here never reads as an outage.
Usage:
$ dfe hunts run [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe hunts run <name>
Calls POST /api/v1/hunts/{name}/run.
dfe hunts status
Get Engine Status
Report hunt scheduling status.
Hunts execute in the separate dfe-hunt-runner service (pull-based, coordinated
via ClickHouse), not in this API process, so runners counts the runners that
beat within their last two polls and running is whether any did. For "is this
hunt running", read the per-hunt running on the hunts list. hunt_count is
the configured-hunt count.
Usage:
$ dfe hunts status [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe hunts status
Calls GET /api/v1/hunts/status.
dfe hyperdx
Usage:
$ dfe hyperdx [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
connection: Get Search Connectionsources: List Search Sources
dfe hyperdx connection
Get Search Connection
Return the caller's OWN org connection - never another org's.
A caller granted query:execute at system scope by a declared, unscoped role
other than org_viewer gets the platform reader. Any other caller gets its org's pinned
dfe_org_<org> user, whatever roles it holds at that org's scope. A caller
that resolves to zero or several separate orgs is refused (403) so isolation
fails closed rather than guessing.
Usage:
$ dfe hyperdx connection [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe hyperdx connection
Calls GET /api/v1/hyperdx/connection.
dfe hyperdx sources
List Search Sources
List every Search team and the DFE sources on it.
A deploy writes its source to every team, so this is the read that says where it landed. 503 when Search is not deployed or not answering -- an empty list would read as "the source is missing", which is a different fault.
Usage:
$ dfe hyperdx sources [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe hyperdx sources
Calls GET /api/v1/hyperdx/sources.
dfe ingest
Usage:
$ dfe ingest [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
compatcompat-profilesrules
dfe ingest compat
Usage:
$ dfe ingest compat [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Apply Compatget: Get Compat
dfe ingest compat apply
Apply Compat
Set the profiles every source binds unless it names its own list.
If-Match is required. Each binding must name a stored profile, a version it
publishes and only opt-in rows it offers, and one version of a profile compiles
per deployment, so a version another source binds differently is refused with
422 invalid_binding. A rules-only change answers reload: hot.
Usage:
$ dfe ingest compat apply [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Validate and report the change without committing it--if-match <str>: The current ETag: the write fails with 412 if it has changed--if-none-match <str>:*to create: the write fails with 412 if the resource exists--profiles <str>: The deployment's default bindings JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe ingest compat apply
Calls PUT /api/v1/ingest/compat.
dfe ingest compat get
Get Compat
Get the profiles every source binds unless it names its own list. Its ETag is an apply's If-Match.
Usage:
$ dfe ingest compat get [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe ingest compat get
Calls GET /api/v1/ingest/compat.
dfe ingest compat-profiles
Usage:
$ dfe ingest compat-profiles [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Compat Profilelist: List Compat Profiles
dfe ingest compat-profiles get
Get Compat Profile
Get one compatibility profile with every version it publishes.
Usage:
$ dfe ingest compat-profiles get [OPTIONS] [path_profile]
Arguments:
path_profile: Profile Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe ingest compat-profiles get <path-profile>
Calls GET /api/v1/ingest/compat-profiles/{profile}.
dfe ingest compat-profiles list
List Compat Profiles
List the stored compatibility profiles by id, each at its current version. Takes no filter or order_by.
Usage:
$ dfe ingest compat-profiles list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe ingest compat-profiles list
Calls GET /api/v1/ingest/compat-profiles.
dfe ingest rules
Usage:
$ dfe ingest rules [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List Rule Blocksorder: Reorder Rule Blocks
dfe ingest rules list
List Rule Blocks
List every rule block, _source first, each field's in the order it runs.
Its ETag is the If-Match a reorder takes. Takes no filter or order_by.
Usage:
$ dfe ingest rules list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe ingest rules list
Calls GET /api/v1/ingest/rules.
dfe ingest rules order
Reorder Rule Blocks
Set the order one field's rule blocks run in.
If-Match is required, and a stale one answers 412 with the current ETag.
The pinned default keeps its place last. A rules-only change is one the
receiver reloads where it stands, so reload answers hot.
Usage:
$ dfe ingest rules order [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Validate and report the change without committing it--if-match <str>: The current ETag: the write fails with 412 if it has changed--if-none-match <str>:*to create: the write fails with 412 if the resource exists--target <_source|_org_id>: The header field whose blocks are reordered Required.--blocks <str>: Every block id GET /ingest/rules lists for target bar the pinned default Required.--help: Show this message and exit.
Example: dfe ingest rules order
Calls POST /api/v1/ingest/rules/order.
dfe kafka
Usage:
$ dfe kafka [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
topics-cmd: List Topic Statusclient-config: Emit ready-to-use client config for...topics
dfe kafka topics-cmd
List Topic Status
Report each source topic's existence, shape, config and drift.
Read-only: it creates nothing, so a status call against a broker mid-restart reports that it could not be read rather than reporting every topic missing. A caller held to its orgs sees the topics of the sources it may read.
Usage:
$ dfe kafka topics-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source <str>: Limit to one source's topics; omitted means every source--help: Show this message and exit.
Example: dfe kafka topics
Calls GET /api/v1/kafka/topics.
dfe kafka client-config
Emit ready-to-use client config for PROVIDER (kcat / confluent / librdkafka).
Usage:
$ dfe kafka client-config [OPTIONS]
Options:
--provider <str>: Provider: strimzi / redpanda / redpanda-cloud / confluent-cloud / msk / plaintext. [required]--tool <properties|kcat|kafbat>: Output shape: librdkafka .properties (default), kcat -F file (same), or kafbat-ui JSON. [default: properties]--bootstrap <str>: Bootstrap servers (else from settings/.env).--username <str>: SASL username (else from settings/.env).--password <str>: SASL password (else from settings/.env).--schema-registry-url <str>: Schema registry URL (kafbat only).--out FILE: Write to FILE (chmod 0600) instead of stdout.--eval: Printexport KCAT_CONFIG=<0600 temp file>foreval "$(...)"so kcat just works.--help: Show this message and exit.
dfe kafka topics
Usage:
$ dfe kafka topics [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
ensure: Ensure Source Topicsremove: Remove Source Topicsupdate: Update Source Topics
dfe kafka topics ensure
Ensure Source Topics
Create every topic the sources in scope need and do not have.
Idempotent, and it never touches a topic that already exists: widening an
existing topic is update, deliberately, so a re-ensure cannot reshape a
live topic as a side effect.
Usage:
$ dfe kafka topics ensure [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source <str>: Limit to one source's topics; omitted means every source-n, --dry-run: Report what would change without changing it--help: Show this message and exit.
Example: dfe kafka topics ensure
Calls POST /api/v1/kafka/topics/ensure.
dfe kafka topics remove
Remove Source Topics
Delete one source's topics. DESTRUCTIVE - the records on them are gone.
Guarded twice over: a source name is required (there is no remove-everything
call), and confirm must be set. A dry run needs neither the confirmation
nor a broker write, so it is the safe way to see what would go.
Usage:
$ dfe kafka topics remove [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source <str>: The source whose topics go; never every source at once Required.--confirm / --no-confirm: Must be true: the topic's records go with it and do not come back-n, --dry-run: Report what would change without changing it--help: Show this message and exit.
Example: dfe kafka topics remove --source <source>
Calls POST /api/v1/kafka/topics/remove.
dfe kafka topics update
Update Source Topics
Converge existing topics onto their spec: alter configs, widen partitions.
A topic that does not exist is reported as absent rather than created, so a source that never deployed shows up here instead of being quietly fixed.
Usage:
$ dfe kafka topics update [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source <str>: Limit to one source's topics; omitted means every source-n, --dry-run: Report what would change without changing it--help: Show this message and exit.
Example: dfe kafka topics update
Calls POST /api/v1/kafka/topics/update.
dfe library
Usage:
$ dfe library [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Create Artifactdelete: Delete Artifactget: Get Artifactkinds: List Kindslist: List Artifactsrollback: Rollbackupdate: Patch Artifactstatetagsusageversions
dfe library create
Create Artifact
Create an artefact, with or without its first version.
Creating one empty is what lets its kind, group and labels be settled before any content can enter.
Usage:
$ dfe library create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Name Required.--kind <str>: A kind declared in the app manifest. Required.--group <str>: Optional namespace, e.g. 'network'.--description <str>: Description--labels <str>: Labels JSON or YAML, or file://<path>.--content <str>: Publish this as version 1. Omit to create the artefact empty.--message <str>: Message--help: Show this message and exit.
Example: dfe library create
Calls POST /api/v1/library.
dfe library delete
Delete Artifact
Remove an artefact. Refused while any instance links to it.
Retiring an artefact that is still in use is a state change, not a delete, so the history behind a deployed file is never destroyed.
Usage:
$ dfe library delete [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe library delete <artifact>
Calls DELETE /api/v1/library/{artifact}.
dfe library get
Get Artifact
One artefact's metadata and pointers.
Usage:
$ dfe library get [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe library get <artifact>
Calls GET /api/v1/library/{artifact}.
dfe library kinds
List Kinds
Every artefact kind the manifest declares.
Usage:
$ dfe library kinds [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe library kinds
Calls GET /api/v1/library/kinds.
dfe library list
List Artifacts
Every artefact, filtered. Different filters AND together.
Usage:
$ dfe library list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--kind <str>: Kind--group <str>: Group--state <str>: State--label <str>: Repeatable 'key' or 'key=value' selector; all must match.--q <str>: Substring of the name or the description.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe library list
Calls GET /api/v1/library.
dfe library rollback
Rollback
Point current back at an earlier version, keeping the newer ones.
Usage:
$ dfe library rollback [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <int>: Version Required.--help: Show this message and exit.
Example: dfe library rollback <artifact>
Calls POST /api/v1/library/{artifact}/rollback.
dfe library update
Patch Artifact
Edit the classification metadata. Never produces a version.
Usage:
$ dfe library update [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--description <str>: Description--labels <str>: Labels JSON or YAML, or file://<path>.--group <str>: Group--help: Show this message and exit.
Example: dfe library update <artifact>
Calls PATCH /api/v1/library/{artifact}.
dfe library state
Usage:
$ dfe library state [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Set State
dfe library state apply
Set State
Set the lifecycle state.
Usage:
$ dfe library state apply [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--state <str>: enabled | disabled | deprecated Required.--help: Show this message and exit.
Example: dfe library state apply <artifact>
Calls PUT /api/v1/library/{artifact}/state.
dfe library tags
Usage:
$ dfe library tags [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Set Tagdelete: Delete Tag
dfe library tags apply
Set Tag
Point a tag at a version. Repointing is explicit, never a side effect.
Usage:
$ dfe library tags apply [OPTIONS] [artifact] [tag]
Arguments:
artifact: Artifact Required.tag: Tag Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <int>: Version Required.--help: Show this message and exit.
Example: dfe library tags apply <artifact> <tag>
Calls PUT /api/v1/library/{artifact}/tags/{tag}.
dfe library tags delete
Delete Tag
Remove a tag. The versions it named are untouched.
Usage:
$ dfe library tags delete [OPTIONS] [artifact] [tag]
Arguments:
artifact: Artifact Required.tag: Tag Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe library tags delete <artifact> <tag>
Calls DELETE /api/v1/library/{artifact}/tags/{tag}.
dfe library usage
Usage:
$ dfe library usage [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Usage
dfe library usage get
Get Usage
Every instance file that links to this artefact.
Usage:
$ dfe library usage get [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe library usage get <artifact>
Calls GET /api/v1/library/{artifact}/usage.
dfe library versions
Usage:
$ dfe library versions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Publish Versionget: Get Versionlist: List Versions
dfe library versions create
Publish Version
Publish content as a version.
Re-sending identical content is a no-op naming the version that already holds it. Sending different content at an existing version number is refused.
Usage:
$ dfe library versions create [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--if-match <str>: If-Match--content <str>: Content Required.--description <str>: Fixed to this version at publish.--message <str>: Message--version <int>: Publish at this exact version. Omit for the next in the series.--help: Show this message and exit.
Example: dfe library versions create <artifact>
Calls POST /api/v1/library/{artifact}/versions.
dfe library versions get
Get Version
One immutable version, with its digest as a strong ETag.
Usage:
$ dfe library versions get [OPTIONS] [artifact] [version]
Arguments:
artifact: Artifact Required.version: Version Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe library versions get <artifact> <version>
Calls GET /api/v1/library/{artifact}/versions/{version}.
dfe library versions list
List Versions
Every version, oldest first, without their content.
Usage:
$ dfe library versions list [OPTIONS] [artifact]
Arguments:
artifact: Artifact Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe library versions list <artifact>
Calls GET /api/v1/library/{artifact}/versions.
dfe lifecycle
Usage:
$ dfe lifecycle [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: List Servicespost: Set Lifecycle
dfe lifecycle list
List Services
List services with their tier and current lifecycle state.
Usage:
$ dfe lifecycle list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe lifecycle list
Calls GET /api/v1/lifecycle.
dfe lifecycle post
Set Lifecycle
Set a service's lifecycle state - per-service RBAC. Pinned services are 404.
Usage:
$ dfe lifecycle post [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--state <running|paused|stopped>: The gitops state dial value. Required.--help: Show this message and exit.
Example: dfe lifecycle post <name>
Calls POST /api/v1/lifecycle/{name}.
dfe operations
Usage:
$ dfe operations [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
cancel: Cancel Operationget: Get Operationlist: List Operations
dfe operations cancel
Cancel Operation
Cancel a running operation.
Usage:
$ dfe operations cancel [OPTIONS] [operation]
Arguments:
operation: Operation Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe operations cancel <operation>
Calls POST /api/v1/operations/{operation}/cancel.
dfe operations get
Get Operation
Get an operation: done with its response or error, else its progress.
Usage:
$ dfe operations get [OPTIONS] [operation]
Arguments:
operation: Operation Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe operations get <operation>
Calls GET /api/v1/operations/{operation}.
dfe operations list
List Operations
List the operations the caller may see, optionally filtered by kind.
Usage:
$ dfe operations list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--kind <str>: Filter by task kind--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe operations list
Calls GET /api/v1/operations.
dfe orgs
Usage:
$ dfe orgs [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Orgavailable-ids: Available Org Idscreate: Create Orgdelete: Delete Orgget: Get Orglist: List Orgsingest-credentials
dfe orgs apply
Update Org
Update an organisation (admin only).
The org's tenant ids are stored afresh in every hunt naming it before the org is
written, which also repairs a hunt holding stale ones. A production+team posture
routes that hunt change to review, and the X-DFE-Review-Required header says
so. An org's name is its identity, so it cannot be changed here.
Usage:
$ dfe orgs apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--display-name <str>: Human-readable label--org-ids <str>: Tenant IDs--enabled / --no-enabled: Enable or disable the org--help: Show this message and exit.
Example: dfe orgs apply <name>
Calls PUT /api/v1/orgs/{name}.
dfe orgs available-ids
Available Org Ids
Tenant ids the deployment's data actually carries (admin only).
Suggestions for the org form's Organisation IDs field, so an operator picks
an id that matches rows rather than typing one that matches none. Declared
above /{name} so the literal path wins the match.
Usage:
$ dfe orgs available-ids [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--limit <int>: Most tenant ids to return -- a suggestion list, not an export. Unset takes orgs.available_ids_limit (200 by default)--help: Show this message and exit.
Example: dfe orgs available-ids
Calls GET /api/v1/orgs/available-ids.
dfe orgs create
Create Org
Create a new customer organisation (admin only).
If the Search integration is enabled, the lifecycle manager handles team creation as part of org provisioning. Failure is non-fatal.
A hunt already naming the org, such as one whose org was deleted, has the new
org's tenant ids stored first. A production+team posture routes that hunt
change to review, and the X-DFE-Review-Required header says so.
Usage:
$ dfe orgs create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--name <str>: Unique org name (used as identifier) Required.--display-name <str>: Human-readable label--org-ids <str>: Tenant IDs for ClickHouse row-level security--help: Show this message and exit.
Example: dfe orgs create
Calls POST /api/v1/orgs.
dfe orgs delete
Delete Org
Delete an organisation (admin only), and the ingest credentials it owns.
Every hunt naming the org loses its stored tenant ids first and keeps the name,
so it fails as unknown_customers and holds its watermark until it is edited,
rather than reading the rows the org left behind. A production+team posture
routes that hunt change to review, and the X-DFE-Review-Required header says so.
The reserved default org cannot be deleted, nor can an org another org's
ingest credential binds or a fetched source names: each answers 409.
Usage:
$ dfe orgs delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe orgs delete <name>
Calls DELETE /api/v1/orgs/{name}.
dfe orgs get
Get Org
Get a single organisation by name (org:read at that org's scope).
Usage:
$ dfe orgs get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe orgs get <name>
Calls GET /api/v1/orgs/{name}.
dfe orgs list
List Orgs
List organisations visible to the caller, paginated.
System-scope org:read holders see every org. Org-scope holders see only the orgs their grants cover.
Usage:
$ dfe orgs list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in org name/display name--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over display_name, name, updated_at, each optionally followed by desc--help: Show this message and exit.
Example: dfe orgs list
Calls GET /api/v1/orgs.
dfe orgs ingest-credentials
Usage:
$ dfe orgs ingest-credentials [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Apply Ingest Credentialdelete: Delete Ingest Credentialget: Get Ingest Credentiallist: List Ingest Credentialsrotate: Rotate Ingest Credential
dfe orgs ingest-credentials apply
Apply Ingest Credential
Create an ingest credential and mint its token, or change what it binds.
If-None-Match: * creates it and answers 201 with the token, once.
If-Match: <etag> updates its orgs, default org and listeners and keeps its
token. A credential id is unique across every org, so creating one another org
holds answers 409 credential_id_taken. A binding the receiver could not
hold answers 422 invalid_binding with a field error for each problem. A write
another one got to first answers 412 where its precondition no longer holds, else
409 conflict, and changes nothing.
Usage:
$ dfe orgs ingest-credentials apply [OPTIONS] [org] [credential]
Arguments:
org: Org Required.credential: Credential Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Validate and report the change without committing it--if-match <str>: The current ETag: the write fails with 412 if it has changed--if-none-match <str>:*to create: the write fails with 412 if the resource exists--orgs <str>: The orgs its records may land in, the owning org among them. Unset is the owning org alone--default-org <str>: The org a record takes when no rule picks one of orgs. Unset is the owning org--listeners <str>: The receiver listeners that accept its token. Unset is every one--help: Show this message and exit.
Example: dfe orgs ingest-credentials apply <org> <credential>
Calls PUT /api/v1/orgs/{org}/ingest-credentials/{credential}.
dfe orgs ingest-credentials delete
Delete Ingest Credential
Delete an ingest credential. Its token stops working once the receiver rereads its secret.
One another write got to first answers 412 where its If-Match no longer holds,
else 409 conflict, and changes nothing.
Usage:
$ dfe orgs ingest-credentials delete [OPTIONS] [org] [credential]
Arguments:
org: Org Required.credential: Credential Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Validate and report the change without committing it--if-match <str>: The current ETag: the write fails with 412 if it has changed--if-none-match <str>:*to create: the write fails with 412 if the resource exists--help: Show this message and exit.
Example: dfe orgs ingest-credentials delete <org> <credential>
Calls DELETE /api/v1/orgs/{org}/ingest-credentials/{credential}.
dfe orgs ingest-credentials get
Get Ingest Credential
Get one ingest credential, never its token. Its ETag is an apply's If-Match.
Usage:
$ dfe orgs ingest-credentials get [OPTIONS] [org] [credential]
Arguments:
org: Org Required.credential: Credential Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe orgs ingest-credentials get <org> <credential>
Calls GET /api/v1/orgs/{org}/ingest-credentials/{credential}.
dfe orgs ingest-credentials list
List Ingest Credentials
List the ingest credentials an org owns, by id. Takes no filter or order_by.
Usage:
$ dfe orgs ingest-credentials list [OPTIONS] [org]
Arguments:
org: Org Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe orgs ingest-credentials list <org>
Calls GET /api/v1/orgs/{org}/ingest-credentials.
dfe orgs ingest-credentials rotate
Rotate Ingest Credential
Mint a new token for an ingest credential. The old one stops working and the binding stays.
The new token comes back in this response and never again. If-Match is
honoured when sent. A rotate the secrets backend refuses answers 503 and leaves the
old token working. One another write got to first answers 412 where its
If-Match no longer holds, else 409 conflict, and changes nothing.
Usage:
$ dfe orgs ingest-credentials rotate [OPTIONS] [org] [credential]
Arguments:
org: Org Required.credential: Credential Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Validate and report the change without committing it--if-match <str>: The current ETag: the write fails with 412 if it has changed--if-none-match <str>:*to create: the write fails with 412 if the resource exists--help: Show this message and exit.
Example: dfe orgs ingest-credentials rotate <org> <credential>
Calls POST /api/v1/orgs/{org}/ingest-credentials/{credential}/rotate.
dfe pipeline
Usage:
$ dfe pipeline [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
build: Build Pipelinetemplates: List Templates
dfe pipeline build
Build Pipeline
Start pipeline manifest generation, answering the operation to poll.
Usage:
$ dfe pipeline build [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--config-path <str>: Path to dfe_package.yaml (uses default if not provided)--output-path <str>: Output directory for rendered manifests--build-core / --no-build-core: Build core templates (vs custom only)--help: Show this message and exit.
Example: dfe pipeline build
Calls POST /api/v1/pipeline/build.
dfe pipeline templates
List Templates
List available Vector pipeline templates.
Usage:
$ dfe pipeline templates [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe pipeline templates
Calls GET /api/v1/pipeline/templates.
dfe queries
Usage:
$ dfe queries [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
cost-leaderboard: Query Cost Leaderboardraw: Execute Raw Queryviews-cmd: List Viewsviews
dfe queries cost-leaderboard
Query Cost Leaderboard
Top query-cost consumers from dfe.query_log_archive, heaviest first.
Groups by the attribution id (the hunt id for feature='hunts') and returns the query count + summed read rows/bytes + duration + peak memory. Reads the MV the CH wrapper's log_comment attribution feeds - returns [] until it has data.
Usage:
$ dfe queries cost-leaderboard [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--feature <str>: Attribution feature to rank (e.g. 'hunts')--days <int>: Lookback window in days--limit <int>: Max rows--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe queries cost-leaderboard
Calls GET /api/v1/queries/cost-leaderboard.
dfe queries raw
Execute Raw Query
Execute a raw query against a registered datasource adapter.
This is the lower-level query path -- for ad-hoc queries against
datasource adapters rather than parameterized views. The SQL runs as the
engine's own ClickHouse user, so it requires raw_query:execute, which no
built-in role but admin holds, and ClickHouse runs it read-only.
It returns at most options.limit rows, or query_views.default_limit,
capped at query_views.max_limit, with has_more set when the query had
more. The datasource stops reading past the cap.
Usage:
$ dfe queries raw [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--datasource <str>: Datasource URI (e.g. 'clickhouse:default') Required.--body-query <str>: Query label or identifier Required.--params <str>: Query parameters JSON or YAML, or file://<path>.--options <str>: Execution options (limit, timeout, etc.) JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe queries raw
Calls POST /api/v1/queries/raw.
dfe queries views-cmd
List Views
List available parameterized views.
Usage:
$ dfe queries views-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--namespace <str>: Filter by namespace--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe queries views
Calls GET /api/v1/queries/views.
dfe queries views
Usage:
$ dfe queries views [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
execute: Execute Viewget: Get Viewnamespaces: List Namespaces
dfe queries views execute
Execute View
Execute a parameterized view and return JSON results.
The org_id parameter is always injected from the authenticated
user's context -- it cannot be overridden by the client. It is the org the
session's account is bound to, and a view taking it runs only when the caller's
groups grant that org or it reads every org (granted_bound_org).
Usage:
$ dfe queries views execute [OPTIONS] [label]
Arguments:
label: Label Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--params <str>: View parameters (validated against view definition) JSON or YAML, or file://<path>.--options <str>: Execution options (limit, offset, timeout, etc.) JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe queries views execute <label>
Calls POST /api/v1/queries/views/{label}/execute.
dfe queries views get
Get View
Get a specific view definition with parameters and metadata.
Usage:
$ dfe queries views get [OPTIONS] [label]
Arguments:
label: Label Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe queries views get <label>
Calls GET /api/v1/queries/views/{label}.
dfe queries views namespaces
List Namespaces
List available view namespaces.
Usage:
$ dfe queries views namespaces [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe queries views namespaces
Calls GET /api/v1/queries/views/namespaces.
dfe rules
Usage:
$ dfe rules [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Rulecreate: Create Ruledelete: Delete Rulefrom-hyperdx: Create Rule From Searchget: Get Rulelist: List Rulesvalidate: Validate Rule Sql
dfe rules apply
Update Rule
Replace a detection rule (re-runs creation pipeline, preserves created_at).
A replacement the hunt runner could not compile is refused with 422 and the
stored rule is left as it was. A production+team write is routed to a review
branch instead of the branch the runner git-syncs, and the
X-DFE-Review-Required header says so.
Usage:
$ dfe rules apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--display-name <str>: Human-readable label (defaults fromnamewhen omitted on create)--severity <str>: low|medium|high|critical--user-sql <str>: Full detection query: SELECT ... FROM <db>.<table> WHERE ... (the FROM names the source table) Required.--cel-filter <str>: CEL expression filter--hunt-name <str>: Parent hunt name--source <str>: Source label (e.g. windows_audit)--estimate-cost / --no-estimate-cost: Return the alert-volume preview's measurement as cost_estimate. The preview and its warnings on the rule follow the deployment's detection guard either way.--cost-window-minutes <int>: Lookback window in minutes the preview counts over. Absent or 0 uses the deployment's preview window.--help: Show this message and exit.
Example: dfe rules apply <name>
Calls PUT /api/v1/rules/{name}.
dfe rules create
Create Rule
Create a new hunt rule via RuleCreationService.
The service sanitizes the SQL, applies CEL->SQL transpilation, validates column references, and optionally estimates query cost. A rule whose SQL the hunt runner could not compile is refused with 422. The cost preview counts only the orgs the hunts running the rule read, cut to the orgs its author may read.
A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the X-DFE-Review-Required header says so.
Usage:
$ dfe rules create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--display-name <str>: Human-readable label (defaults fromnamewhen omitted on create)--severity <str>: low|medium|high|critical--user-sql <str>: Full detection query: SELECT ... FROM <db>.<table> WHERE ... (the FROM names the source table) Required.--cel-filter <str>: CEL expression filter--hunt-name <str>: Parent hunt name--source <str>: Source label (e.g. windows_audit)--estimate-cost / --no-estimate-cost: Return the alert-volume preview's measurement as cost_estimate. The preview and its warnings on the rule follow the deployment's detection guard either way.--cost-window-minutes <int>: Lookback window in minutes the preview counts over. Absent or 0 uses the deployment's preview window.--name <str>: Rule file name (YAML stem); must be unique Required.--source-type <raw|hyperdx>: 'raw' (plain SQL) or 'hyperdx' (Search saved search format)--help: Show this message and exit.
Example: dfe rules create
Calls POST /api/v1/rules.
dfe rules delete
Delete Rule
Delete a detection rule.
A production+team delete is routed to a review branch, so the runner keeps
compiling the rule until that branch is merged, which X-DFE-Review-Required says.
Usage:
$ dfe rules delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe rules delete <name>
Calls DELETE /api/v1/rules/{name}.
dfe rules from-hyperdx
Create Rule From Search
Create a hunt rule from the SQL a Search view renders to.
Wraps the create pipeline with source_type='hyperdx' and auto-derives a
unique rule id from the saved-search name, so the caller need not supply one.
A view whose SQL the hunt runner could not compile, or that matches every
event, is refused with 422. RBAC: rule:write (data_analyst) --
org_viewer has neither this grant nor the UI button.
Usage:
$ dfe rules from-hyperdx [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--raw-sql <str>: The ClickHouse SELECT the Search view renders to Required.--saved-search-name <str>: Search saved-search name; seeds the rule id and label--severity <str>: low|medium|high|critical--hunt-name <str>: Parent hunt name--source <str>: Source label (e.g. windows_audit)--help: Show this message and exit.
Example: dfe rules from-hyperdx
Calls POST /api/v1/rules/from-hyperdx.
dfe rules get
Get Rule
Get a detection rule by file name.
Usage:
$ dfe rules get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe rules get <name>
Calls GET /api/v1/rules/{name}.
dfe rules list
List Rules
List detection rules with pagination and search.
Usage:
$ dfe rules list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Case-insensitive search in name, display_name, source, hunt_name, severity--severity <str>: Filter by severity--source <str>: Filter by source label--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over created_at, display_name, hunt_name, name, severity, source, each optionally followed by desc--help: Show this message and exit.
Example: dfe rules list
Calls GET /api/v1/rules.
dfe rules validate
Validate Rule Sql
Validate a detection query (SELECT ... FROM ...) without creating a rule.
Returns any syntax errors or validation issues found.
Usage:
$ dfe rules validate [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--sql <str>: Full SELECT ... FROM ... query to validate Required.--help: Show this message and exit.
Example: dfe rules validate
Calls POST /api/v1/rules/validate.
dfe sample
Usage:
$ dfe sample [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
create: Sample Adhoc
dfe sample create
Sample Adhoc
Ad-hoc sample - supply an explicit table/topic (or a source).
Usage:
$ dfe sample create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--mode <recent|random|smart|anomaly>: How to pick the sample.
recent- newest rows first (fast tail, ClickHouse ORDER BY ts DESC, Kafka reads from the partition high-watermark backwards).random- uniform-ish random rows (fair distribution, no recency bias).smart- logreducer representative/diverse sample (default). Gated.anomaly- logreducer isolation-forest outliers (the weird events). Gated.
--backend <clickhouse|kafka>: Where the data is read from.--limit <int>: Rows to return (defaults to sampler.default_limit)--source <str>: Registered source name--table <str>: Explicit ClickHouse table (overrides source's table)--topic <str>: Explicit Kafka topic (overrides source's land topic)--filter <str>: One ClickHouse condition over the sampled table's columns (ClickHouse backend only). No subquery, alias, query parameter, table function, or dictionary, Join table or file read.--since <str>: Lower time bound (ISO 8601) on the timestamp column--until <str>: Upper time bound (ISO 8601) on the timestamp column--seed <int>: Seed for random mode (determinism)--level <str>: logreducer level override: standard | enhanced | maximum--wait <float>: Seconds to block for inline completion before returning pending--help: Show this message and exit.
Example: dfe sample create
Calls POST /api/v1/sample.
dfe samples
Usage:
$ dfe samples [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Samplelist: List Samples
dfe samples get
Get Sample
Poll a sample task's status and result.
A caller held to its orgs gets 404 for a task not held to them, as for one that does not exist.
Usage:
$ dfe samples get [OPTIONS] [task_id]
Arguments:
task_id: Task Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe samples get <task-id>
Calls GET /api/v1/samples/{task_id}.
dfe samples list
List Samples
List recent sample tasks (most recent first). A caller held to its orgs sees only theirs.
Usage:
$ dfe samples list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe samples list
Calls GET /api/v1/samples.
dfe schemas
Usage:
$ dfe schemas [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
build: Build Schemaelastic-converter: Elastic Converterimport: Import Meta Schemajson-paths: Discover Json Pathslist: List Schemaspromote-field: Promote Fieldsample-rows: Sample Source Rowsvocabulary: Get Schema Vocabularycolumnsdefinitions
dfe schemas build
Build Schema
Build complete schema (DDL) from a source version snapshot.
Runs the v2 YAML -> DDL pipeline and returns the generated DDL without executing it against ClickHouse.
Usage:
$ dfe schemas build [OPTIONS] [source_name]
Arguments:
source_name: Source Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Source version id (defaults to deployed_version)--help: Show this message and exit.
Example: dfe schemas build <source-name>
Calls POST /api/v1/schemas/{source_name}/build.
dfe schemas elastic-converter
Elastic Converter
Extract meta-schema columns from an Elasticsearch index template JSON file.
Accepts Beat-style exports with template.mappings.properties or API-style
mappings.properties. Column layout follows curated YAML conventions
(snake_case name, @source: dotted expr).
Upload size is capped by api.elastic_converter_max_upload_bytes (reject with 413 and
upload_too_large when exceeded). Override with DFE_ENGINE_API_ELASTIC_CONVERTER_*.
Usage:
$ dfe schemas elastic-converter [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe schemas elastic-converter
Calls POST /api/v1/schemas/elastic-converter.
dfe schemas import
Import Meta Schema
Import a meta-schema document exported from another deployment.
A custom document is written through the schema registry. A core document names a schema dfe-schemas already put here: it is RESOLVED against the local registry at its pinned version and nothing is written, so the read-only definition is never forked.
Usage:
$ dfe schemas import [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--kind <str>: Kind--format <int>: Document format version--path <str>: Registry path (e.g. meta/cisco_ios) Required.--resource-type <core|custom>: core travels as a reference; custom travels in full--current <str>: Current version (custom schemas only)--versions <str>: Full version history (custom schemas only) JSON or YAML, or file://<path>.--reference <str>: Path and version pin (core schemas only) JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe schemas import
Calls POST /api/v1/schemas/import.
dfe schemas json-paths
Discover Json Paths
Discover JSON paths inside a source's _json column.
Resolves the requested version (or the source's current version). If that
version defines a meta_schema it uses db.<source> only after deploy;
until then discovery runs on db.<landing> filtered by the version's
match rule. Versions without meta_schema always use the landing table.
Returns one record per path with observed types, a suggested column name,
and whether the path is already promoted. ?samples=N adds random
distinct example values. ?stats=true adds coverage + distinct counts.
A caller without a platform grant holding schema:read reads only its own
orgs' rows, as the sampler holds it, and a table it cannot be held on is 403.
Usage:
$ dfe schemas json-paths [OPTIONS] [source_name]
Arguments:
source_name: Source Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--samples <int>: Random distinct example values per path--stats / --no-stats: Include coverage_pct + distinct_count (expensive, opt-in)--paths <str>: Comma-separated paths to restrict discovery + sampling--version <str>: Source version to discover against (defaults to current)--help: Show this message and exit.
Example: dfe schemas json-paths <source-name>
Calls GET /api/v1/schemas/{source_name}/json-paths.
dfe schemas list
List Schemas
List all meta schemas with optional filtering.
Usage:
$ dfe schemas list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in path--schema-type <str>: Filter by top-level schema path segment (repeat param for multiple), e.g. meta, common-header, additional, hunt-results--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over current, path, updated_at, each optionally followed by desc--help: Show this message and exit.
Example: dfe schemas list
Calls GET /api/v1/schemas.
dfe schemas promote-field
Promote Field
Promote JSON path(s) into dedicated typed columns.
Creates a new schema version on the source's meta-schema (or on schema_path
when the source has none), adding one column per path with an @source directive
naming the bare record path, which is what dfe-loader reads to fill the column on
the next ingest. Existing rows are not backfilled. Core meta-schemas are forked to
{source_name}_{schema_stem} under the same parent path before promoting.
?dry_run=true returns the proposed diff and DDL without forking core schemas,
adding meta-schema versions, or updating the source. A core source, such as the
landing source main, is refused with 409 before any schema is resolved or
written, dry run included. Its json-paths and sample-rows reads stay open.
Usage:
$ dfe schemas promote-field [OPTIONS] [source_name]
Arguments:
source_name: Source Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.-n, --dry-run: Return the proposed diff without committing--json-path <str>: JSON path (e.g. user.email) or a list of paths for batch promotion Required.--column-name <str>: Target column name (single promotion only; batch uses suggested names)--data-type <str>: DFE primitive override; auto-derived from the JSON type when omitted--use-case <str>: The question the promoted column is asked, which decides the index generated for it (dimension, exact_match, range, word_search, substring_search, key_search, similarity_search(<dims>)), or null for no index. Validated against the type registry dfe-schemas ships as registries/types.yaml, so it follows the registry rather than a list held here.--atomic / --no-atomic: When true, all paths succeed or none commit; else best-effort--schema-path <str>: Meta-schema path when the source version has no meta_schema assigned (forbidden if meta_schema is already set on the source)--help: Show this message and exit.
Example: dfe schemas promote-field <source-name>
Calls POST /api/v1/schemas/{source_name}/promote-field.
dfe schemas sample-rows
Sample Source Rows
Return random sample rows for a source, scoped to its match rule.
Resolves the requested version (or the source's current version). A
version with a meta_schema uses db.<source> only after that version
is deployed and the table exists. Otherwise rows are read from
db.<landing> filtered by the version's match rule.
Intended for inspecting real data while authoring a match condition or CEL
before promoting any JSON path -- a row-level companion to the per-path
?samples=N on /json-paths.
A caller without a platform grant holding schema:read reads only its own
orgs' rows, as the sampler holds it, and a table it cannot be held on is 403.
Usage:
$ dfe schemas sample-rows [OPTIONS] [source_name]
Arguments:
source_name: Source Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--limit <int>: Number of random rows to sample--version <str>: Source version to sample against (defaults to current)--help: Show this message and exit.
Example: dfe schemas sample-rows <source-name>
Calls GET /api/v1/schemas/{source_name}/sample-rows.
dfe schemas vocabulary
Get Schema Vocabulary
The primitives, use cases, attributes and override types a column may use.
Usage:
$ dfe schemas vocabulary [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe schemas vocabulary
Calls GET /api/v1/schemas/vocabulary.
dfe schemas columns
Usage:
$ dfe schemas columns [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Schema Columns
dfe schemas columns list
Get Schema Columns
Get composed schema columns for a source version (profile + meta/derived/additional).
Usage:
$ dfe schemas columns list [OPTIONS] [source_name]
Arguments:
source_name: Source Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--version <str>: Source version id (defaults to deployed_version)--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe schemas columns list <source-name>
Calls GET /api/v1/schemas/{source_name}/columns.
dfe schemas definitions
Usage:
$ dfe schemas definitions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
delete: Delete Meta Schemaexport: Export Meta Schemapost: Create Meta Schemaupdate: Update Meta Schemaderived-cmd: List Derived Schemasderivedversions
dfe schemas definitions delete
Delete Meta Schema
Delete a meta-schema definition by registry path.
Usage:
$ dfe schemas definitions delete [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe schemas definitions delete <schema-path>
Calls DELETE /api/v1/schemas/definitions/{schema_path}.
dfe schemas definitions export
Export Meta Schema
Export one meta schema as a document another deployment can import.
A resource_type: core schema exports as a REFERENCE -- its path and the
version it was read at -- and never as a copy of its columns: dfe-schemas ships
and updates those definitions, so an embedded copy would fork the read-only
schema on every import.
Usage:
$ dfe schemas definitions export [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Single version to export. Omitted exports the whole history of a custom schema, and pins a core one at its current version.--help: Show this message and exit.
Example: dfe schemas definitions export <schema-path>
Calls GET /api/v1/schemas/definitions/{schema_path}/export.
dfe schemas definitions post
Create Meta Schema
Create a new meta-schema at the given registry path (parent path + schema name).
Usage:
$ dfe schemas definitions post [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--current <str>: Current version of the schema Required.--versions <str>: JSON or YAML, or file://<path>. Required.--path <str>: DirectoryConfigStore table key / relative path (must match URL when set)--help: Show this message and exit.
Example: dfe schemas definitions post <schema-path>
Calls POST /api/v1/schemas/definitions/{schema_path}.
dfe schemas definitions update
Update Meta Schema
Update meta-schema metadata: current pointer or a version summary.
Usage:
$ dfe schemas definitions update [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Version to update summary for (required when summary is set)--current <str>: Set the schema's current version pointer--summary <str>: Update summary on the version selected via query parameter--help: Show this message and exit.
Example: dfe schemas definitions update <schema-path>
Calls PATCH /api/v1/schemas/definitions/{schema_path}.
dfe schemas definitions derived-cmd
List Derived Schemas
List every stored derived schema.
Usage:
$ dfe schemas definitions derived-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in path and base--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over base, current, path, updated_at, each optionally followed by desc--help: Show this message and exit.
Example: dfe schemas definitions derived
Calls GET /api/v1/schemas/definitions/derived.
dfe schemas definitions derived
Usage:
$ dfe schemas definitions derived [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Derived Schemadelete: Delete Derived Schemaget: Get Derived Schemapost: Create Derived Schema
dfe schemas definitions derived apply
Update Derived Schema
Replace a derived schema. The body is the whole document, as on create.
Usage:
$ dfe schemas definitions derived apply [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--path <str>: Registry path (derived/<group>/<name>); must match the URL when set--base <str>: Meta-schema registry path, extensionless (e.g. meta/beats/filebeat) Required.--base-version <str>: Version of the base meta schema Required.--current <str>: Version of this derived schema to make current Required.--versions <str>: Version id -> selection JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe schemas definitions derived apply <schema-path>
Calls PUT /api/v1/schemas/definitions/derived/{schema_path}.
dfe schemas definitions derived delete
Delete Derived Schema
Delete a derived schema by registry path.
Usage:
$ dfe schemas definitions derived delete [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe schemas definitions derived delete <schema-path>
Calls DELETE /api/v1/schemas/definitions/derived/{schema_path}.
dfe schemas definitions derived get
Get Derived Schema
Read one derived schema by registry path (e.g. beats/filebeat_auth).
Usage:
$ dfe schemas definitions derived get [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe schemas definitions derived get <schema-path>
Calls GET /api/v1/schemas/definitions/derived/{schema_path}.
dfe schemas definitions derived post
Create Derived Schema
Create a derived schema at the given registry path.
Usage:
$ dfe schemas definitions derived post [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--path <str>: Registry path (derived/<group>/<name>); must match the URL when set--base <str>: Meta-schema registry path, extensionless (e.g. meta/beats/filebeat) Required.--base-version <str>: Version of the base meta schema Required.--current <str>: Version of this derived schema to make current Required.--versions <str>: Version id -> selection JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe schemas definitions derived post <schema-path>
Calls POST /api/v1/schemas/definitions/derived/{schema_path}.
dfe schemas definitions versions
Usage:
$ dfe schemas definitions versions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
columns: Get Meta Schemacreate: Add Meta Schema Versiondelete: Delete Meta Schema Version
dfe schemas definitions versions columns
Get Meta Schema
Get one meta-schema definition by registry path (e.g. aws/cloudtrail).
items is a page of the selected version's columns, after search and filters.
Usage:
$ dfe schemas definitions versions columns [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--version <str>: Schema version to return (required) Required.--search <str>: Case-insensitive substring search across all column fields--name <str>: Filter by name (substring)--type <str>: Filter by type (substring)--use-case <str>: Filter by use_case (substring)--expr <str>: Filter by expr (substring)--comment <str>: Filter by comment (substring)--attribute <str>: Filter by attribute (substring)--searchable-columns <str>: Fields to applysearchagainst (name, type, type_filter, use_case, expr, comment, attribute). Defaults to all column fields.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe schemas definitions versions columns <schema-path> --version <version>
Calls GET /api/v1/schemas/definitions/{schema_path}/versions/columns.
dfe schemas definitions versions create
Add Meta Schema Version
Add a new meta-schema version (bumps semver from current and sets it current).
Usage:
$ dfe schemas definitions versions create [OPTIONS] [schema_path]
Arguments:
schema_path: Schema Path Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--type <model|addition|revision>: Change category (semver bump from current) Required.--summary <str>: Human-readable summary stored on the new version--columns <str>: JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe schemas definitions versions create <schema-path>
Calls POST /api/v1/schemas/definitions/{schema_path}/versions.
dfe schemas definitions versions delete
Delete Meta Schema Version
Delete a specific meta-schema version.
Core schemas are blocked by the core-resource guard (HTTP 409). The last remaining version cannot be deleted -- delete the schema instead.
Usage:
$ dfe schemas definitions versions delete [OPTIONS] [schema_path] [version]
Arguments:
schema_path: Schema Path Required.version: Version Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe schemas definitions versions delete <schema-path> <version>
Calls DELETE /api/v1/schemas/definitions/{schema_path}/versions/{version}.
dfe scim
Usage:
$ dfe scim [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
v2
dfe scim v2
Usage:
$ dfe scim v2 [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
groupsresource-typesschemasservice-provider-configusers
dfe scim v2 groups
Usage:
$ dfe scim v2 groups [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Replace Groupcreate: Create Groupdelete: Delete Groupget: Get Grouplist: List Groupsupdate: Patch Group
dfe scim v2 groups apply
Replace Group
Replace a group's member set (SCIM PUT).
Usage:
$ dfe scim v2 groups apply [OPTIONS] [group_id]
Arguments:
group_id: Group Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 groups apply <group-id>
Calls PUT /api/v1/scim/v2/Groups/{group_id}.
dfe scim v2 groups create
Create Group
Provision a group with its member set (member Account.groups kept in sync).
Usage:
$ dfe scim v2 groups create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 groups create
Calls POST /api/v1/scim/v2/Groups.
dfe scim v2 groups delete
Delete Group
Delete a group. Members are detached first so the store permits removal.
Usage:
$ dfe scim v2 groups delete [OPTIONS] [group_id]
Arguments:
group_id: Group Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 groups delete <group-id>
Calls DELETE /api/v1/scim/v2/Groups/{group_id}.
dfe scim v2 groups get
Get Group
Fetch a single group by id (name).
Usage:
$ dfe scim v2 groups get [OPTIONS] [group_id]
Arguments:
group_id: Group Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 groups get <group-id>
Calls GET /api/v1/scim/v2/Groups/{group_id}.
dfe scim v2 groups list
List Groups
List groups (SCIM ListResponse). Supports displayName eq, id eq + paging.
id eq may add and members[value eq], which lists the group only for a member.
Usage:
$ dfe scim v2 groups list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 groups list
Calls GET /api/v1/scim/v2/Groups.
dfe scim v2 groups update
Patch Group
Apply a PatchOp on group membership (add/remove/replace members).
Usage:
$ dfe scim v2 groups update [OPTIONS] [group_id]
Arguments:
group_id: Group Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 groups update <group-id>
Calls PATCH /api/v1/scim/v2/Groups/{group_id}.
dfe scim v2 resource-types
Usage:
$ dfe scim v2 resource-types [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Resource Types
dfe scim v2 resource-types list
Resource Types
Advertise the User and Group resource types.
Usage:
$ dfe scim v2 resource-types list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 resource-types list
Calls GET /api/v1/scim/v2/ResourceTypes.
dfe scim v2 schemas
Usage:
$ dfe scim v2 schemas [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Schemas
dfe scim v2 schemas list
Schemas
Advertise the User and Group core schemas (generated from scim2-models).
Usage:
$ dfe scim v2 schemas list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 schemas list
Calls GET /api/v1/scim/v2/Schemas.
dfe scim v2 service-provider-config
Usage:
$ dfe scim v2 service-provider-config [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Service Provider Config
dfe scim v2 service-provider-config list
Service Provider Config
Static SCIM capability advertisement (RFC 7643 s5).
Usage:
$ dfe scim v2 service-provider-config list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 service-provider-config list
Calls GET /api/v1/scim/v2/ServiceProviderConfig.
dfe scim v2 users
Usage:
$ dfe scim v2 users [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Replace Usercreate: Create Userdelete: Delete Userget: Get Userlist: List Usersupdate: Patch User
dfe scim v2 users apply
Replace User
Replace a user's writable attributes (SCIM PUT).
Usage:
$ dfe scim v2 users apply [OPTIONS] [user_id]
Arguments:
user_id: User Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 users apply <user-id>
Calls PUT /api/v1/scim/v2/Users/{user_id}.
dfe scim v2 users create
Create User
Provision a user. IdP-owned. Local password is randomised when omitted.
A password the IdP does send is held to the same length floor as every other password the API sets, and one under it is refused rather than replaced.
Usage:
$ dfe scim v2 users create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 users create
Calls POST /api/v1/scim/v2/Users.
dfe scim v2 users delete
Delete User
Delete a user (SCIM 204).
Usage:
$ dfe scim v2 users delete [OPTIONS] [user_id]
Arguments:
user_id: User Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 users delete <user-id>
Calls DELETE /api/v1/scim/v2/Users/{user_id}.
dfe scim v2 users get
Get User
Fetch a single user by id (username).
Usage:
$ dfe scim v2 users get [OPTIONS] [user_id]
Arguments:
user_id: User Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 users get <user-id>
Calls GET /api/v1/scim/v2/Users/{user_id}.
dfe scim v2 users list
List Users
List users (SCIM ListResponse). Supports userName eq, externalId eq + paging.
Usage:
$ dfe scim v2 users list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 users list
Calls GET /api/v1/scim/v2/Users.
dfe scim v2 users update
Patch User
Apply a PatchOp - primarily the active toggle IdPs use to deprovision.
Usage:
$ dfe scim v2 users update [OPTIONS] [user_id]
Arguments:
user_id: User Id Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe scim v2 users update <user-id>
Calls PATCH /api/v1/scim/v2/Users/{user_id}.
dfe services
Usage:
$ dfe services [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Save Service Configdelete: Delete Service Configget: Get Service Configlist: List Service Configsseed: Seed Service Configsvalidate: Validate Service Config
dfe services apply
Save Service Config
Create or update a service config.
Each top-level section in the body replaces the stored one, and a section the
body leaves out is kept as stored, so a form that sends some sections cannot
drop the rest and the secrets in them. A section written as null is removed.
A read shows every set secret masked, so a masked value written back keeps the
secret stored there, matched as the app surface matches one. A mask with nothing
stored behind it, or in a list entry that cannot be told apart, is a 400
masked_value and nothing is saved. A changed field beside a masked secret,
in the same mapping or with the secret one mapping down, is a 400
credential_reentry_required: the secret is typed again. A value the app's
contract refuses is a 422 invalid_config.
Usage:
$ dfe services apply [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe services apply <service> <instance>
Calls PUT /api/v1/services/{service}/{instance}.
dfe services delete
Delete Service Config
Delete a service config.
Usage:
$ dfe services delete [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe services delete <service> <instance>
Calls DELETE /api/v1/services/{service}/{instance}.
dfe services get
Get Service Config
A service config as its instance runs it, every credential masked.
The stored keys over the app's own defaults, read from its mounted contract. With no contract mounted only the stored keys are shown.
Usage:
$ dfe services get [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe services get <service> <instance>
Calls GET /api/v1/services/{service}/{instance}.
dfe services list
List Service Configs
List service configs with optional filtering.
Usage:
$ dfe services list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--service <str>: Filter by service type--search <str>: Search in service/instance names--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over instance, service, updated_at, each optionally followed by desc--help: Show this message and exit.
Example: dfe services list
Calls GET /api/v1/services.
dfe services seed
Seed Service Configs
Seed built-in default service configs. Non-destructive.
Usage:
$ dfe services seed [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe services seed
Calls POST /api/v1/services/seed.
dfe services validate
Validate Service Config
Dry-run validate a service config without saving.
Usage:
$ dfe services validate [OPTIONS] [service] [instance]
Arguments:
service: Service Required.instance: Instance Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe services validate <service> <instance>
Calls POST /api/v1/services/{service}/{instance}/validate.
dfe sources
Usage:
$ dfe sources [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Update Sourcebuild: Build Source Schemabulk: Bulk Actioncatalogue: List Cataloguecatalogue-tags: List Catalogue Tagscreate: Create Sourcedelete: Delete Sourcedeploy: Deploy Source Schemaengines: List Table Enginesexport: Export Sourceflow: Get Source Flowfrom-catalogue: Create Sources From Catalogueget: Get Sourceimport: Import Sourcelag: Get External Laglist: List Sourcesplan: Plan Source Deployreconcile-apps: Reconcile Appssample: Sample Sourceseed: Seed Sourcessignals: Get Source Signalsupdate: Patch Source Enabledcolumnsversions
dfe sources apply
Update Source
Update a source from a flat revision body.
Before the first deploy, edits update the working version in place. After deploy, a new
major version is created only when current equals deployed_version and a
table-shaping field changes: schema pins (meta_schema, meta_schema_version,
derived_schema, additional_fields), ttl_days, engine, common-header
type/version, views, or transform. Draft versions (current not deployed)
update in place.
Origin (receiver vs fetcher) cannot change, and a pinned meta_schema cannot be
cleared: once a source owns its own table it cannot move back onto main.
A field the body omits keeps its stored value (header, schema, views,
transform, transport, archive, aliases, compat_profiles), and
null, [] or false clears it. compat_profiles: null returns the source
to the deployment's profiles.
A schema pin naming nothing is accepted here so a source can be written before
its schema, while /sources/import refuses one because an exported bundle
brings every schema it pins.
Usage:
$ dfe sources apply [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source <str>: Source name (_source label); required on create--display-name <str>: Human-readable display name--description <str>: Source description--enabled / --no-enabled: Compat boolean lifecycle (True -> active, False -> disabled);statewins when both are sent--state <active|dormant|disabled>: Tri-state lifecycle (active | dormant | disabled); overridesenabled--match <str>: Receiver match rule. One of match, when or fetcher is set JSON or YAML, or file://<path>.--when <str>: A CEL Fast condition the receiver tests each record with, in place of match. It is checked at save under the profile the receiver compiles it with--aliases <str>: Per compatibility profile, the values its lookup rows map to this source, e.g. the DFE 2.x categories under dfe-legacy-2x. Read only while the source binds that profile JSON or YAML, or file://<path>.--compat-profiles <str>: The compatibility profiles bound to this source. Unset takes the deployment's list, and an empty list binds none JSON or YAML, or file://<path>.--header <str>: Common schema header configuration for this revision JSON or YAML, or file://<path>.--schema <str>: Schema configuration for this revision JSON or YAML, or file://<path>.--transform <str>: Transform stage (optional, top-level) JSON or YAML, or file://<path>.--fetcher <str>: Fetcher-based origin. One of match, when, fetcher or external is set JSON or YAML, or file://<path>.--external <str>: External origin: the customer's own pipeline writes the landing topic. One of match, when, fetcher or external is set JSON or YAML, or file://<path>.--transport <bus|direct>: bus or direct; null takes the deployment default--archive / --no-archive: Keep the raw record as it arrived, on either transport--from-catalogue-item <str>: Catalogue entry this source was created from; absent when written by hand--from-catalogue-intake <beats|receiver|fetcher>: Intake selected for that catalogue entry: beats, receiver or fetcher--views <str>: Naming-standard views for this revision (sigma, ecs, cim, ocsf) JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe sources apply <name>
Calls PUT /api/v1/sources/{name}.
dfe sources build
Build Source Schema
Build complete schema (DDL) from a source version snapshot.
Runs the v2 YAML -> DDL pipeline and returns the generated DDL without executing it against ClickHouse.
Usage:
$ dfe sources build [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Source version id (defaults to deployed_version)--help: Show this message and exit.
Example: dfe sources build <name>
Calls POST /api/v1/sources/{name}/build.
dfe sources bulk
Bulk Action
Perform a bulk action on multiple sources.
enable / disable / dormant / delete apply immediately.
deploy submits one source:deploy background task per accepted source
(poll GET /operations/{operation}). Refused names land in failed.
An action that applies immediately reports the one reconcile it ends with, as a single-source write does.
Usage:
$ dfe sources bulk [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--action <str>: Action: enable, disable, dormant, delete, deploy Required.--sources <str>: Sources to act on. Plain name strings are accepted. JSON or YAML, or file://<path>. Required.--dry-run / --no-dry-run: Deploy only: plan/validate DDL without applying it. Ignored otherwise.--help: Show this message and exit.
Example: dfe sources bulk
Calls POST /api/v1/sources/bulk.
dfe sources catalogue
List Catalogue
List the sources the installed dfe-schemas catalogue ships ready to create.
tags keeps an entry whose holding directory is one of the names given.
untagged is a file that sits in the catalogue root, and omitting tags
lists every entry. engine keeps an entry whose transform engine is that
one, without regard to case, and an engine no entry uses lists nothing. An
entry already stored as a source is left out unless include_stored is set,
matched on the catalogue entry name even when the source was given a different
one. A source written by hand does not hide an entry. Each entry says whether
the deployed transform ships its default variant, read off that app's mounted
contract, so a console can hold back an entry the create would refuse. It also
says whether this deployment can run the entry at all: a source that needs a
per-source app (a fetcher or a transform) is refused on a gRPC deployment.
Usage:
$ dfe sources catalogue [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--intake <str>: Only entries that arrive this way (beats, receiver, fetcher)--search <str>: Search the entry name, package and data stream--tags <str>: Only entries in one of these holding directories. Repeat the param for more than one. untagged is the files that sit in the catalogue root. Omit it to list the whole catalogue--engine <str>: Only entries whose transform engine is this one, matched without regard to case. An engine no entry uses lists nothing. Omit it to list every engine--include-stored / --no-include-stored: List entries already stored as a source too. Off by default, so the create-from-catalogue page offers only what is left to create--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe sources catalogue
Calls GET /api/v1/sources/catalogue.
dfe sources catalogue-tags
List Catalogue Tags
List the directories under the catalogue that hold source files.
A tag is one directory directly under catalogue/. Files that sit in the
catalogue root, rather than in one of those directories, are the tag
untagged. id is the directory key. name and description come
from registries/catalogue-tags.yaml beside that catalogue. name keeps
a tag whose key or display name starts with it, so act matches
active-mq and does not match a name that only contains those letters later.
Usage:
$ dfe sources catalogue-tags [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--name <str>: Keep tags whose directory key or display name starts with this. The match ignores case--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe sources catalogue-tags
Calls GET /api/v1/sources/catalogue-tags.
dfe sources create
Create Source
Create a new source from a flat source definition (initial version 1.0.0).
header is optional: when omitted, no common-header profile is stored on the
version (DDL compose uses meta/derived columns only until a header is set).
A schema pin naming nothing is accepted here so a source can be written before
its schema, while /sources/import refuses one because an exported bundle
brings every schema it pins.
201 when the apps follow the new source, 202 when the source is stored and the
reconcile that brings the apps into step with it did not complete, or when
production+team sent it to review (review_required).
Usage:
$ dfe sources create [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--source <str>: Source name (_source label); required on create--display-name <str>: Human-readable display name--description <str>: Source description--enabled / --no-enabled: Compat boolean lifecycle (True -> active, False -> disabled);statewins when both are sent--state <active|dormant|disabled>: Tri-state lifecycle (active | dormant | disabled); overridesenabled--match <str>: Receiver match rule. One of match, when or fetcher is set JSON or YAML, or file://<path>.--when <str>: A CEL Fast condition the receiver tests each record with, in place of match. It is checked at save under the profile the receiver compiles it with--aliases <str>: Per compatibility profile, the values its lookup rows map to this source, e.g. the DFE 2.x categories under dfe-legacy-2x. Read only while the source binds that profile JSON or YAML, or file://<path>.--compat-profiles <str>: The compatibility profiles bound to this source. Unset takes the deployment's list, and an empty list binds none JSON or YAML, or file://<path>.--header <str>: Common schema header configuration for this revision JSON or YAML, or file://<path>.--schema <str>: Schema configuration for this revision JSON or YAML, or file://<path>.--transform <str>: Transform stage (optional, top-level) JSON or YAML, or file://<path>.--fetcher <str>: Fetcher-based origin. One of match, when, fetcher or external is set JSON or YAML, or file://<path>.--external <str>: External origin: the customer's own pipeline writes the landing topic. One of match, when, fetcher or external is set JSON or YAML, or file://<path>.--transport <bus|direct>: bus or direct; null takes the deployment default--archive / --no-archive: Keep the raw record as it arrived, on either transport--from-catalogue-item <str>: Catalogue entry this source was created from; absent when written by hand--from-catalogue-intake <beats|receiver|fetcher>: Intake selected for that catalogue entry: beats, receiver or fetcher--views <str>: Naming-standard views for this revision (sigma, ecs, cim, ocsf) JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe sources create
Calls POST /api/v1/sources.
dfe sources delete
Delete Source
Delete a source by name. Its fetcher instance, receiver rule and topics go with it.
An engine-owned source -- the landing table's own -- is refused with 409
conflict, the same answer PUT and PATCH give.
The answer reports the reconcile as a create or an update does: on a
deployment that renders the app config itself, restart_required names the
command that takes away the containers the source's instances ran in.
A delete production+team sends to review answers review_required and
touches nothing else: main still carries the source, so its topics, records and
Search source stay until the branch is merged.
Usage:
$ dfe sources delete [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources delete <name>
Calls DELETE /api/v1/sources/{name}.
dfe sources deploy
Deploy Source Schema
Plan (dry_run=true) or deploy a source version's schema to ClickHouse.
Runs the v2 YAML -> DDL pipeline. In plan mode the CREATE TABLE (+ any standard views) and validation errors are returned for review WITHOUT touching ClickHouse. In deploy mode the DDL is applied: an absent table is created, and an existing one gains the columns it lacks and moves to the version's TTL, so a re-deploy changes only what differs. The engine and the type of an existing column are left as created. A schema that failed validation is never deployed. A source on the bus transport whose Kafka topics the broker did not create is not marked deployed either, and the call answers 502 naming each topic.
Usage:
$ dfe sources deploy [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Source version id (defaults to the source's current version)-n, --dry-run: Plan only: generate + validate the DDL without applying it--help: Show this message and exit.
Example: dfe sources deploy <name>
Calls POST /api/v1/sources/{name}/deploy.
dfe sources engines
List Table Engines
List the table engines a source may select, from dfe-schemas registries/engines.yaml.
Usage:
$ dfe sources engines [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe sources engines
Calls GET /api/v1/sources/engines.
dfe sources export
Export Source
Export one source version as a bundle another deployment can import.
The bundle carries the version's routing, schema and transform, each only
where the source declares it, plus one document per meta schema the schema
pins name. A pinned schema with resource_type: core travels as a
REFERENCE and a version pin rather than a copy of its columns, so importing
the bundle cannot fork the read-only definition dfe-schemas ships.
Usage:
$ dfe sources export [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Version id to export; omitted takes the source's current--help: Show this message and exit.
Example: dfe sources export <name>
Calls GET /api/v1/sources/{name}/export.
dfe sources flow
Get Source Flow
The stages this source's records travel, resolved against this deployment.
The console draws the flow from this rather than from the source's fields, for the same reason the compilers write from it: the topics, the endpoints and the instance running each stage follow from the source plus the deployment, and one resolver is what keeps the drawing and the deployed config the same answer.
Usage:
$ dfe sources flow [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources flow <name>
Calls GET /api/v1/sources/{name}/flow.
dfe sources from-catalogue
Create Sources From Catalogue
Create a source for each catalogue entry, on the intake it arrives by.
Each entry's file is the write body for its default intake, and another intake swaps in the match rule that intake derives. A variant the deployed transform's contract does not list is refused for that entry, and one whose contract is not mounted is allowed. The source records the catalogue entry and the intake that was selected, and a later edit leaves both in place.
At most 50 entries. A longer or empty selection is refused before anything is
stored, as {code, message}. Entries are stored in the order given. One
entry's refusal is recorded in failed and the rest continue. The response
is 200 when any entry was refused for a reason other than a conflict, including
when nothing was stored. Nothing stored is 409 when every refusal is a conflict
or a missing variant. The apps are reconciled once, after the entries that
could be stored.
Usage:
$ dfe sources from-catalogue [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--entries <str>: Entries to create, in the order given. At most 50. JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe sources from-catalogue
Calls POST /api/v1/sources/from-catalogue.
dfe sources get
Get Source
Get a full source definition by name, including build/deploy per version.
Usage:
$ dfe sources get [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources get <name>
Calls GET /api/v1/sources/{name}.
dfe sources import
Import Source
Import a source bundle exported from another deployment.
The bundle's meta-schema definitions are written first, then the source, both
through their registries. A definition marked resource_type: core is
resolved against what dfe-schemas already put here and never written, so the
read-only schema is not forked.
Every check runs before the first write: a bundle applied halfway would leave
the source's schema pins with no definitions behind them. A schema pin, or a
version it pins, that neither the bundle nor this deployment defines is a 422
unresolved_reference.
Usage:
$ dfe sources import [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--kind <str>: Kind--format <int>: Document format version--source <str>: The _source label Required.--resource-type <core|custom>: core travels as a reference; custom travels in full--reference <str>: Name and version pin (core sources only) JSON or YAML, or file://<path>.--version <str>: Version id of the snapshot this bundle carries--date-time <str>: Creation date of the exported snapshot; absent takes the import date--display-name <str>: Human-readable display name--description <str>: Source description--state <active|dormant|disabled>: Lifecycle state--routing <str>: Receiver match rule (receiver-based sources) JSON or YAML, or file://<path>.--when <str>: CEL Fast condition the receiver tests records with, in place of routing--aliases <str>: Per compatibility profile, the values its lookup rows map to this source JSON or YAML, or file://<path>.--compat-profiles <str>: The compatibility profiles the source binds. Absent takes the deployment's JSON or YAML, or file://<path>.--fetcher <str>: Fetcher origin (fetcher-based sources) JSON or YAML, or file://<path>.--schema <str>: Schema pins, header and the definitions they name JSON or YAML, or file://<path>.--transform <str>: Transform stage, when the version declares one JSON or YAML, or file://<path>.--transport <bus|direct>: bus or direct; absent takes the importing deployment's default--archive / --no-archive: Keep the record as it arrived--views <str>: Naming-standard views the version exposes JSON or YAML, or file://<path>.--help: Show this message and exit.
Example: dfe sources import
Calls POST /api/v1/sources/import.
dfe sources lag
Get External Lag
How far the customer's own transform is behind on this source's landing topic.
Read from the broker on each call. A broker that cannot be reached answers 200 with nulls and the reason, because "no lag" and "could not look" call for opposite reactions.
Usage:
$ dfe sources lag [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources lag <name>
Calls GET /api/v1/sources/{name}/lag.
dfe sources list
List Sources
List sources with pagination, search, filtering, and a full object tree.
The landing source (main) is always the first item when it is in the
result set. Remaining sources keep the requested sort. A caller held to its
orgs does not see a fetcher source bound to another org.
Usage:
$ dfe sources list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in source name and description--enabled / --no-enabled: Filter by enabled status--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--order-by <str>: Ordering over current, deployed_version, display_name, enabled, source, updated_at, each optionally followed by desc--help: Show this message and exit.
Example: dfe sources list
Calls GET /api/v1/sources.
dfe sources plan
Plan Source Deploy
Dry-run ClickHouse deploy: DDL statements and validation errors (not persisted).
Usage:
$ dfe sources plan [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--version <str>: Source version id (defaults to current working version)--help: Show this message and exit.
Example: dfe sources plan <name>
Calls POST /api/v1/sources/{name}/plan.
dfe sources reconcile-apps
Reconcile Apps
Bring the deploy repo's derived app state into step with the sources.
Recompiles every stack-scoped routing block (receiver, loader, archiver) and
deploys, syncs or removes the instances of every instance-scoped app (a fetcher
per active fetcher-based source). Every source write does this on its own. This
route is the retry when one reported apps_sync_error, and the pass that
deletes a stranded _load topic a deploy reported in topics_pending_removal.
Usage:
$ dfe sources reconcile-apps [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources reconcile-apps
Calls POST /api/v1/sources/reconcile-apps.
dfe sources sample
Sample Source
Sample a registered source. The path source wins over any in the body.
Usage:
$ dfe sources sample [OPTIONS] [source]
Arguments:
source: Source Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--mode <recent|random|smart|anomaly>: How to pick the sample.
recent- newest rows first (fast tail, ClickHouse ORDER BY ts DESC, Kafka reads from the partition high-watermark backwards).random- uniform-ish random rows (fair distribution, no recency bias).smart- logreducer representative/diverse sample (default). Gated.anomaly- logreducer isolation-forest outliers (the weird events). Gated.
--backend <clickhouse|kafka>: Where the data is read from.--limit <int>: Rows to return (defaults to sampler.default_limit)--body-source <str>: Registered source name--table <str>: Explicit ClickHouse table (overrides source's table)--topic <str>: Explicit Kafka topic (overrides source's land topic)--filter <str>: One ClickHouse condition over the sampled table's columns (ClickHouse backend only). No subquery, alias, query parameter, table function, or dictionary, Join table or file read.--since <str>: Lower time bound (ISO 8601) on the timestamp column--until <str>: Upper time bound (ISO 8601) on the timestamp column--seed <int>: Seed for random mode (determinism)--level <str>: logreducer level override: standard | enhanced | maximum--wait <float>: Seconds to block for inline completion before returning pending--help: Show this message and exit.
Example: dfe sources sample <source>
Calls POST /api/v1/sources/{source}/sample.
dfe sources seed
Seed Sources
Seed built-in default source definitions. Non-destructive (skips existing).
Usage:
$ dfe sources seed [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources seed
Calls POST /api/v1/sources/seed.
dfe sources signals
Get Source Signals
Whether this source's records are arriving, and how fast.
Reads the loader's per-table counter out of the otel tables over a bounded five-minute window, so the console can put a number beside a source without the operator opening Search. It answers 200 with nulls where the series is absent: a source that was only just defined has nothing to report, and that is not an error.
Usage:
$ dfe sources signals [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources signals <name>
Calls GET /api/v1/sources/{name}/signals.
dfe sources update
Patch Source Enabled
Set a source's lifecycle state without changing versioned configuration.
Does not create a new source version. Activating may return 409 match_conflict if another non-disabled source already uses the same
receiver match rule.
Usage:
$ dfe sources update [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--enabled / --no-enabled: Compat boolean lifecycle (True -> active, False -> disabled)--state <active|dormant|disabled>: Tri-state lifecycle (active | dormant | disabled); wins over enabled--help: Show this message and exit.
Example: dfe sources update <name>
Calls PATCH /api/v1/sources/{name}.
dfe sources columns
Usage:
$ dfe sources columns [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Source Schema Columns
dfe sources columns list
Get Source Schema Columns
Get composed schema columns for a source version (profile + meta/derived/additional).
Usage:
$ dfe sources columns list [OPTIONS] [name]
Arguments:
name: Name Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--version <str>: Source version id (defaults to deployed_version)--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe sources columns list <name>
Calls GET /api/v1/sources/{name}/columns.
dfe sources versions
Usage:
$ dfe sources versions [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Source Version
dfe sources versions get
Get Source Version
Get one immutable source version snapshot by id, with build/deploy status.
Usage:
$ dfe sources versions get [OPTIONS] [name] [version]
Arguments:
name: Name Required.version: Version Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe sources versions get <name> <version>
Calls GET /api/v1/sources/{name}/versions/{version}.
dfe synthetic-data
Usage:
$ dfe synthetic-data [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
generate: Generatelookalike: Lookalikepacks: List Packsstream: Start Streamstreams-cmd: List Streamsstreams
dfe synthetic-data generate
Generate
Generate a bounded batch of synthetic events inline.
Sync handler by design: a ceiling-sized batch is pure CPU, so FastAPI's threadpool keeps the event loop responsive while it renders.
Usage:
$ dfe synthetic-data generate [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--schema <str>: Schema ref (e.g. meta/syslog) or path under the schemas root Required.--version <str>: Schema version (default: current)--count <int>: Events to generate (capped by settings)--seed <int>: Determinism seed--rate-eps <float>: Timestamp spacing rate (events/second)--tags <str>: Extra tags merged into events (refused for a pack whose tags is a keyword list) JSON or YAML, or file://<path>.--mark-synthetic / --no-mark-synthetic: Mark events synthetic: tags.synthetic=true for an object tags, or a 'synthetic' keyword in the list for an ECS keyword-array tags--help: Show this message and exit.
Example: dfe synthetic-data generate
Calls POST /api/v1/synthetic-data/generate.
dfe synthetic-data lookalike
Lookalike
Generate a lookalike batch from a supplied sample (identities scrubbed).
Usage:
$ dfe synthetic-data lookalike [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--rows <str>: Parsed sample events (preferred input) JSON or YAML, or file://<path>.--lines <str>: Raw sample lines (used when rows is empty)--count <int>: Events to generate (capped by settings)--seed <int>: Determinism seed--rate-eps <float>: Timestamp spacing rate (events/second)--tags <str>: Extra tags merged into events (refused for a pack whose tags is a keyword list) JSON or YAML, or file://<path>.--mark-synthetic / --no-mark-synthetic: Mark events synthetic: tags.synthetic=true for an object tags, or a 'synthetic' keyword in the list for an ECS keyword-array tags--help: Show this message and exit.
Example: dfe synthetic-data lookalike
Calls POST /api/v1/synthetic-data/lookalike.
dfe synthetic-data packs
List Packs
List schema packs the generator can drive.
Usage:
$ dfe synthetic-data packs [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe synthetic-data packs
Calls GET /api/v1/synthetic-data/packs.
dfe synthetic-data stream
Start Stream
Start a stream task that posts generated events to an ingest URL.
Usage:
$ dfe synthetic-data stream [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--schema <str>: Schema ref (e.g. meta/syslog) or path under the schemas root Required.--version <str>: Schema version (default: current)--seed <int>: Determinism seed--rate-eps <float>: Events/second (Poisson; capped by settings)--count <int>: Stop after this many events--duration-s <float>: Stop after this many seconds (capped by settings)--receiver-url <str>: Ingest URL to POST events to (dfe-receiver) Required.--headers <str>: Extra request headers (e.g. receiver auth) JSON or YAML, or file://<path>.--ndjson / --no-ndjson: POST batches as NDJSON instead of JSON--batch-max <int>: Events per POST--tags <str>: Extra tags merged into events (refused for a pack whose tags is a keyword list) JSON or YAML, or file://<path>.--mark-synthetic / --no-mark-synthetic: Mark events synthetic: tags.synthetic=true for an object tags, or a 'synthetic' keyword in the list for an ECS keyword-array tags--wait <float>: Seconds to block for inline completion before returning--help: Show this message and exit.
Example: dfe synthetic-data stream
Calls POST /api/v1/synthetic-data/stream.
dfe synthetic-data streams-cmd
List Streams
List stream operations (most recent first).
Usage:
$ dfe synthetic-data streams-cmd [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe synthetic-data streams
Calls GET /api/v1/synthetic-data/streams.
dfe synthetic-data streams
Usage:
$ dfe synthetic-data streams [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
cancel: Cancel Streamget: Get Stream
dfe synthetic-data streams cancel
Cancel Stream
Cancel a stream, under the same action that starts it.
Usage:
$ dfe synthetic-data streams cancel [OPTIONS] [operation]
Arguments:
operation: Operation Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe synthetic-data streams cancel <operation>
Calls POST /api/v1/synthetic-data/streams/{operation}/cancel.
dfe synthetic-data streams get
Get Stream
Poll a stream, under the same action that lists it.
Usage:
$ dfe synthetic-data streams get [OPTIONS] [operation]
Arguments:
operation: Operation Required.
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe synthetic-data streams get <operation>
Calls GET /api/v1/synthetic-data/streams/{operation}.
dfe system
Usage:
$ dfe system [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
schema: Get Schema Statussettings: Get Settingsstatus: Get System Statusversion: Get Versionclickhouse-clouddefaultsdeploymentretention
dfe system schema
Get Schema Status
What the last schema bootstrap pass did, object by object.
This is the operator's record of the schema apply, replacing the completed
ArgoCD Job the engine took over from. state is what readiness follows:
converged is ready, failed leaves the pod up and NotReady with the stage that
failed here and the cause in the engine log, and observed -- another applier
held the lease for the whole wait -- stays NotReady until a later pass converges.
Usage:
$ dfe system schema [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system schema
Calls GET /api/v1/system/schema.
dfe system settings
Get Settings
Get a redacted summary of current settings. No secrets exposed.
Usage:
$ dfe system settings [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system settings
Calls GET /api/v1/system/settings.
dfe system status
Get System Status
Conditions that leave the engine degraded while it keeps serving.
A refused YAML write keeps the old file or the old deploy-repo content, so reads stay correct and readiness is not failed. This is where the refusal shows.
Usage:
$ dfe system status [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system status
Calls GET /api/v1/system/status.
dfe system version
Get Version
What this deployment runs.
Authenticated but ungated on purpose: the console footer is on every page, and the body carries versions only.
Usage:
$ dfe system version [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system version
Calls GET /api/v1/system/version.
dfe system clickhouse-cloud
Usage:
$ dfe system clickhouse-cloud [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Clickhouse Cloud Statusstart: Clickhouse Cloud Startstop: Clickhouse Cloud Stop
dfe system clickhouse-cloud list
Clickhouse Cloud Status
CH Cloud service control-plane status (read-only).
Usage:
$ dfe system clickhouse-cloud list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system clickhouse-cloud list
Calls GET /api/v1/system/clickhouse-cloud.
dfe system clickhouse-cloud start
Clickhouse Cloud Start
Start (wake) the CH Cloud service. BILLABLE + admin-gated + audited.
Usage:
$ dfe system clickhouse-cloud start [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system clickhouse-cloud start
Calls POST /api/v1/system/clickhouse-cloud/start.
dfe system clickhouse-cloud stop
Clickhouse Cloud Stop
Stop the CH Cloud service (saves cost). Admin-gated + audited.
Usage:
$ dfe system clickhouse-cloud stop [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system clickhouse-cloud stop
Calls POST /api/v1/system/clickhouse-cloud/stop.
dfe system defaults
Usage:
$ dfe system defaults [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Apply Defaultsdrift: Get Default Driftget: Get Defaultsupdate: Patch Defaults
dfe system defaults apply
Apply Defaults
Pin the current TTL, common header and merge engine onto the named sources and their tables.
Sources that are not in the list are left alone. A source that already stores these values is unchanged in the deploy repo. A missing or engine-owned name fails the request before any source is written.
A draft takes the values in place. A deployed version is never rewritten: the
values land on a new major version, which becomes current. Either way the
table takes them when that version is deployed.
A named source whose deployed version already carries the values has its table
brought to them in this request: the TTL moves and the header's missing
columns are added. The engine of an existing table needs a rebuild, so it
reaches new tables only, and existing columns keep their type. live
reports each source: what reached the table, what did not and why. A
ClickHouse failure is reported on that source, and the pin stays committed.
A pin production+team sends to review is listed in awaiting_review with
review_required and the review headers, and its table is left alone until
the branch merges, since main still carries the source as it was.
Usage:
$ dfe system defaults apply [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--sources <str>: Source names. Only these are written. Required.--help: Show this message and exit.
Example: dfe system defaults apply
Calls POST /api/v1/system/defaults/apply.
dfe system defaults drift
Get Default Drift
Sources whose table or current version runs a header, TTL or engine other than the default.
TTL and engine are measured on a deployed source's table, read from ClickHouse,
so a value pinned in the source that the table never took is still drift. An
engine change persists as drift until the table is rebuilt. For a source with
no deployed table, and for the header, the stored value is measured: a field
the source leaves unset inherits the default on its next deploy and is not
drift, nor is a stored value equal to the default. Header types compare as
bare profile names, so common-header/timeseries is timeseries.
core is true for an engine-owned source, which the apply endpoint will
refuse. The landing source is never listed. search matches the source
name, a drifted field name, or a stored or live value.
Usage:
$ dfe system defaults drift [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--no-paginate: Fetch one page instead of following next_page_token.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--max-items <int range>: Most items to print. A cut-short list ends with a next_page_token. [x>=1]--starting-token <str>: Resume from the next_page_token an earlier call printed.--search <str>: Search in source name, drifted field, and stored or live value--page-size <int>: Items per page: 0 means 50, above 1000 is cut to it--skip <int>: Items to skip, after page_token--help: Show this message and exit.
Example: dfe system defaults drift
Calls GET /api/v1/system/defaults/drift.
dfe system defaults get
Get Defaults
The TTL, common header and merge engine a source inherits when it sets none.
Usage:
$ dfe system defaults get [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system defaults get
Calls GET /api/v1/system/defaults.
dfe system defaults update
Patch Defaults
Store the named defaults. Only ttl_days is applied to live tables.
Omitted fields are left alone. null clears that override. Common-header type, version and engine are what a source inherits the next time it is deployed. This request does not rewrite them onto live tables. A patch that names ttl_days stores it and then runs the same reconcile as PUT /retention.
Usage:
$ dfe system defaults update [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--ttl-days <int>: Retention in days; 0 keeps rows forever. null clears the override.--common-header-type <str>: Common-header profile name, such as timeseries or minimal. null clears it.--common-header-version <str>: Common-header profile version. null clears it.--engine <str>: MergeTree-family variant. null clears it, so the deployment engine applies.--help: Show this message and exit.
Example: dfe system defaults update
Calls PATCH /api/v1/system/defaults.
dfe system deployment
Usage:
$ dfe system deployment [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Deployment
dfe system deployment get
Get Deployment
What this deployment IS: its profile, transports, backing services and versions.
Authenticated but ungated, for the same reason /version is: every console pane that must not guess reads this, and the body carries deployment shape and versions only. Without it the console has to assume the widest deployment and offer a transport or an app this tier does not run.
Usage:
$ dfe system deployment get [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system deployment get
Calls GET /api/v1/system/deployment.
dfe system retention
Usage:
$ dfe system retention [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
apply: Put Retentionget: Get Retention
dfe system retention apply
Put Retention
Store the override in the deploy repo, then apply it to every table that follows it.
The engine's own tables and every deployed source's table are brought to the new
effective default in this request, with ALTER TABLE ... MODIFY TTL (or
REMOVE TTL for 0). A table that declares its own TTL is left alone. A
ClickHouse failure answers 502 with the override ALREADY committed. Sending the
same value again applies it.
Usage:
$ dfe system retention apply [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--default-ttl-days <int>: Retention in days for every table that follows the default; 0 keeps rows forever. null clears the override, so deployment_default applies again. Required.--help: Show this message and exit.
Example: dfe system retention apply
Calls PUT /api/v1/system/retention.
dfe system retention get
Get Retention
The effective default TTL, the admin's override and the deployment's own value.
Usage:
$ dfe system retention get [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe system retention get
Calls GET /api/v1/system/retention.
dfe transforms
Usage:
$ dfe transforms [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
compile: Compile Transformtest: Test Transform
dfe transforms compile
Compile Transform
Compile user source code to a WASM binary.
Proxies to the dfe-transform-compiler service. The response includes a base64-encoded WASM binary that can be passed directly to /test.
Usage:
$ dfe transforms compile [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--language <rust|go|assemblyscript>: Language Required.--files <str>: Source files. Key = filename, value = source content. JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe transforms compile
Calls POST /api/v1/transforms/compile.
dfe transforms test
Test Transform
Run a compiled WASM transform against sample records.
Proxies to the dfe-transform-wasm service's /test endpoint. The wasm_base64 field should come directly from /compile.
Usage:
$ dfe transforms test [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--body <str>: The whole request body as JSON or YAML, or file://<path>. Field options override it.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--wasm-base64 <str>: Base64-encoded WASM binary from /compile Required.--records <str>: Sample input records JSON or YAML, or file://<path>. Required.--help: Show this message and exit.
Example: dfe transforms test
Calls POST /api/v1/transforms/test.
dfe usage
Usage:
$ dfe usage [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
get: Get Usageoverview
dfe usage get
Get Usage
One usage metric per UTC day over a range, for the whole deployment or one org.
Events per second over more than one tenant id is the busiest minute of their sum, read from the minute table, which keeps 7 days.
Usage:
$ dfe usage get [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--metric <cores_deployed|node_cores|ingested_bytes|events_per_second>: The metric to read Required.--from <str>: The first UTC day, 29 days beforetowhen absent--to <str>: The last UTC day, today when absent--org <str>: One org to read. Absent reads the whole deployment, or every org the caller holds--granularity <str>: Per UTC day, the only granularity the rollup keeps--help: Show this message and exit.
Example: dfe usage get --metric <metric>
Calls GET /api/v1/usage.
dfe usage overview
Usage:
$ dfe usage overview [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
list: Get Usage Overview
dfe usage overview list
Get Usage Overview
Every usage metric per UTC day over the last 30 days, and its highest in the last 7.
The whole deployment for a caller that reads every org, else the caller's own
orgs combined, with the two core counts not_permitted. Events per second over
more than one tenant id is the busiest minute of their sum, read from the minute
table, which keeps 7 days.
Usage:
$ dfe usage overview list [OPTIONS]
Options:
-o, --output <json|yaml|table|text>: Output format: json, yaml, table, text. Default: json off a terminal, else yaml for get, table for list.--query <str>: JMESPath expression applied to the answer before it is printed.--endpoint-url <str>: The API's base URL, over the environment and the profile.--profile <str>: Named profile to read the endpoint and credential from.-d, --debug: Show tracebacks instead of one-line errors.-y, --yes: Skip the confirmation a delete asks for.-v, --verbose: Print each request and its answer's status on stderr.-q, --quiet: Print no warnings, and a value or list of values bare, one per line.--no-input: Never prompt: refuse a delete that has no --yes, even at a terminal.--cli-input-json <str>: Every input as one document with path, query, header and body sections, or file://<path>. JSON.--cli-input-yaml <str>: Every input as one document with path, query, header and body sections, or file://<path>. YAML.--generate-cli-skeleton: Print the input document with placeholder values, as JSON or with --output yaml as YAML, and send nothing.--help: Show this message and exit.
Example: dfe usage overview list
Calls GET /api/v1/usage/overview.