`config` commands

The configuration registry: projects, environments, clusters, accounts, providers.

Reference index · Output formats and exit codes

Command	Summary
`skopea config settings get`	Show the organization's global settings (feature flags, secrets prefix, AI chat, audit, branding...).
`skopea config settings set`	Overwrite settings sections from a file (a section sent replaces the stored one; the others are kept).
`skopea config settings edit`	Edit the settings (or one --section) in $EDITOR; only the changed sections are written.
`skopea config settings feature enable`	Turn on one organization feature flag (the other flags are kept).
`skopea config settings feature disable`	Turn off one organization feature flag (the other flags are kept).
`skopea config frontend get`	Show the configuration the web app boots with (any signed-in user; role ARNs hidden unless admin).
`skopea config public get`	Show the public branding of the login page (no sign-in needed).
`skopea config project list`	List the projects of the registry.
`skopea config project get`	Show one project.
`skopea config project create`	Register a project.
`skopea config project update`	Change fields of a project (absent fields keep their stored value).
`skopea config project edit`	Edit a project in $EDITOR, then write only what changed.
`skopea config project delete`	Delete a project AND all its environments (no soft delete; a local backup is written first).
`skopea config project duplicate`	Copy a project and all its environments under a new id.
`skopea config env list`	List the environments of the registry.
`skopea config env get`	Show one environment.
`skopea config env create`	Register a environment.
`skopea config env update`	Change fields of a environment (absent fields keep their stored value).
`skopea config env edit`	Edit a environment in $EDITOR, then write only what changed.
`skopea config env delete`	Delete a environment (a local backup is written first).
`skopea config env explain`	Show how an environment resolves: the account, region, cluster and the role ARNs really used.
`skopea config env duplicate`	Copy an environment inside its project under a new id.
`skopea config env checkers set`	Turn health checkers on or off for an environment (the others are kept).
`skopea config env autostop get`	Show an environment's auto-stop configuration: the master switch and its sources.
`skopea config env autostop test`	Probe the auto-stop sources: reachable, and holding rows for this environment? (writes nothing)
`skopea config env autostop apply`	Write an environment's auto-stop block from a file, after probing it.
`skopea config env autostop enable`	Turn the auto-stop CONFIGURATION master switch on (not the runtime schedule).
`skopea config env autostop disable`	Turn the auto-stop CONFIGURATION master switch off (not the runtime schedule).
`skopea config env autostop source add`	Add one auto-stop source to an environment, after probing it.
`skopea config env autostop source remove`	Remove one auto-stop source from an environment.
`skopea config cluster list`	List the clusters of the registry.
`skopea config cluster get`	Show one cluster.
`skopea config cluster create`	Register a cluster (asks what is missing on a terminal: account, region, type, then a discovered cluster).
`skopea config cluster update`	Change fields of a cluster (absent fields keep their stored value).
`skopea config cluster edit`	Edit a cluster in $EDITOR, then write only what changed.
`skopea config cluster delete`	Delete a cluster.
`skopea config cluster discover`	List the clusters a cloud account has, each marked registered or not.
`skopea config account list`	List the cloud accounts of the registry.
`skopea config account get`	Show one cloud account.
`skopea config account create`	Register a cloud account.
`skopea config account update`	Change fields of a cloud account (absent fields keep their stored value).
`skopea config account edit`	Edit a cloud account in $EDITOR, then write only what changed.
`skopea config account delete`	Delete a cloud account.
`skopea config ou list`	List the organization units of the registry.
`skopea config ou get`	Show one organization unit.
`skopea config ou create`	Register a organization unit.
`skopea config ou update`	Change fields of a organization unit (absent fields keep their stored value).
`skopea config ou edit`	Edit a organization unit in $EDITOR, then write only what changed.
`skopea config ou delete`	Delete a organization unit.
`skopea config ci list`	List the CI providers of the registry.
`skopea config ci get`	Show one CI provider.
`skopea config ci create`	Register a CI provider.
`skopea config ci update`	Change fields of a CI provider (absent fields keep their stored value).
`skopea config ci edit`	Edit a CI provider in $EDITOR, then write only what changed.
`skopea config ci delete`	Delete a CI provider and its stored credential.
`skopea config registry list`	List the image registries of the registry.
`skopea config registry get`	Show one image registry.
`skopea config registry create`	Register a image registry.
`skopea config registry update`	Change fields of a image registry (absent fields keep their stored value).
`skopea config registry edit`	Edit a image registry in $EDITOR, then write only what changed.
`skopea config registry delete`	Delete a image registry and its stored credential.
`skopea config monitoring list`	List the monitoring providers of the registry.
`skopea config monitoring get`	Show one monitoring provider.
`skopea config monitoring create`	Register a monitoring provider.
`skopea config monitoring update`	Change fields of a monitoring provider (absent fields keep their stored value).
`skopea config monitoring edit`	Edit a monitoring provider in $EDITOR, then write only what changed.
`skopea config monitoring delete`	Delete a monitoring provider and its stored credential.
`skopea config ci test`	Test a CI provider's connection: a saved one, every saved one (--all), or unsaved credentials (--type ...). Writes nothing.
`skopea config registry test`	Test a image registry's connection: a saved one, every saved one (--all), or unsaved credentials (--type ...). Writes nothing.
`skopea config monitoring test`	Test a monitoring provider's connection: a saved one, every saved one (--all), or unsaved credentials (--type ...). Writes nothing.
`skopea config monitoring app list`	List the APM applications a New Relic provider knows.
`skopea config monitoring namespace list`	List the Kubernetes namespaces a New Relic provider reports on.
`skopea config monitoring log-source list`	List the log sources a New Relic provider exposes.
`skopea config credential get`	Say whether an organization-wide integration credential exists (never its value).
`skopea config credential set`	Create or OVERWRITE an integration credential; the value comes from stdin or a file, never argv.
`skopea config credential delete`	Delete an integration credential (organization-wide, or of --project).
`skopea config credential test`	Test a legacy CI/CD connection with the stored {provider}-token, or a token from stdin or a file. Writes nothing.
`skopea config credential discover`	List the pipelines a legacy CI/CD provider exposes. Writes nothing.
`skopea config export`	Export the whole registry as one v2.0 snapshot (projects, environments, clusters, accounts, units, settings).
`skopea config validate`	Validate a snapshot's structure on the server (writes nothing); exits 9 when it is not valid.
`skopea config import`	Import a snapshot: always previewed by the server first, then confirmed (merge upserts; replace CLEARS the registry).
`skopea config access-source list`	List the Access Map sources: the declared ones and the implicit ones (Identity Center, IAM, Skopea, the registry's clusters and CI).
`skopea config access-source get`	Show one Access Map source, with the result of its last test (lastProbe), facet by facet.
`skopea config access-source create`	Declare an Access Map source (credentials are references: ciProviderId, identityId or secretRef, never a value).
`skopea config access-source update`	Change a declared Access Map source (an implicit one is refused: it is switched off in settings.accessMap).
`skopea config access-source enable`	Enable a declared Access Map source: it is collected again at its cadence.
`skopea config access-source disable`	Disable a declared Access Map source: it is no longer collected (its data leaves the map at the retention horizon).
`skopea config access-source test`	Test a source: queue a probe the collector runs at its next tick (within five minutes); the result lands in lastProbe.
`skopea config access-source delete`	Delete a declared Access Map source (its data leaves the map at the retention horizon, max(24 h, 4 x cadence), never before).

`skopea config settings get`

Show the organization's global settings (feature flags, secrets prefix, AI chat, audit, branding...).

skopea config settings get [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigSettings

Flags

Flag	Value	Description
`--section`	`aiChat\|audit\|auth\|branding\|comparison\|features\|iac\|identityCenter\|opsIntegration\|secretsPrefix\|defaultOrchestratorType\|environmentTagKey\|projectTagKey`	Only this settings section.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config settings get
skopea config settings get --section features -o json

`skopea config settings set`

Overwrite settings sections from a file (a section sent replaces the stored one; the others are kept).

skopea config settings set [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigSettings, getConfigSettings

Flags

Flag	Value	Description
`--section`	`aiChat\|audit\|auth\|branding\|comparison\|features\|iac\|identityCenter\|opsIntegration\|secretsPrefix\|defaultOrchestratorType\|environmentTagKey\|projectTagKey`	Only this settings section.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigSettings`	org-admin or platform-admin — config/handler.handler rejects any caller failing is_global_admin(auth) with 403 'forbidden' before routing. That single boolean grants BOTH tiers: an admin over every project of their OWN organization (project='*', scoped by Permission.org_id) and a platform admin, who is transverse to all organizations. No per-project scoping.

Examples

skopea config settings set --section audit --file audit.json
skopea config settings set --file settings.json --yes

`skopea config settings edit`

Edit the settings (or one --section) in $EDITOR; only the changed sections are written.

skopea config settings edit [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigSettings, updateConfigSettings

Flags

Flag	Value	Description
`--section`	`aiChat\|audit\|auth\|branding\|comparison\|features\|iac\|identityCenter\|opsIntegration\|secretsPrefix\|defaultOrchestratorType\|environmentTagKey\|projectTagKey`	Only this settings section.
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigSettings`	org-admin or platform-admin — config/handler.handler rejects any caller failing is_global_admin(auth) with 403 'forbidden' before routing. That single boolean grants BOTH tiers: an admin over every project of their OWN organization (project='*', scoped by Permission.org_id) and a platform admin, who is transverse to all organizations. No per-project scoping.

Examples

skopea config settings edit --section aiChat

`skopea config settings feature enable`

Turn on one organization feature flag (the other flags are kept).

skopea config settings feature enable <feature> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigSettings, updateConfigSettings

Arguments

Argument	Description
`feature`	Feature flag name (see config settings get --section features).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigSettings`	org-admin or platform-admin — config/handler.handler rejects any caller failing is_global_admin(auth) with 403 'forbidden' before routing. That single boolean grants BOTH tiers: an admin over every project of their OWN organization (project='*', scoped by Permission.org_id) and a platform admin, who is transverse to all organizations. No per-project scoping.

Examples

skopea config settings feature enable comparison

`skopea config settings feature disable`

Turn off one organization feature flag (the other flags are kept).

skopea config settings feature disable <feature> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigSettings, updateConfigSettings

Arguments

Argument	Description
`feature`	Feature flag name (see config settings get --section features).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigSettings`	org-admin or platform-admin — config/handler.handler rejects any caller failing is_global_admin(auth) with 403 'forbidden' before routing. That single boolean grants BOTH tiers: an admin over every project of their OWN organization (project='*', scoped by Permission.org_id) and a platform admin, who is transverse to all organizations. No per-project scoping.

Examples

skopea config settings feature disable comparison

`skopea config frontend get`

Show the configuration the web app boots with (any signed-in user; role ARNs hidden unless admin).

skopea config frontend get [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getFrontendConfig

Flags

Flag	Value	Description
`--section`	`global\|features\|projects\|auth\|api\|defaultProject`	Only this section of the frontend config.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

getFrontendConfig Any authenticated caller. The cross-account role ARNs carried by projects[].aws.accounts[] (readRoleArn/actionRoleArn) are stripped for anyone who is not a global admin (config/routes/frontend._redact_frontend_config). A non-admin receives only the projects they hold a live grant on (a role with actions, or a capability), the organization units above those, and projectsFiltered: true when anything was withheld.

Examples

skopea config frontend get
skopea config frontend get --section projects -o json

`skopea config public get`

Show the public branding of the login page (no sign-in needed).

skopea config public get [flags]

Context: an API origin only; no credential is sent
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getPublicConfig

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config public get --api-url https://api.example.com

`skopea config project list`

List the projects of the registry.

skopea config project list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listConfigProjects

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config project list
skopea config project list -o json

`skopea config project get`

Show one project.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config project get <projectId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigProject

Arguments

Argument	Description
`projectId`	Project id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config project get webshop
skopea config project get webshop -o yaml

`skopea config project create`

Register a project.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config project create <projectId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigProject

Arguments

Argument	Description
`projectId`	Project id.

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--description`	`VALUE`	Free-text description.
`--ou`	`VALUE`	Organization unit id the project is filed under.
`--type`	`ecs\|eks\|ec2\|lambda`	Orchestrator type.
`--status`	`VALUE`	Lifecycle status (for example planned, active).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

createConfigProject org-admin / platform-admin, or project-admin (manage-projects, org or ou scope) on the project's unit — before AND after a write: a move needs the source and the target, and the project's existing bindings must fall in the target's allowed bindings (409 bindings_outside_target_ou). A unit-scoped admin must name an ouId. idpGroupMapping: org admin only; tag keys and finopsTagAliases: org scope only (403 field_locked). ou-admin (manage-org-units) may only MOVE a project inside its subtree. A delegated delete of a project still referenced by live assignments or grants answers 409 still_referenced. Reads are filtered to the covered projects.

Examples

skopea config project create webshop --name Webshop --type ecs --ou ou-prod
skopea config project create webshop --file project.json --yes

`skopea config project update`

Change fields of a project (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config project update <projectId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigProject, getConfigProject

Arguments

Argument	Description
`projectId`	Project id.

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--description`	`VALUE`	Free-text description.
`--ou`	`VALUE`	Organization unit id the project is filed under.
`--type`	`ecs\|eks\|ec2\|lambda`	Orchestrator type.
`--status`	`VALUE`	Lifecycle status (for example planned, active).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigProject org-admin / platform-admin, or project-admin (manage-projects, org or ou scope) on the project's unit — before AND after a write: a move needs the source and the target, and the project's existing bindings must fall in the target's allowed bindings (409 bindings_outside_target_ou). A unit-scoped admin must name an ouId. idpGroupMapping: org admin only; tag keys and finopsTagAliases: org scope only (403 field_locked). ou-admin (manage-org-units) may only MOVE a project inside its subtree. A delegated delete of a project still referenced by live assignments or grants answers 409 still_referenced. Reads are filtered to the covered projects.

Examples

skopea config project update webshop --status active
skopea config project update webshop --file changes.json --yes

`skopea config project edit`

Edit a project in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config project edit <projectId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigProject, updateConfigProject

Arguments

Argument	Description
`projectId`	Project id.

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigProject org-admin / platform-admin, or project-admin (manage-projects, org or ou scope) on the project's unit — before AND after a write: a move needs the source and the target, and the project's existing bindings must fall in the target's allowed bindings (409 bindings_outside_target_ou). A unit-scoped admin must name an ouId. idpGroupMapping: org admin only; tag keys and finopsTagAliases: org scope only (403 field_locked). ou-admin (manage-org-units) may only MOVE a project inside its subtree. A delegated delete of a project still referenced by live assignments or grants answers 409 still_referenced. Reads are filtered to the covered projects.

Examples

skopea config project edit webshop

`skopea config project delete`

Delete a project AND all its environments (no soft delete; a local backup is written first).

Lists the environments deleted with it before the confirmation. The local backup is a v2.0 snapshot: config import --file <backup> restores it.

skopea config project delete <projectId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigProject, getConfigProject

Arguments

Argument	Description
`projectId`	Project id.

Flags

Flag	Value	Description
`--no-backup`		Do not write the local backup before deleting.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

deleteConfigProject org-admin / platform-admin, or project-admin (manage-projects, org or ou scope) on the project's unit — before AND after a write: a move needs the source and the target, and the project's existing bindings must fall in the target's allowed bindings (409 bindings_outside_target_ou). A unit-scoped admin must name an ouId. idpGroupMapping: org admin only; tag keys and finopsTagAliases: org scope only (403 field_locked). ou-admin (manage-org-units) may only MOVE a project inside its subtree. A delegated delete of a project still referenced by live assignments or grants answers 409 still_referenced. Reads are filtered to the covered projects.

Examples

skopea config project delete webshop
skopea config project delete webshop --yes --confirm webshop

`skopea config project duplicate`

Copy a project and all its environments under a new id.

skopea config project duplicate <projectId> <newProjectId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runConfigProjectAction

Arguments

Argument	Description
`projectId`	Project to copy.
`newProjectId`	Id of the copy.

Flags

Flag	Value	Description
`--new-name`	`VALUE`	Display name of the copy.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

runConfigProjectAction org-admin / platform-admin, or project-admin (manage-projects, org or ou scope) on the project's unit — before AND after a write: a move needs the source and the target, and the project's existing bindings must fall in the target's allowed bindings (409 bindings_outside_target_ou). A unit-scoped admin must name an ouId. idpGroupMapping: org admin only; tag keys and finopsTagAliases: org scope only (403 field_locked). ou-admin (manage-org-units) may only MOVE a project inside its subtree. A delegated delete of a project still referenced by live assignments or grants answers 409 still_referenced. Reads are filtered to the covered projects.

Examples

skopea config project duplicate webshop webshop-eu --new-name Webshop-EU

`skopea config env list`

List the environments of the registry.

skopea config env list [flags]

Context: needs org and project; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listConfigEnvironments

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config env list --project webshop
skopea config env list --project webshop -o json

`skopea config env get`

Show one environment.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config env get <envId> [flags]

Context: needs org and project; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigEnvironment

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--section`	`autostop\|checkers\|monitoring\|infrastructure\|pipelines\|topology\|iac\|registry\|config`	Only this block of the environment.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config env get production --project webshop
skopea config env get production --project webshop -o yaml
skopea config env get production --project webshop --section autostop

`skopea config env create`

Register a environment.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config env create <envId> [flags]

Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigEnvironment

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--cluster-name`	`VALUE`	Cloud cluster name (the ECS or EKS cluster as the cloud names it), not a Skopea cluster id.
`--namespace`	`VALUE`	Primary Kubernetes namespace of the environment (the other namespaces are kept). (not with --namespaces)
`--namespaces`	`A,B`	Every Kubernetes namespace of the environment, comma-separated, the primary first (replaces the list). Each is a Kubernetes name: lower-case letters, digits and -.
`--services`	`VALUE`	Comma-separated service names.
`--status`	`VALUE`	Lifecycle status (for example planned, active).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

createConfigEnvironment org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env create staging --project webshop --account 123456789012 --region eu-west-1 --status planned
skopea config env create production --project webshop --file env.json --yes

`skopea config env update`

Change fields of a environment (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config env update <envId> [flags]

Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigEnvironment, getConfigEnvironment

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--cluster-name`	`VALUE`	Cloud cluster name (the ECS or EKS cluster as the cloud names it), not a Skopea cluster id.
`--namespace`	`VALUE`	Primary Kubernetes namespace of the environment (the other namespaces are kept). (not with --namespaces)
`--namespaces`	`A,B`	Every Kubernetes namespace of the environment, comma-separated, the primary first (replaces the list). Each is a Kubernetes name: lower-case letters, digits and -.
`--services`	`VALUE`	Comma-separated service names.
`--status`	`VALUE`	Lifecycle status (for example planned, active).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigEnvironment org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env update production --project webshop --namespaces webshop-prod,webshop-prod-jobs
skopea config env update production --project webshop --file changes.json --yes

`skopea config env edit`

Edit a environment in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config env edit <envId> [flags]

Context: needs org and project; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigEnvironment, updateConfigEnvironment

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigEnvironment org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env edit production --project webshop

`skopea config env delete`

Delete a environment (a local backup is written first).

The local backup is a v2.0 snapshot: config import --file <backup> restores it.

skopea config env delete <envId> [flags]

Context: needs org and project; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigEnvironment, getConfigEnvironment, getConfigProject

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--no-backup`		Do not write the local backup before deleting.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

deleteConfigEnvironment org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env delete production --project webshop
skopea config env delete production --project webshop --yes --confirm webshop/production

`skopea config env explain`

Show how an environment resolves: the account, region, cluster and the role ARNs really used.

The effective view (env value first, else the account's): the answer to "why does Skopea see nothing in this environment?".

skopea config env explain <envId> [flags]

Context: needs org and project; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigEnvironmentResolution

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config env explain production --project webshop

`skopea config env duplicate`

Copy an environment inside its project under a new id.

skopea config env duplicate <envId> <newEnvId> [flags]

Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runConfigEnvironmentAction

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).
`newEnvId`	Id of the copy.

Flags

Flag	Value	Description
`--new-name`	`VALUE`	Display name of the copy.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

runConfigEnvironmentAction org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env duplicate staging preprod --project webshop --new-name Pre-production

`skopea config env checkers set`

Turn health checkers on or off for an environment (the others are kept).

skopea config env checkers set <envId> [checkers...] [flags]

Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: patchConfigEnvironmentCheckers

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).
`checkers`	<checker>=on\|off, one or more.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

patchConfigEnvironmentCheckers org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env checkers set production rds=on ecs=off --project webshop

`skopea config env autostop get`

Show an environment's auto-stop configuration: the master switch and its sources.

The registry block (which sources schedule the environment). The runtime schedule is autostop get (power domain).

skopea config env autostop get <envId> [flags]

Aliases: skopea autostop config get
Context: needs org and project; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigEnvironment

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config env autostop get production --project webshop
skopea autostop config get production --project webshop -o json

`skopea config env autostop test`

Probe the auto-stop sources: reachable, and holding rows for this environment? (writes nothing)

Probes the stored block, or the block in --file before you apply it. Exits 9 when a source is not ok.

skopea config env autostop test <envId> [flags]

Aliases: skopea autostop config test
Context: needs org and project; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: probeConfigEnvironmentAutostop

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`probeConfigEnvironmentAutostop`	org-admin / platform-admin, or infra-admin (manage-infra at the org): the probe reaches the environment's action identity (R5), never a project admin.

Examples

skopea config env autostop test production --project webshop
skopea config env autostop test production --project webshop --file block.json

`skopea config env autostop apply`

Write an environment's auto-stop block from a file, after probing it.

Probes the new block first and refuses when a source cannot be reached (--force-unreachable writes anyway), shows the local diff, then confirms.

skopea config env autostop apply <envId> [flags]

Aliases: skopea autostop config apply
Context: needs org and project; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: probeConfigEnvironmentAutostop, getConfigEnvironment, patchConfigEnvironmentAutostop

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--skip-probe`		Do not probe the sources before writing.
`--force-unreachable`		Apply even when the probe could not reach a source.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

probeConfigEnvironmentAutostop org-admin / platform-admin, or infra-admin (manage-infra at the org): the probe reaches the environment's action identity (R5), never a project admin.

patchConfigEnvironmentAutostop org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env autostop apply production --project webshop --file block.json

`skopea config env autostop enable`

Turn the auto-stop CONFIGURATION master switch on (not the runtime schedule).

skopea config env autostop enable <envId> [flags]

Aliases: skopea autostop config enable
Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: patchConfigEnvironmentAutostop

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

patchConfigEnvironmentAutostop org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env autostop enable production --project webshop

`skopea config env autostop disable`

Turn the auto-stop CONFIGURATION master switch off (not the runtime schedule).

skopea config env autostop disable <envId> [flags]

Aliases: skopea autostop config disable
Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: patchConfigEnvironmentAutostop

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

patchConfigEnvironmentAutostop org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env autostop disable production --project webshop --yes

`skopea config env autostop source add`

Add one auto-stop source to an environment, after probing it.

Flags set id, type and label; --file adds the type-specific keys (storageAccount, tableName, partitionKey...). Read-modify-write: there is no version precondition (G15).

skopea config env autostop source add <envId> [flags]

Aliases: skopea autostop config source add
Context: needs org and project; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigEnvironment, probeConfigEnvironmentAutostop, patchConfigEnvironmentAutostop

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).

Flags

Flag	Value	Description
`--id`	`VALUE`	Source slug id (lower case, digits, dashes).
`--type`	`VALUE`	Source type (for example azure-table, dynamodb, ssm-json, resource-tags).
`--label`	`VALUE`	Human label.
`--disabled`		Add the source disabled.
`--skip-probe`		Do not probe the sources before writing.
`--force-unreachable`		Apply even when the probe could not reach a source.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

probeConfigEnvironmentAutostop org-admin / platform-admin, or infra-admin (manage-infra at the org): the probe reaches the environment's action identity (R5), never a project admin.

patchConfigEnvironmentAutostop org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env autostop source add staging --project webshop --id azure-schedule --type azure-table --file source.json

`skopea config env autostop source remove`

Remove one auto-stop source from an environment.

skopea config env autostop source remove <envId> <sourceId> [flags]

Aliases: skopea autostop config source remove, skopea config env autostop source rm, skopea autostop config source rm
Context: needs org and project; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigEnvironment, patchConfigEnvironmentAutostop

Arguments

Argument	Description
`envId`	Environment id (the project comes from --project or the context).
`sourceId`	The source's slug id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

patchConfigEnvironmentAutostop org-admin / platform-admin, or project-admin (manage-projects) covering the environment's project. Every CHANGED binding (account, cluster and namespaces, identities, role ARNs, pipelines, registry, monitoring, auto-stop sources) must fall in the allowed bindings of the project's unit — the union along its OU chain; for an org-scoped project admin, the org list ∪ that chain when the org list is set, else the whole registry (403 binding_not_allowed). A duplicate is a creation. A delegated delete of a referenced environment answers 409 still_referenced.

Examples

skopea config env autostop source remove staging azure-schedule --project webshop

`skopea config cluster list`

List the clusters of the registry.

skopea config cluster list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listConfigClusters

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config cluster list
skopea config cluster list -o json

`skopea config cluster get`

Show one cluster.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config cluster get <clusterId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigCluster

Arguments

Argument	Description
`clusterId`	Cluster registry id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config cluster get eks-prod
skopea config cluster get eks-prod -o yaml

`skopea config cluster create`

Register a cluster (asks what is missing on a terminal: account, region, type, then a discovered cluster).

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config cluster create <clusterId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigCluster, listConfigCloudAccounts

Arguments

Argument	Description
`clusterId`	Cluster registry id.

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--type`	`eks\|ecs`	Cluster type.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--display-name`	`VALUE`	Display name.
`--cloud`	`aws\|azure\|gcp\|scaleway`	Cloud provider.
`--identity`	`VALUE`	Identity chain id used to reach the cloud (internal API).
`--k8s-version`	`VALUE`	Cluster version (for example 1.29).
`--proxy-url`	`VALUE`	HTTP proxy kubectl goes through to reach the API server; written into the kubeconfig of "My access" connections. Empty string clears it.
`--log-provider`	`VALUE`	Monitoring provider id serving this cluster's logs. (requires --log-namespace)
`--log-namespace`	`VALUE`	Namespace of the log source. (requires --log-provider)
`--log-pattern`	`VALUE`	Deployment name pattern of the log source. (requires --log-provider)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createConfigCluster`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config cluster create eks-prod --name eks-prod --type eks --account 123456789012 --region eu-central-1
skopea config cluster create eks-prod --file cluster.json --yes

`skopea config cluster update`

Change fields of a cluster (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config cluster update <clusterId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigCluster, getConfigCluster, getFrontendConfig

Arguments

Argument	Description
`clusterId`	Cluster registry id.

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--type`	`eks\|ecs`	Cluster type.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--display-name`	`VALUE`	Display name.
`--cloud`	`aws\|azure\|gcp\|scaleway`	Cloud provider.
`--identity`	`VALUE`	Identity chain id used to reach the cloud (internal API).
`--k8s-version`	`VALUE`	Cluster version (for example 1.29).
`--proxy-url`	`VALUE`	HTTP proxy kubectl goes through to reach the API server; written into the kubeconfig of "My access" connections. Empty string clears it.
`--eks-read-role`	`VALUE`	EKS read role ARN (pre-identity override).
`--ecs-read-role`	`VALUE`	ECS read role ARN (pre-identity override).
`--log-provider`	`VALUE`	Monitoring provider id serving this cluster's logs. (requires --log-namespace)
`--log-namespace`	`VALUE`	Namespace of the log source. (requires --log-provider)
`--log-pattern`	`VALUE`	Deployment name pattern of the log source. (requires --log-provider)
`--clear-log-source`		Remove the cluster's log source (sends logSource: null). (not with --log-provider)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigCluster org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

getFrontendConfig Any authenticated caller. The cross-account role ARNs carried by projects[].aws.accounts[] (readRoleArn/actionRoleArn) are stripped for anyone who is not a global admin (config/routes/frontend._redact_frontend_config). A non-admin receives only the projects they hold a live grant on (a role with actions, or a capability), the organization units above those, and projectsFiltered: true when anything was withheld.

Examples

skopea config cluster update eks-prod --log-provider nr-main --log-namespace webshop-production
skopea config cluster update eks-prod --file changes.json --yes

`skopea config cluster edit`

Edit a cluster in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config cluster edit <clusterId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigCluster, updateConfigCluster

Arguments

Argument	Description
`clusterId`	Cluster registry id.

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigCluster`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config cluster edit eks-prod

`skopea config cluster delete`

Delete a cluster.

Lists the environments that run on the cluster first (the server checks nothing); off a terminal they require --force-orphan.

skopea config cluster delete <clusterId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigCluster, getConfigCluster, getFrontendConfig

Arguments

Argument	Description
`clusterId`	Cluster registry id.

Flags

Flag	Value	Description
`--force-orphan`		Delete even though environments still reference the cluster (they lose their cluster link).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

deleteConfigCluster org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

getFrontendConfig Any authenticated caller. The cross-account role ARNs carried by projects[].aws.accounts[] (readRoleArn/actionRoleArn) are stripped for anyone who is not a global admin (config/routes/frontend._redact_frontend_config). A non-admin receives only the projects they hold a live grant on (a role with actions, or a capability), the organization units above those, and projectsFiltered: true when anything was withheld.

Examples

skopea config cluster delete eks-prod
skopea config cluster delete eks-prod --yes --confirm eks-prod

`skopea config cluster discover`

List the clusters a cloud account has, each marked registered or not.

An empty answer does not prove the account has none (several providers swallow their errors). JSON is {listDiscoveredAccountResources, listConfigClusters, rows}.

skopea config cluster discover <accountId> [resourceType] [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listDiscoveredAccountResources, listConfigClusters

Arguments

Argument	Description
`accountId`	Cloud account id to discover.
`resourceType`	Cluster type (default eks). One of: eks, ecs.

Flags

Flag	Value	Description
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config cluster discover 123456789012 --region eu-central-1
skopea config cluster discover 123456789012 ecs -o json

`skopea config account list`

List the cloud accounts of the registry.

skopea config account list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listConfigCloudAccounts

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config account list
skopea config account list -o json

`skopea config account get`

Show one cloud account.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config account get <accountId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigCloudAccount

Arguments

Argument	Description
`accountId`	Cloud account id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config account get 123456789012
skopea config account get 123456789012 -o yaml

`skopea config account create`

Register a cloud account.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config account create <accountId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigCloudAccount

Arguments

Argument	Description
`accountId`	Cloud account id.

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--cloud`	`aws\|azure\|gcp\|scaleway`	Cloud provider.
`--identity`	`VALUE`	Identity chain id used to reach the cloud (internal API).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createConfigCloudAccount`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config account create 123456789012 --name Production --region eu-west-1 --identity payer-billing
skopea config account create 123456789012 --file account.json --yes

`skopea config account update`

Change fields of a cloud account (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config account update <accountId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigCloudAccount, getConfigCloudAccount

Arguments

Argument	Description
`accountId`	Cloud account id.

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--cloud`	`aws\|azure\|gcp\|scaleway`	Cloud provider.
`--identity`	`VALUE`	Identity chain id used to reach the cloud (internal API).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigCloudAccount`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config account update 123456789012 --region eu-central-1
skopea config account update 123456789012 --file changes.json --yes

`skopea config account edit`

Edit a cloud account in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config account edit <accountId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigCloudAccount, updateConfigCloudAccount

Arguments

Argument	Description
`accountId`	Cloud account id.

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigCloudAccount`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config account edit 123456789012

`skopea config account delete`

Delete a cloud account.

skopea config account delete <accountId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigCloudAccount

Arguments

Argument	Description
`accountId`	Cloud account id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`deleteConfigCloudAccount`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config account delete 123456789012
skopea config account delete 123456789012 --yes --confirm 123456789012

`skopea config ou list`

List the organization units of the registry.

skopea config ou list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listConfigOrganizationUnits

Flags

Flag	Value	Description
`--tree`		Show the hierarchy (parents first, children indented).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config ou list
skopea config ou list -o json
skopea config ou list --tree

`skopea config ou get`

Show one organization unit.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config ou get <organizationUnitId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigOrganizationUnit

Arguments

Argument	Description
`organizationUnitId`	Organization unit id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config ou get ou-prod
skopea config ou get ou-prod -o yaml

`skopea config ou create`

Register a organization unit.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config ou create <organizationUnitId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigOrganizationUnit

Arguments

Argument	Description
`organizationUnitId`	Organization unit id (a slug).

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--parent`	`VALUE`	Parent unit id. (not with --no-parent)
`--order`	`N`	Sort order among siblings. (min 0)
`--owner-ref`	`VALUE`	Owning team reference.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

createConfigOrganizationUnit org-admin / platform-admin, or ou-admin (manage-org-units on ou:X): create under X's subtree, modify or delete a unit STRICTLY below X (parentId before and after inside the subtree, no cycle); never X itself nor a root unit. allowedBindings is written only by …/allowed-bindings (400 allowed_bindings_via_dedicated_route). Reads: filtered to the caller's subtrees (all units for manage-infra or an org-scoped project admin).

Examples

skopea config ou create ou-webshop --name Webshop --parent ou-prod
skopea config ou create ou-prod --file ou.json --yes

`skopea config ou update`

Change fields of a organization unit (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config ou update <organizationUnitId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigOrganizationUnit, getConfigOrganizationUnit

Arguments

Argument	Description
`organizationUnitId`	Organization unit id (a slug).

Flags

Flag	Value	Description
`--name`	`VALUE`	Display name.
`--parent`	`VALUE`	Parent unit id. (not with --no-parent)
`--no-parent`		Move the unit to the top level. (not with --parent)
`--order`	`N`	Sort order among siblings. (min 0)
`--owner-ref`	`VALUE`	Owning team reference.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigOrganizationUnit org-admin / platform-admin, or ou-admin (manage-org-units on ou:X): create under X's subtree, modify or delete a unit STRICTLY below X (parentId before and after inside the subtree, no cycle); never X itself nor a root unit. allowedBindings is written only by …/allowed-bindings (400 allowed_bindings_via_dedicated_route). Reads: filtered to the caller's subtrees (all units for manage-infra or an org-scoped project admin).

Examples

skopea config ou update ou-webshop --no-parent
skopea config ou update ou-prod --file changes.json --yes

`skopea config ou edit`

Edit a organization unit in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config ou edit <organizationUnitId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigOrganizationUnit, updateConfigOrganizationUnit

Arguments

Argument	Description
`organizationUnitId`	Organization unit id (a slug).

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

updateConfigOrganizationUnit org-admin / platform-admin, or ou-admin (manage-org-units on ou:X): create under X's subtree, modify or delete a unit STRICTLY below X (parentId before and after inside the subtree, no cycle); never X itself nor a root unit. allowedBindings is written only by …/allowed-bindings (400 allowed_bindings_via_dedicated_route). Reads: filtered to the caller's subtrees (all units for manage-infra or an org-scoped project admin).

Examples

skopea config ou edit ou-prod

`skopea config ou delete`

Delete a organization unit.

Refused with 409 while child units or projects still reference the unit.

skopea config ou delete <organizationUnitId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigOrganizationUnit

Arguments

Argument	Description
`organizationUnitId`	Organization unit id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation RBAC

deleteConfigOrganizationUnit org-admin / platform-admin, or ou-admin (manage-org-units on ou:X): create under X's subtree, modify or delete a unit STRICTLY below X (parentId before and after inside the subtree, no cycle); never X itself nor a root unit. allowedBindings is written only by …/allowed-bindings (400 allowed_bindings_via_dedicated_route). Reads: filtered to the caller's subtrees (all units for manage-infra or an org-scoped project admin).

Examples

skopea config ou delete ou-prod
skopea config ou delete ou-prod --yes --confirm ou-prod

`skopea config ci list`

List the CI providers of the registry.

skopea config ci list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listCiProviders

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config ci list
skopea config ci list -o json

`skopea config ci get`

Show one CI provider.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config ci get <providerId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getCiProvider

Arguments

Argument	Description
`providerId`	CI provider id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config ci get jenkins-main
skopea config ci get jenkins-main -o yaml

`skopea config ci create`

Register a CI provider.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config ci create <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createCiProvider

Arguments

Argument	Description
`providerId`	CI provider id.

Flags

Flag	Value	Description
`--type`	`jenkins\|argocd\|codepipeline\|github-actions\|azure-devops\|bitbucket-pipelines\|gitlab-ci`	CI provider type (github-actions, azure-devops, bitbucket-pipelines and gitlab-ci are also git hosts).
`--url`	`VALUE`	Base URL of the provider.
`--user`	`VALUE`	User name the provider authenticates.
`--name`	`VALUE`	Display name.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createCiProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config ci create jenkins-main --type jenkins --url https://jenkins.example.com --user ci --token-file token.txt
skopea config ci create jenkins-main --file ci.json --yes

`skopea config ci update`

Change fields of a CI provider (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config ci update <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateCiProvider, getCiProvider

Arguments

Argument	Description
`providerId`	CI provider id.

Flags

Flag	Value	Description
`--type`	`jenkins\|argocd\|codepipeline\|github-actions\|azure-devops\|bitbucket-pipelines\|gitlab-ci`	CI provider type (github-actions, azure-devops, bitbucket-pipelines and gitlab-ci are also git hosts).
`--url`	`VALUE`	Base URL of the provider.
`--user`	`VALUE`	User name the provider authenticates.
`--name`	`VALUE`	Display name.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateCiProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config ci update jenkins-main --token-stdin
skopea config ci update jenkins-main --file changes.json --yes

`skopea config ci edit`

Edit a CI provider in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config ci edit <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getCiProvider, updateCiProvider

Arguments

Argument	Description
`providerId`	CI provider id.

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateCiProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config ci edit jenkins-main

`skopea config ci delete`

Delete a CI provider and its stored credential.

skopea config ci delete <providerId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteCiProvider

Arguments

Argument	Description
`providerId`	CI provider id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`deleteCiProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config ci delete jenkins-main
skopea config ci delete jenkins-main --yes --confirm jenkins-main

`skopea config registry list`

List the image registries of the registry.

skopea config registry list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listRegistryProviders

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config registry list
skopea config registry list -o json

`skopea config registry get`

Show one image registry.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config registry get <providerId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getRegistryProvider

Arguments

Argument	Description
`providerId`	Registry provider id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config registry get ecr-main
skopea config registry get ecr-main -o yaml

`skopea config registry create`

Register a image registry.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config registry create <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createRegistryProvider

Arguments

Argument	Description
`providerId`	Registry provider id.

Flags

Flag	Value	Description
`--type`	`ecr\|ghcr\|dockerhub`	Registry type.
`--name`	`VALUE`	Display name.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--mode`	`VALUE`	ECR repository mode (for example project).
`--repo-pattern`	`VALUE`	Repository name pattern, such as {project}-{service}.
`--owner`	`VALUE`	GHCR owner (user or organization).
`--namespace`	`VALUE`	Kubernetes namespace.
`--username`	`VALUE`	Docker Hub user name.
`--package-type`	`VALUE`	GHCR package type.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createRegistryProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config registry create ecr-main --type ecr --account 025922408720 --region eu-central-1 --repo-pattern {project}-{service}
skopea config registry create ecr-main --file registry.json --yes

`skopea config registry update`

Change fields of a image registry (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config registry update <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateRegistryProvider, getRegistryProvider

Arguments

Argument	Description
`providerId`	Registry provider id.

Flags

Flag	Value	Description
`--type`	`ecr\|ghcr\|dockerhub`	Registry type.
`--name`	`VALUE`	Display name.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--mode`	`VALUE`	ECR repository mode (for example project).
`--repo-pattern`	`VALUE`	Repository name pattern, such as {project}-{service}.
`--owner`	`VALUE`	GHCR owner (user or organization).
`--namespace`	`VALUE`	Kubernetes namespace.
`--username`	`VALUE`	Docker Hub user name.
`--package-type`	`VALUE`	GHCR package type.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateRegistryProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config registry update ecr-main --repo-pattern {project}/{service}
skopea config registry update ecr-main --file changes.json --yes

`skopea config registry edit`

Edit a image registry in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config registry edit <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getRegistryProvider, updateRegistryProvider

Arguments

Argument	Description
`providerId`	Registry provider id.

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateRegistryProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config registry edit ecr-main

`skopea config registry delete`

Delete a image registry and its stored credential.

skopea config registry delete <providerId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteRegistryProvider

Arguments

Argument	Description
`providerId`	Registry provider id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`deleteRegistryProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config registry delete ecr-main
skopea config registry delete ecr-main --yes --confirm ecr-main

`skopea config monitoring list`

List the monitoring providers of the registry.

skopea config monitoring list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listMonitoringProviders

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config monitoring list
skopea config monitoring list -o json

`skopea config monitoring get`

Show one monitoring provider.

Every get supports -o json and -o yaml; update --file accepts the JSON back (read-only keys removed).

skopea config monitoring get <providerId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getMonitoringProvider

Arguments

Argument	Description
`providerId`	Monitoring provider id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config monitoring get nr-main
skopea config monitoring get nr-main -o yaml

`skopea config monitoring create`

Register a monitoring provider.

Flags set the common fields; --file supplies the whole body as JSON (flags win). 409 when the id already exists.

skopea config monitoring create <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createMonitoringProvider

Arguments

Argument	Description
`providerId`	Monitoring provider id.

Flags

Flag	Value	Description
`--type`	`cloudwatch\|newrelic`	Monitoring provider type.
`--name`	`VALUE`	Display name.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--api-key-stdin`		Read the New Relic API key from piped stdin.
`--api-key-file`	`PATH\|-`	Read the New Relic API key from a file. (not with --api-key-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createMonitoringProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config monitoring create nr-main --type newrelic --account 1234567 --region EU --api-key-file nr.key
skopea config monitoring create nr-main --file monitoring.json --yes

`skopea config monitoring update`

Change fields of a monitoring provider (absent fields keep their stored value).

Prints a LOCAL diff against the stored document (not a server dry run), then confirms.

skopea config monitoring update <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateMonitoringProvider, getMonitoringProvider

Arguments

Argument	Description
`providerId`	Monitoring provider id.

Flags

Flag	Value	Description
`--type`	`cloudwatch\|newrelic`	Monitoring provider type.
`--name`	`VALUE`	Display name.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--api-key-stdin`		Read the New Relic API key from piped stdin.
`--api-key-file`	`PATH\|-`	Read the New Relic API key from a file. (not with --api-key-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateMonitoringProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config monitoring update nr-main --api-key-stdin
skopea config monitoring update nr-main --file changes.json --yes

`skopea config monitoring edit`

Edit a monitoring provider in $EDITOR, then write only what changed.

Opens the document as JSON in $VISUAL or $EDITOR, shows the diff and confirms. Before writing it re-reads the document and refuses when it changed meanwhile (best effort: the API has no version precondition); --force-stale-edit writes anyway.

skopea config monitoring edit <providerId> [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getMonitoringProvider, updateMonitoringProvider

Arguments

Argument	Description
`providerId`	Monitoring provider id.

Flags

Flag	Value	Description
`--force-stale-edit`		Write even when the document changed on the server since the editor opened (best-effort check).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateMonitoringProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config monitoring edit nr-main

`skopea config monitoring delete`

Delete a monitoring provider and its stored credential.

skopea config monitoring delete <providerId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteMonitoringProvider

Arguments

Argument	Description
`providerId`	Monitoring provider id.

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`deleteMonitoringProvider`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config monitoring delete nr-main
skopea config monitoring delete nr-main --yes --confirm nr-main

`skopea config ci test`

Test a CI provider's connection: a saved one, every saved one (--all), or unsaved credentials (--type ...). Writes nothing.

Exits 9 when a test fails; the provider's answer is still printed.

skopea config ci test [providerId] [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runCiProviderAction, runCiProvidersAction, listCiProviders

Arguments

Argument	Description
`providerId`	Saved provider id (omit with --all or --type).

Flags

Flag	Value	Description
`--all`		Test every saved provider, one after the other.
`--type`	`jenkins\|argocd\|codepipeline\|github-actions\|azure-devops\|bitbucket-pipelines\|gitlab-ci`	CI provider type (github-actions, azure-devops, bitbucket-pipelines and gitlab-ci are also git hosts).
`--url`	`VALUE`	Base URL of the provider.
`--user`	`VALUE`	User name the provider authenticates.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`runCiProviderAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`runCiProvidersAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config ci test jenkins-main
skopea config ci test --all
skopea config ci test --type gitlab-ci --url https://gitlab.com/acme/shop-api --token-file token.txt

`skopea config registry test`

Test a image registry's connection: a saved one, every saved one (--all), or unsaved credentials (--type ...). Writes nothing.

Exits 9 when a test fails; the provider's answer is still printed.

skopea config registry test [providerId] [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runRegistryProviderAction, runRegistryProvidersAction, listRegistryProviders

Arguments

Argument	Description
`providerId`	Saved provider id (omit with --all or --type).

Flags

Flag	Value	Description
`--all`		Test every saved provider, one after the other.
`--type`	`ecr\|ghcr\|dockerhub`	Registry type.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--owner`	`VALUE`	GHCR owner (user or organization).
`--namespace`	`VALUE`	Kubernetes namespace.
`--username`	`VALUE`	Docker Hub user name.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`runRegistryProviderAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`runRegistryProvidersAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config registry test ecr-main
skopea config registry test --all
skopea config registry test --type ghcr --owner acme --token-stdin

`skopea config monitoring test`

Test a monitoring provider's connection: a saved one, every saved one (--all), or unsaved credentials (--type ...). Writes nothing.

Exits 9 when a test fails; the provider's answer is still printed.

skopea config monitoring test [providerId] [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runMonitoringProviderAction, runMonitoringProvidersAction, listMonitoringProviders

Arguments

Argument	Description
`providerId`	Saved provider id (omit with --all or --type).

Flags

Flag	Value	Description
`--all`		Test every saved provider, one after the other.
`--type`	`cloudwatch\|newrelic`	Monitoring provider type.
`--account`	`VALUE`	Cloud account id.
`--region`	`VALUE`	Cloud region (for example eu-west-1).
`--api-key-stdin`		Read the New Relic API key from piped stdin.
`--api-key-file`	`PATH\|-`	Read the New Relic API key from a file. (not with --api-key-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`runMonitoringProviderAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`runMonitoringProvidersAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config monitoring test nr-main
skopea config monitoring test --all
skopea config monitoring test --type cloudwatch

`skopea config monitoring app list`

List the APM applications a New Relic provider knows.

skopea config monitoring app list <providerId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listMonitoringProviderApplications

Arguments

Argument	Description
`providerId`	Monitoring provider id (New Relic only).

Flags

Flag	Value	Description
`--search`	`VALUE`	Substring filter.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config monitoring app list nr-main --search webshop

`skopea config monitoring namespace list`

List the Kubernetes namespaces a New Relic provider reports on.

skopea config monitoring namespace list <providerId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listMonitoringProviderNamespaces

Arguments

Argument	Description
`providerId`	Monitoring provider id (New Relic only).

Flags

Flag	Value	Description
`--cluster-name`	`VALUE`	Only this cloud cluster (clusterName).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config monitoring namespace list nr-main --cluster-name eks-prod

`skopea config monitoring log-source list`

List the log sources a New Relic provider exposes.

skopea config monitoring log-source list <providerId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listMonitoringProviderLogSources

Arguments

Argument	Description
`providerId`	Monitoring provider id (New Relic only).

Flags

Flag	Value	Description
`--namespace`	`VALUE`	Kubernetes namespace.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config monitoring log-source list nr-main --namespace webshop-production

`skopea config credential get`

Say whether an organization-wide integration credential exists (never its value).

Project-scoped credentials cannot be read: the API takes that scope from the body of a GET (G7).

skopea config credential get <secretId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigSecretInfo

Arguments

Argument	Description
`secretId`	Credential type (for example jenkins-token).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config credential get jenkins-token

`skopea config credential set`

Create or OVERWRITE an integration credential; the value comes from stdin or a file, never argv.

skopea config credential set <secretId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: putConfigSecret

Arguments

Argument	Description
`secretId`	Credential type (for example jenkins-token).

Flags

Flag	Value	Description
`--value-stdin`		Read the credential value from piped stdin.
`--value-file`	`PATH\|-`	Read the credential value from a file. (not with --value-stdin)
`--url`	`VALUE`	Base URL of the provider.
`--user`	`VALUE`	User name the provider authenticates.
`--description`	`VALUE`	Free-text description.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`putConfigSecret`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config credential set jenkins-token --value-file token.txt --url https://jenkins.example.com --user ci
skopea config credential set jenkins-token --project webshop --value-stdin --yes --confirm jenkins-token

`skopea config credential delete`

Delete an integration credential (organization-wide, or of --project).

skopea config credential delete <secretId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigSecret

Arguments

Argument	Description
`secretId`	Credential type (for example jenkins-token).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`deleteConfigSecret`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config credential delete jenkins-token --project webshop

`skopea config credential test`

Test a legacy CI/CD connection with the stored {provider}-token, or a token from stdin or a file. Writes nothing.

skopea config credential test <provider> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runConfigSecretsAction

Arguments

Argument	Description
`provider`	Legacy CI/CD provider. One of: jenkins, argocd, github.

Flags

Flag	Value	Description
`--url`	`VALUE`	Base URL of the provider.
`--user`	`VALUE`	User name the provider authenticates.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`runConfigSecretsAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config credential test jenkins --url https://jenkins.example.com

`skopea config credential discover`

List the pipelines a legacy CI/CD provider exposes. Writes nothing.

skopea config credential discover <provider> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: createConfigSecretsDiscovery

Arguments

Argument	Description
`provider`	Legacy CI/CD provider. One of: jenkins, argocd, github.

Flags

Flag	Value	Description
`--path`	`A,B`	Folder or job path to list (for example folder/job); one path.
`--url`	`VALUE`	Base URL of the provider.
`--user`	`VALUE`	User name the provider authenticates.
`--token-stdin`		Read the provider token from piped stdin.
`--token-file`	`PATH\|-`	Read the provider token from a file. (not with --token-stdin)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createConfigSecretsDiscovery`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config credential discover jenkins --path folder/job

`skopea config export`

Export the whole registry as one v2.0 snapshot (projects, environments, clusters, accounts, units, settings).

The table shows the counts; -o json (or --out FILE, mode 0600) writes the snapshot, which config import reads back. Every stored field of every item is exported, declared by the contract or not.

skopea config export [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigSnapshot

Flags

Flag	Value	Description
`--out`	`VALUE`	Write the result to this file (mode 0600) instead of stdout.
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Examples

skopea config export --out registry.json
skopea config export -o json

`skopea config validate`

Validate a snapshot's structure on the server (writes nothing); exits 9 when it is not valid.

skopea config validate [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigSnapshotValidation

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createConfigSnapshotValidation`	org-admin or platform-admin — config/handler.handler rejects any caller failing is_global_admin(auth) with 403 'forbidden' before routing. That single boolean grants BOTH tiers: an admin over every project of their OWN organization (project='*', scoped by Permission.org_id) and a platform admin, who is transverse to all organizations. No per-project scoping.

Examples

skopea config validate --file registry.json

`skopea config import`

Import a snapshot: always previewed by the server first, then confirmed (merge upserts; replace CLEARS the registry).

--dry-run stops after the server's preview. replace needs the org slug re-typed (or --yes --confirm <org>) and writes the backup the server returns to a 0600 file, created BEFORE the replace is sent (an unwritable path is refused while nothing has changed).

skopea config import [flags]

Context: needs org; authenticated
Risk: changes live resources
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runConfigSnapshotAction

Flags

Flag	Value	Description
`--mode`	`merge\|replace`	merge upserts (default); replace CLEARS the registry first (a server backup is taken).
`--backup-out`	`VALUE`	Where to write the backup a replace import returns (mode 0600).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--dry-run`		Ask the server for a dry run (only where the contract has a dryRun field).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`runConfigSnapshotAction`	org-admin or platform-admin — config/handler.handler rejects any caller failing is_global_admin(auth) with 403 'forbidden' before routing. That single boolean grants BOTH tiers: an admin over every project of their OWN organization (project='*', scoped by Permission.org_id) and a platform admin, who is transverse to all organizations. No per-project scoping.

Examples

skopea config import --file registry.json --dry-run
skopea config import --file registry.json --yes
skopea config import --file registry.json --mode replace --yes --confirm acme

`skopea config access-source list`

List the Access Map sources: the declared ones and the implicit ones (Identity Center, IAM, Skopea, the registry's clusters and CI).

The map's view of each source (status, freshness, coverage) is skopea access source list.

skopea config access-source list [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml, jsonl (auto = table on a TTY, json otherwise)
API operations: listConfigAccessSources

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--columns`	`A,B`	Comma-separated columns to show, in order (table and markdown only).
`--sort`	`VALUE`	Sort rows by a column: COLUMN[:asc\|desc] (table and markdown only).
`--wide`		Also show the wide columns (table and markdown only).
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml\|jsonl`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`listConfigAccessSources`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source list
skopea config access-source list -o json

`skopea config access-source get`

Show one Access Map source, with the result of its last test (lastProbe), facet by facet.

skopea config access-source get <sourceId> [flags]

Context: needs org; authenticated
Risk: read-only
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: getConfigAccessSource

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`getConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source get jenkins-main
skopea config access-source get jenkins-main -o json

`skopea config access-source create`

Declare an Access Map source (credentials are references: ciProviderId, identityId or secretRef, never a value).

--file supplies the body ({"target": {…}, "credentials": {…}, "options": {…}}); --label, --cadence and --disabled set their fields (flags win). A target no implemented adapter reads is refused by the server, naming the adapter. 409 when the id already exists.

skopea config access-source create <sourceId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: createConfigAccessSource

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--label`	`VALUE`	Human label.
`--cadence`	`N`	Collection cadence in minutes, at least 5 (default: the adapter's). (min 5; max 10080)
`--disabled`		Declare the source disabled (it is not collected).
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`createConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source create jenkins-main --file jenkins-source.json
skopea config access-source create argocd-prd --file argocd.json --cadence 120 --yes

`skopea config access-source update`

Change a declared Access Map source (an implicit one is refused: it is switched off in settings.accessMap).

Prints a LOCAL diff against the stored declaration (not a server dry run), then confirms. Enabling and disabling are their own commands.

skopea config access-source update <sourceId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigAccessSource, getConfigAccessSource

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--label`	`VALUE`	Human label.
`--cadence`	`N`	Collection cadence in minutes, at least 5 (default: the adapter's). (min 5; max 10080)
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--file`, `-f`	`PATH\|-`	JSON request body from a file, or - for stdin. Flags win over file values.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`getConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source update jenkins-main --cadence 120
skopea config access-source update jenkins-main --file changes.json --yes

`skopea config access-source enable`

Enable a declared Access Map source: it is collected again at its cadence.

skopea config access-source enable <sourceId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigAccessSource, getConfigAccessSource

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`getConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source enable jenkins-main

`skopea config access-source disable`

Disable a declared Access Map source: it is no longer collected (its data leaves the map at the retention horizon).

skopea config access-source disable <sourceId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: updateConfigAccessSource, getConfigAccessSource

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`updateConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`getConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source disable jenkins-main --yes

`skopea config access-source test`

Test a source: queue a probe the collector runs at its next tick (within five minutes); the result lands in lastProbe.

Nothing is written to the registry. Read the result with skopea config access-source get <sourceId>.

skopea config access-source test <sourceId> [flags]

Context: needs org; authenticated
Risk: changes live resources (asks y/N on a TTY; --yes off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: runConfigAccessSourcesAction

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`runConfigAccessSourcesAction`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source test jenkins-main
skopea config access-source test jenkins-main --yes -o json

`skopea config access-source delete`

Delete a declared Access Map source (its data leaves the map at the retention horizon, max(24 h, 4 x cadence), never before).

An implicit source cannot be deleted: switch its family off in settings.accessMap.

skopea config access-source delete <sourceId> [flags]

Context: needs org; authenticated
Risk: destructive (re-type the target on a TTY; --yes --confirm <target> off a TTY)
Output: table, markdown, json, yaml (auto = table on a TTY, json otherwise)
API operations: deleteConfigAccessSource, getConfigAccessSource

Arguments

Argument	Description
`sourceId`	Access Map source id (a slug).

Flags

Flag	Value	Description
`--org`	`VALUE`	Organization slug.
`--project`	`VALUE`	Project id.
`--env`	`VALUE`	Environment id.
`--api-url`	`VALUE`	API origin (https required with a credential, except on loopback).
`--context`	`VALUE`	Named context to use.
`--yes`		Skip the interactive confirmation (never skips validation or permissions).
`--confirm`	`VALUE`	The target name, required with --yes on a destructive command.
`--output`, `-o`	`auto\|table\|markdown\|json\|yaml`	Output format (auto = table on a TTY, json otherwise).

Permissions (from the API contract)

Operation	RBAC
`deleteConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.
`getConfigAccessSource`	org-admin / platform-admin, or infra-admin (manage-infra at the org). A connection test with a STORED credential uses the STORED URL: a different URL needs the credential in the same request.

Examples

skopea config access-source delete jenkins-main
skopea config access-source delete jenkins-main --yes --confirm jenkins-main

Coverage

73 of 76 operations this domain owns have a command here.

Not yet implemented in the terminal (3):

Operation	Status
`v1PutConfigAllowedBindings`	not yet implemented
`v1PutConfigOrganizationUnitAllowedBindings`	not yet implemented
`v1RunConfigRetiredIdAction`	not yet implemented