CLI reference
Every omniglass command, generated from the binary’s own command tree. The data commands
are generated from the API (make gen), so this reference is a faithful mirror of
what the server exposes. For the narrative, connecting, authenticating, and the generated-versus-
hand-written split, see the CLI guide.
Global flags
Section titled “Global flags”Every command accepts these, each with an environment-variable default:
| Flag | Type | Default | Description |
|---|---|---|---|
--server | string | http://localhost:8080 | Omniglass server base URL (env OMNIGLASS_SERVER) |
--token | string | (none) | bearer token (env OMNIGLASS_TOKEN) |
omniglass audit-log
Section titled “omniglass audit-log”Commands for the audit-log resource
omniglass audit-log list
Section titled “omniglass audit-log list”List audit-trail events
omniglass audit-log list [flags]Recent audit-trail events, newest first, each with the actor and, for an impersonated action, the real actor behind it. Read-only; gated by audit:read:admin (admin/owner only, since the audit trail is admin-sensitive).
| Flag | Type | Default | Description |
|---|---|---|---|
--before | string | (none) | Only events strictly older than this RFC3339 timestamp (paging backward) |
--limit | int | 0 | Max rows to return, newest first (default 100, capped at 500) |
--resource | string | (none) | Filter to one resource kind (e.g. auth, principal_grant) |
--verb | string | (none) | Filter to one verb (e.g. login, create) |
Example:
omniglass audit-log listomniglass auth
Section titled “omniglass auth”Commands for the auth resource
omniglass auth avatar
Section titled “omniglass auth avatar”Get your own profile picture
omniglass auth avatarReturns the caller’s profile picture as a base64-encoded JPEG. Requires authentication; self-scoped. No picture is a 404.
Example:
omniglass auth avataromniglass auth change-password
Section titled “omniglass auth change-password”Change your own password
omniglass auth change-password [flags]Verifies the current password and sets a new one. Requires authentication; self-scoped.
| Flag | Type | Default | Description |
|---|---|---|---|
--current-password | string | (none) | Your current password |
--new-password | string | (none) | The new password (at least 12 characters, not a common password, not containing the username) |
Example:
omniglass auth change-password --current-password current_password --new-password new_passwordomniglass auth create-token
Section titled “omniglass auth create-token”Create one of your own API tokens
omniglass auth create-token [flags]Mints a CLI/API token for the caller and returns it once (store it now; it cannot be retrieved again). A description is required (what the token is for); an optional ttl_days bounds its lifetime (default 90, maximum 365). Requires authentication; self-scoped (always issued for you). The token is stamped with the device and address that created it.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | What the token is for (required) |
--ttl-days | string | (none) | Days until the token expires (default 90, maximum 365) |
Example:
omniglass auth create-token --description descriptionomniglass auth login
Section titled “omniglass auth login”Log in with a username and password
omniglass auth login [flags]Verifies a human’s password and sets an httpOnly session cookie. Public; a bad credential is a flat 401, and a correct password against a disabled account is a distinct 403 so the screen can explain it.
| Flag | Type | Default | Description |
|---|---|---|---|
--password | string | (none) | |
--username | string | (none) |
Example:
omniglass auth login --password password --username usernameomniglass auth logout
Section titled “omniglass auth logout”Log out the current session
omniglass auth logoutRevokes the session token and clears the cookie. Public.
Example:
omniglass auth logoutomniglass auth me
Section titled “omniglass auth me”The authenticated principal, its permissions, and grants
omniglass auth meReturns the caller’s principal, flattened permissions (a UI hint and the fast-reject set), and grants. Requires authentication.
Example:
omniglass auth meomniglass auth remove-avatar
Section titled “omniglass auth remove-avatar”Remove your own profile picture
omniglass auth remove-avatarClears the caller’s profile picture. Requires authentication; self-scoped.
Example:
omniglass auth remove-avataromniglass auth set-avatar
Section titled “omniglass auth set-avatar”Set your own profile picture
omniglass auth set-avatar [flags]Sets the caller’s profile picture (JPEG, PNG, or WebP, base64-encoded), normalized server-side to a 256x256 JPEG. Requires authentication; self-scoped. A bad or oversize image is a 422.
| Flag | Type | Default | Description |
|---|---|---|---|
--image-base64 | string | (none) | The image (JPEG, PNG, or WebP), base64-encoded; normalized server-side to a 256x256 JPEG |
Example:
omniglass auth set-avatar --image-base64 image_base64omniglass auth status
Section titled “omniglass auth status”Commands for the status resource
omniglass auth status list
Section titled “omniglass auth status list”Whether the system has an owner yet
omniglass auth status listPublic: reports whether any owner has been bootstrapped, so the login screen can hide the bootstrap hint.
Example:
omniglass auth status listomniglass auth stop-impersonation
Section titled “omniglass auth stop-impersonation”Stop the current impersonation session
omniglass auth stop-impersonationRevokes the impersonation session presented by the request token, ending the view-as / act-as. Requires an impersonation token.
Example:
omniglass auth stop-impersonationomniglass auth update-profile
Section titled “omniglass auth update-profile”Update your own profile
omniglass auth update-profile [flags]Updates the caller’s own display name (email is administrator-set). Requires authentication; self-scoped (edits only your own principal).
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | Your display name; empty clears it |
Example:
omniglass auth update-profileomniglass bootstrap
Section titled “omniglass bootstrap”Create the first owner (idempotent per username) and mint its bearer token
omniglass bootstrap <username> [flags]| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | owner display name (optional) |
--email | string | (none) | owner email (optional) |
--password | string | (none) | owner password, so the owner can sign in to the console (optional) |
--ttl | duration | 2160h0m0s | how long the bootstrap token is valid before it expires (max 365 days) |
omniglass capability
Section titled “omniglass capability”Commands for the capability resource
omniglass capability create
Section titled “omniglass capability create”Create a capability
omniglass capability create [flags]Creates a custom (non-official) capability. Gated by capability:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--name | string | (none) | The globally unique kebab handle; renameable |
Example:
omniglass capability create --display-name display_name --name nameomniglass capability delete
Section titled “omniglass capability delete”Delete a capability
omniglass capability delete <id>Deletes a custom capability, refused if official (422). Gated by capability:delete.
Example:
omniglass capability delete <id>omniglass capability get
Section titled “omniglass capability get”Get a capability
omniglass capability get <id>Fetches a capability by id. Gated by capability:read.
Example:
omniglass capability get <id>omniglass capability list
Section titled “omniglass capability list”List capabilities
omniglass capability listLists the capability registry, ordered alphabetically by display name. Populates the capability picker on the product form. Gated by capability:read.
Example:
omniglass capability listomniglass capability update
Section titled “omniglass capability update”Update a capability
omniglass capability update <id> [flags]Patches a custom capability’s display_name. Official capabilities are read-only (422). Gated by capability:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) |
Example:
omniglass capability update <id>omniglass component
Section titled “omniglass component”Commands for the component resource
omniglass component alarm
Section titled “omniglass component alarm”Commands for the alarm resource
omniglass component alarm create
Section titled “omniglass component alarm create”Raise an alarm on a component
omniglass component alarm create <name> [flags]Records a condition on this component and the capabilities it degrades, then recomputes health in the same transaction: any role requiring a degraded capability can no longer be filled by this component, and its system and location verdicts move with it. An unknown capability is a 422. Gated by component:update; an out-of-scope component is a non-disclosing 404.
| Flag | Type | Default | Description |
|---|---|---|---|
--capabilities | string | (none) | The capabilities this condition degrades; a role requiring one of them can no longer be filled by this component |
--message | string | (none) | What is wrong, for the operator reading it later |
--severity | string | (none) | How bad it is; critical puts the component itself in outage |
Example:
omniglass component alarm create <name> --severity severityomniglass component alarm delete
Section titled “omniglass component alarm delete”Clear an alarm
omniglass component alarm delete <name> <id>Marks the alarm cleared and recomputes health in the same transaction, so the recovery is recorded as a transition at the moment it happened. The row is kept: what was wrong and when outlives the fix. Clearing an alarm that is already cleared or does not exist is a 404. Gated by component:update; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component alarm delete <name> <id>omniglass component alarm list
Section titled “omniglass component alarm list”List a component’s alarms
omniglass component alarm list <name> [flags]What is currently wrong with this component, newest first, each with the capabilities it degrades. Pass include_cleared for the history rather than the active set. Gated by component:read; an out-of-scope component is a non-disclosing 404.
| Flag | Type | Default | Description |
|---|---|---|---|
--include-cleared | bool | false | Include cleared alarms, so the list is the history rather than what is wrong now |
Example:
omniglass component alarm list <name>omniglass component capability
Section titled “omniglass component capability”Commands for the capability resource
omniglass component capability delete
Section titled “omniglass component capability delete”Clear a capability declaration on a component
omniglass component capability delete <name> <capability>Removes the component’s own fact about the capability, so it falls back to whatever its product declares. Clearing a fact the component never declared is a 404. Gated by component:update; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component capability delete <name> <capability>omniglass component capability list
Section titled “omniglass component capability list”List a component’s effective capabilities
omniglass component capability list <name>What this component actually provides: the capabilities its product declares, plus the ones the component adds, minus the ones it suppresses. This is the set the role-assignment guard checks, so a productless component that declares its own can still be staffed. Gated by component:read; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component capability list <name>omniglass component capability update
Section titled “omniglass component capability update”Declare a capability on a component
omniglass component capability update <name> <capability> [flags]Records this component’s own fact about a capability: present true adds one its product does not claim, present false suppresses one it does. Idempotent. An unknown capability is a 422; an unknown or out-of-scope component is a non-disclosing 404 (the component is resolved in scope first). Gated by component:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--present | string | (none) | True to add the capability, false to suppress one the product declares |
Example:
omniglass component capability update <name> <capability> --present presentomniglass component checkName
Section titled “omniglass component checkName”Check a component technical name
omniglass component checkName [flags]Reports whether a proposed technical name is a valid slug and currently free. Advisory (Save is still gated by the unique constraint). Availability is scope-blind to match the global unique constraint. Gated by component:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--name | string | (none) | The proposed technical name to check |
Example:
omniglass component checkName --name nameomniglass component create
Section titled “omniglass component create”Create a component
omniglass component create [flags]Creates a component, optionally under a parent (a root needs an all-scoped grant), bound to a system and a location. Gated by component:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--location | string | (none) | Location name this component is placed at |
--name | string | (none) | Globally unique name (the address; lowercase letters, digits, hyphens) |
--parent | string | (none) | Parent component name; omit for a root component |
--product | string | (none) | Product id (catalog SKU) this component is an instance of |
--system | string | (none) | Primary system name this component belongs to |
Example:
omniglass component create --name nameomniglass component delete
Section titled “omniglass component delete”Delete a component
omniglass component delete <name>Deletes a component, refused (409) while it still has child components or is still referenced elsewhere, such as by a system role it staffs. Gated by component:delete; read and delete scopes drive the 404 versus 403 split.
Example:
omniglass component delete <name>omniglass component effective-secret
Section titled “omniglass component effective-secret”Commands for the effective-secret resource
omniglass component effective-secret list
Section titled “omniglass component effective-secret list”Effective secrets for a component
omniglass component effective-secret list <name>Resolves the secrets that cascade onto a component (platform -> location -> component), with the winner and the shadowed candidates it overrode. There is NO system band: a secret is device-facing, and the room a component happens to serve is the wrong owner for a credential the device itself answers with. Fields are masked, as in the directory; plaintext is only ever the audited reveal. Gated by secret:read, which the viewer floor does not carry, and admin-sensitive secrets appear only to the admin tier.
Example:
omniglass component effective-secret list <name>omniglass component effective-tag
Section titled “omniglass component effective-tag”Commands for the effective-tag resource
omniglass component effective-tag list
Section titled “omniglass component effective-tag list”Effective tags for a component
omniglass component effective-tag list <name> [flags]Resolves the tags that cascade onto a component (platform -> location -> system -> component): keys union, values override most-specific-wins, with the winner and shadowed candidates. A non-propagating key resolves only from a binding on the component itself. The system band comes from MEMBERSHIP: pass ?system= to resolve against one the component belongs to (a shared device answers differently for each), or omit it to resolve against its primary membership. Gated by component:read; the component must be in the caller’s component read scope.
| Flag | Type | Default | Description |
|---|---|---|---|
--system | string | (none) | Resolve against this system, which the component must be a member of. Omit to resolve against its primary membership, the default for a caller with no system in hand. |
Example:
omniglass component effective-tag list <name>omniglass component effective-variable
Section titled “omniglass component effective-variable”Commands for the effective-variable resource
omniglass component effective-variable list
Section titled “omniglass component effective-variable list”Effective variables for a component
omniglass component effective-variable list <name>Resolves the variables that cascade onto a component (platform -> location -> system -> component): names union, values override most-specific-wins, with the winner and the shadowed candidates it overrode. The system band comes from the component’s PRIMARY membership; resolving against a named system is not offered here yet, unlike effective-tags. Gated by variable:read; the component must be in the caller’s component read scope.
Example:
omniglass component effective-variable list <name>omniglass component event
Section titled “omniglass component event”Commands for the event resource
omniglass component event list
Section titled “omniglass component event list”List a component’s recent events
omniglass component event list <name>Returns the component’s recent log occurrences (the log-kind sink), newest first, bounded to the last 24 hours. Gated by component:read; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component event list <name>omniglass component get
Section titled “omniglass component get”Get a component
omniglass component get <name>Fetches a component by name within the caller’s read scope. Out of scope is a non-disclosing 404. Gated by component:read.
Example:
omniglass component get <name>omniglass component list
Section titled “omniglass component list”List components in scope
omniglass component listLists the components the caller may read, each filtered to its scope subtree. Gated by component:read.
Example:
omniglass component listomniglass component listTags
Section titled “omniglass component listTags”List tags on a component
omniglass component listTags <name>Lists the tags bound directly on a component (not the resolved cascade). Gated by component:read.
Example:
omniglass component listTags <name>omniglass component membership
Section titled “omniglass component membership”Commands for the membership resource
omniglass component membership list
Section titled “omniglass component membership list”List the systems a component is in
omniglass component membership list <name>The systems this component is bound into, ordered by name. A component may belong to several: a rack DSP serving three rooms is a member of all three, and each of them depends on it. Exactly one membership may be marked primary, the default for a question asked without a system in hand. Gated by component:read; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component membership list <name>omniglass component property
Section titled “omniglass component property”Commands for the property resource
omniglass component property delete
Section titled “omniglass component property delete”Clear a property on a component
omniglass component property delete <name> <property>Removes the component’s declared value, so the property falls back to the product contract’s default (or leaves the effective read entirely when it was off-contract). Clearing a property the component never set is a 404. Gated by component:update; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component property delete <name> <property>omniglass component property list
Section titled “omniglass component property list”List a component’s effective properties
omniglass component property list <name>Every property the component’s product declares, resolved to the component’s own value or the contract default (is_set marks the override), plus any property set directly on the component (from_contract false). Gated by component:read; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component property list <name>omniglass component property update
Section titled “omniglass component property update”Set a property on a component
omniglass component property update <name> <property> [flags]Declares a value for the property on this component, overriding the product contract’s default. Idempotent: the first set stores the value, a later set replaces it. The property need not be on the contract, but it must exist in the catalog (422 otherwise). Gated by component:update; an out-of-scope component is a non-disclosing 404.
| Flag | Type | Default | Description |
|---|---|---|---|
--value | string | (none) | The value to declare, shape given by the property’s data_type |
Example:
omniglass component property update <name> <property> --value valueomniglass component reachability
Section titled “omniglass component reachability”Commands for the reachability resource
omniglass component reachability list
Section titled “omniglass component reachability list”Read a component’s per-interface reachability
omniglass component reachability list <name>Composes, per interface, the latest reachability verdict, the probe-layer signals that compose it, and the recent verdict transitions for the availability strip. Gated by component:read; an out-of-scope component is a non-disclosing 404.
Example:
omniglass component reachability list <name>omniglass component removeTag
Section titled “omniglass component removeTag”Remove a tag value from a component
omniglass component removeTag <name> [flags]Removes a key’s value from a component. Gated by component:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key to remove |
Example:
omniglass component removeTag <name> --key keyomniglass component setTag
Section titled “omniglass component setTag”Set a tag value on a component
omniglass component setTag <name> [flags]Binds a value for a key on a component. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by component:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key (must exist and apply to this kind) |
--value | string | (none) | The bound value |
Example:
omniglass component setTag <name> --key key --value valueomniglass component update
Section titled “omniglass component update”Update a component
omniglass component update <name> [flags]Patches a component’s technical name or display_name. Gated by component:update; read and update scopes drive the 404 versus 403 split.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--name | string | (none) | A new globally unique technical name (rename) |
Example:
omniglass component update <name>omniglass driver
Section titled “omniglass driver”Commands for the driver resource
omniglass driver create
Section titled “omniglass driver create”Create a driver
omniglass driver create [flags]Creates a custom (non-official) driver. Gated by driver:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--name | string | (none) | The globally unique kebab handle; renameable |
--version | string | (none) |
Example:
omniglass driver create --display-name display_name --name nameomniglass driver delete
Section titled “omniglass driver delete”Delete a driver
omniglass driver delete <id>Deletes a custom driver, refused if official (422). Gated by driver:delete.
Example:
omniglass driver delete <id>omniglass driver get
Section titled “omniglass driver get”Get a driver
omniglass driver get <id>Fetches a driver by id. Gated by driver:read.
Example:
omniglass driver get <id>omniglass driver list
Section titled “omniglass driver list”List drivers
omniglass driver listLists the driver registry, ordered alphabetically by display name. Populates the driver picker on the product form. Gated by driver:read.
Example:
omniglass driver listomniglass driver update
Section titled “omniglass driver update”Update a driver
omniglass driver update <id> [flags]Patches a custom driver’s display_name or version. Official drivers are read-only (422). Gated by driver:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--version | string | (none) |
Example:
omniglass driver update <id>omniglass file
Section titled “omniglass file”Commands for the file resource
omniglass file create
Section titled “omniglass file create”Create a file from an upload
omniglass file create [flags]Stores the uploaded bytes as a content-addressed blob (identical bytes dedup to one blob) and writes the file handle pointing at it. Gated by file:create; a sensitive file additionally needs the admin tier (file:create:admin).
| Flag | Type | Default | Description |
|---|---|---|---|
--content | string | (none) | The file bytes, base64-encoded |
--content-type | string | (none) | The MIME type used to serve the file |
--name | string | (none) | The file’s display name (a label, no path separators) |
--sensitive | string | (none) | Admin-only visibility; defaults false. Setting true requires the admin tier |
Example:
omniglass file create --content content --content-type content_type --name nameomniglass file delete
Section titled “omniglass file delete”Delete a file
omniglass file delete <id>Removes a file handle. The underlying blob is left in place (garbage collection is a later slice). A sensitive file is a non-disclosing 404 without the admin tier. Gated by file:delete.
Example:
omniglass file delete <id>omniglass file download
Section titled “omniglass file download”Download a file’s bytes
omniglass file download <id>Returns a file’s bytes (base64-encoded) read from the blob it points at, the hash verified on read. A sensitive file is a non-disclosing 404 without the admin tier. Gated by file:read.
Example:
omniglass file download <id>omniglass file get
Section titled “omniglass file get”Get a file’s metadata
omniglass file get <id>Returns one file handle’s searchable metadata (no bytes). A sensitive file is a non-disclosing 404 without the admin tier. Gated by file:read.
Example:
omniglass file get <id>omniglass file list
Section titled “omniglass file list”List files
omniglass file listLists the file handles the caller may see (searchable metadata, no bytes). Sensitive files appear only to the admin tier. Gated by file:read.
Example:
omniglass file listomniglass healthz
Section titled “omniglass healthz”Liveness and database-reachability probe
omniglass healthzReports process health and the database leg, pinged through the Storage Gateway.
Example:
omniglass healthzomniglass interface
Section titled “omniglass interface”Commands for the interface resource
omniglass interface create
Section titled “omniglass interface create”Create an interface
omniglass interface create [flags]Creates an interface owned by a component (or a server-hosted one, which needs an all-scoped grant). The create scope cascades through the owning component. Gated by interface:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--component | string | (none) | Owning component, by name or id; omit for a server-hosted interface (needs an all-scoped grant) |
--interface-type | string | (none) | An interface_type name (the protocol); the interface is named by it, unique within the component |
--node | string | (none) | Node placement, by name or id |
--params | string | (none) | Endpoint/target settings (jsonb) |
Example:
omniglass interface create --interface-type interface_typeomniglass interface delete
Section titled “omniglass interface delete”Delete an interface
omniglass interface delete <id>Deletes an interface, refused while a task still references it. Gated by interface:delete; read and delete scopes (through the component) drive the 404 versus 403 split.
Example:
omniglass interface delete <id>omniglass interface get
Section titled “omniglass interface get”Get an interface
omniglass interface get <id>Fetches an interface by id. An interface whose component is out of the caller’s read scope is a non-disclosing 404. Gated by interface:read.
Example:
omniglass interface get <id>omniglass interface list
Section titled “omniglass interface list”List interfaces in scope
omniglass interface listLists the interfaces whose owning component the caller may read (the component cascade). Gated by interface:read.
Example:
omniglass interface listomniglass interface update
Section titled “omniglass interface update”Update an interface
omniglass interface update <id> [flags]Patches an interface’s node placement or params. Gated by interface:update; read and update scopes (through the component) drive the 404 versus 403 split.
| Flag | Type | Default | Description |
|---|---|---|---|
--node | string | (none) | Reassign the node placement, by name or id |
--params | string | (none) | Replace the endpoint/target settings (jsonb) |
Example:
omniglass interface update <id>omniglass location
Section titled “omniglass location”Commands for the location resource
omniglass location checkName
Section titled “omniglass location checkName”Check a location technical name
omniglass location checkName [flags]Reports whether a proposed technical name is a valid slug and currently free. Advisory (Save is still gated by the unique constraint). Availability is scope-blind to match the global unique constraint. Gated by location:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--name | string | (none) | The proposed technical name to check |
Example:
omniglass location checkName --name nameomniglass location create
Section titled “omniglass location create”Create a location
omniglass location create [flags]Creates a location, optionally under a parent (a root needs an all-scoped grant). Gated by location:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--location-type | string | (none) | A location_type id (campus, building, …) |
--name | string | (none) | Globally unique name (the address; lowercase letters, digits, hyphens) |
--parent | string | (none) | Parent location name; omit for a root location |
Example:
omniglass location create --location-type location_type --name nameomniglass location delete
Section titled “omniglass location delete”Delete a location
omniglass location delete <name>Deletes a location, refused (409) while it still has child locations or is still referenced elsewhere. Gated by location:delete; read and delete scopes drive the 404 versus 403 split.
Example:
omniglass location delete <name>omniglass location get
Section titled “omniglass location get”Get a location
omniglass location get <name>Fetches a location by name within the caller’s read scope. Out of scope is a non-disclosing 404. Gated by location:read.
Example:
omniglass location get <name>omniglass location health
Section titled “omniglass location health”Commands for the health resource
omniglass location health list
Section titled “omniglass location health list”Read a location’s health
omniglass location health list <name>The location’s current verdict, worst-wins over every system placed anywhere beneath it, with those systems and their verdicts as the drill-down (the system health read names the role, the capability, and the alarm). Transitions are the recorded edges over the last 30 days. Gated by location:read; an out-of-scope location is a non-disclosing 404.
Example:
omniglass location health list <name>omniglass location list
Section titled “omniglass location list”List locations in scope
omniglass location listLists the locations the caller may read, each filtered to its scope subtree. Gated by location:read.
Example:
omniglass location listomniglass location listTags
Section titled “omniglass location listTags”List tags on a location
omniglass location listTags <name>Lists the tags bound directly on a location (not the resolved cascade). Gated by location:read.
Example:
omniglass location listTags <name>omniglass location property
Section titled “omniglass location property”Commands for the property resource
omniglass location property delete
Section titled “omniglass location property delete”Clear a property on a location
omniglass location property delete <name> <property>Removes the location’s declared value, so the property falls back to the location type contract’s default (or leaves the effective read entirely when it was off-contract). Clearing a property the location never set is a 404. Gated by location:update; an out-of-scope location is a non-disclosing 404.
Example:
omniglass location property delete <name> <property>omniglass location property list
Section titled “omniglass location property list”List a location’s effective properties
omniglass location property list <name>Every property the location’s type declares, resolved to the location’s own value or the contract default (is_set marks the override), plus any property set directly on the location (from_contract false). Gated by location:read; an out-of-scope location is a non-disclosing 404.
Example:
omniglass location property list <name>omniglass location property update
Section titled “omniglass location property update”Set a property on a location
omniglass location property update <name> <property> [flags]Declares a value for the property on this location, overriding the location type contract’s default. Idempotent: the first set stores the value, a later set replaces it. The property need not be on the contract, but it must exist in the catalog (422 otherwise). Gated by location:update; an out-of-scope location is a non-disclosing 404.
| Flag | Type | Default | Description |
|---|---|---|---|
--value | string | (none) | The value to declare, shape given by the property’s data_type |
Example:
omniglass location property update <name> <property> --value valueomniglass location removeTag
Section titled “omniglass location removeTag”Remove a tag value from a location
omniglass location removeTag <name> [flags]Removes a key’s value from a location. Gated by location:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key to remove |
Example:
omniglass location removeTag <name> --key keyomniglass location setTag
Section titled “omniglass location setTag”Set a tag value on a location
omniglass location setTag <name> [flags]Binds a value for a key on a location. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by location:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key (must exist and apply to this kind) |
--value | string | (none) | The bound value |
Example:
omniglass location setTag <name> --key key --value valueomniglass location update
Section titled “omniglass location update”Update a location
omniglass location update <name> [flags]Patches a location’s display_name, location_type, or parent (a move). Gated by location:update; the read and update scopes drive the 404 versus 403 split.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--location-type | string | (none) | |
--name | string | (none) | A new globally unique technical name (rename) |
--parent | string | (none) | Re-parents the location (a tree move) to this location name, cycle-guarded and placement-validated. Moving to root is not supported via update this slice. |
Example:
omniglass location update <name>omniglass location-type
Section titled “omniglass location-type”Commands for the location-type resource
omniglass location-type create
Section titled “omniglass location-type create”Create a location type
omniglass location-type create [flags]Creates a custom (non-official) location_type. Gated by type:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--allowed-parent-types | string | (none) | location_type ids and/or the reserved root sentinel this type may be placed under; empty means unconstrained |
--display-name | string | (none) | |
--icon | string | (none) | A glyph key; the console falls back to map-pin when empty |
--name | string | (none) | The globally unique kebab handle (e.g. wing); “root” is reserved |
Example:
omniglass location-type create --display-name display_name --name nameomniglass location-type delete
Section titled “omniglass location-type delete”Delete a location type
omniglass location-type delete <id>Deletes a custom location_type, refused if official (422) or still referenced by a location (409). Gated by type:delete.
Example:
omniglass location-type delete <id>omniglass location-type list
Section titled “omniglass location-type list”List location types
omniglass location-type listLists the location_type registry (the shape-definers a location is classified by), ordered alphabetically by display name. Populates the type picker on the location form. Gated by type:read.
Example:
omniglass location-type listomniglass location-type property
Section titled “omniglass location-type property”Commands for the property resource
omniglass location-type property delete
Section titled “omniglass location-type property delete”Withdraw a property from a location type
omniglass location-type property delete <id> <property>Removes one line from a custom location type’s contract; locations of the type keep any value they set for it, now off-contract. A property the type does not declare is a 404, and an official type is read-only (422). Gated by type:delete.
Example:
omniglass location-type property delete <id> <property>omniglass location-type property list
Section titled “omniglass location-type property list”List a location type’s declared properties
omniglass location-type property list <id>Lists the location type’s declared-property contract (what every location of the type exposes), ordered by property name, each with its optional default and required flag. Gated by type:read.
Example:
omniglass location-type property list <id>omniglass location-type property update
Section titled “omniglass location-type property update”Declare a property on a location type
omniglass location-type property update <id> <property> [flags]Declares a catalog property on a custom location type, or revises the declaration in place (the line is addressed by name, so the write is idempotent). Official location types are read-only (422); an unknown type is a 404 and a property the catalog does not know is a 422. Gated by type:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--default-value | string | (none) | The contract default, validated against the property’s data_type; omit for no default |
--required | string | (none) | Whether every location of this type must set the property; defaults to false |
Example:
omniglass location-type property update <id> <property>omniglass location-type update
Section titled “omniglass location-type update”Update a location type
omniglass location-type update <id> [flags]Patches a custom location_type’s display_name or icon. Official types are read-only (422). Gated by type:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--allowed-parent-types | string | (none) | Replaces the allowed-parent set; omit to leave unchanged, [] to clear back to unconstrained |
--display-name | string | (none) | |
--icon | string | (none) |
Example:
omniglass location-type update <id>omniglass migrate
Section titled “omniglass migrate”Apply embedded database migrations (dbmate)
omniglass migrateomniglass node
Section titled “omniglass node”Commands for the node resource
omniglass node claim
Section titled “omniglass node claim”Claim a node identity in exchange for its NATS credential
omniglass node claim [flags]The node-facing exchange: a node presents its enrollment token and receives its NATS credential (url, username, password). Public (the token is the authentication); an invalid token is a 401.
| Flag | Type | Default | Description |
|---|---|---|---|
--name | string | (none) | |
--token | string | (none) |
Example:
omniglass node claim --name name --token tokenomniglass node create
Section titled “omniglass node create”Create a node
omniglass node create [flags]Registers an edge node server-side (day-one enrollment: create, then :enroll to mint its token). Gated by node:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | |
--display-name | string | (none) | Operator label; falls back to the name when empty |
--location | string | (none) | Optional location the node sits in, by name or id (descriptive placement, not scope) |
--name | string | (none) | Globally unique node name (also its NATS subject token, so no dots or whitespace) |
Example:
omniglass node create --name nameomniglass node delete
Section titled “omniglass node delete”Delete a node
omniglass node delete <name>Decommissions a node: a hard delete that cascades its interfaces, their derived tasks, its node-owned tags and self-telemetry, and its enrollment credential. Component telemetry it collected is unaffected. Requires an all-scope action. Gated by node:delete.
Example:
omniglass node delete <name>omniglass node enroll
Section titled “omniglass node enroll”Mint a node’s enrollment token
omniglass node enroll <name>Mints (or re-mints) the node’s enrollment token and returns it once. The token is stored only as a hash; it is never logged. Gated by node:enroll.
Example:
omniglass node enroll <name>omniglass node get
Section titled “omniglass node get”Get a node
omniglass node get <name>Fetches a node by name. Requires an all-scope read. Gated by node:read.
Example:
omniglass node get <name>omniglass node list
Section titled “omniglass node list”List nodes
omniglass node listLists the edge nodes. A node is estate-wide, so listing requires an all-scope read. Gated by node:read.
Example:
omniglass node listomniglass node listTags
Section titled “omniglass node listTags”List tags on a node
omniglass node listTags <name>Lists the tags bound directly on a node (not the resolved cascade). Gated by node:read.
Example:
omniglass node listTags <name>omniglass node removeTag
Section titled “omniglass node removeTag”Remove a tag value from a node
omniglass node removeTag <name> [flags]Removes a key’s value from a node. Gated by node:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key to remove |
Example:
omniglass node removeTag <name> --key keyomniglass node run
Section titled “omniglass node run”Run the edge node: claim, pull the worklist, and heartbeat over NATS
omniglass node run [flags]| Flag | Type | Default | Description |
|---|---|---|---|
--heartbeat | duration | 30s | heartbeat interval |
--name | string | (none) | this node’s registered name (env OMNIGLASS_NODE_NAME) |
--once | bool | false | run a single claim + pull + heartbeat cycle and exit |
--server | string | (none) | Omniglass server base URL (env OMNIGLASS_SERVER) |
--token | string | (none) | enrollment token from POST /nodes/{name}:enroll (env OMNIGLASS_NODE_TOKEN) |
omniglass node setTag
Section titled “omniglass node setTag”Set a tag value on a node
omniglass node setTag <name> [flags]Binds a value for a key on a node. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by node:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key (must exist and apply to this kind) |
--value | string | (none) | The bound value |
Example:
omniglass node setTag <name> --key key --value valueomniglass node update
Section titled “omniglass node update”Update a node
omniglass node update <name> [flags]Patches a node’s display name, description, and location (a nil field is unchanged; a location of "" clears it). The name is immutable. Requires an all-scope action. Gated by node:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | |
--display-name | string | (none) | |
--location | string | (none) | Set the node’s location by name or id, or "" to clear it |
Example:
omniglass node update <name>omniglass principal
Section titled “omniglass principal”Commands for the principal resource
omniglass principal archive
Section titled “omniglass principal archive”Archive a principal
omniglass principal archive <id>Soft-deletes a principal: it is hidden from the directory, can no longer authenticate, and its rows stay intact, reversibly (restore) until purged. Gated by principal:archive (all-scope). The last active owner cannot be archived.
Example:
omniglass principal archive <id>omniglass principal avatar
Section titled “omniglass principal avatar”Commands for the avatar resource
omniglass principal avatar list
Section titled “omniglass principal avatar list”Get a principal’s profile picture
omniglass principal avatar list <id>Returns the principal’s profile picture as a base64-encoded JPEG. Gated by principal:read:admin. A principal without a picture is a 404.
Example:
omniglass principal avatar list <id>omniglass principal create
Section titled “omniglass principal create”Create a human principal
omniglass principal create [flags]Creates a human principal with an optional initial password. Gated by principal:create (all-scope). The new principal holds no grants; assign roles separately.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--email | string | (none) | |
--password | string | (none) | Optional initial password (at least 12 characters, not a common password, not containing the username); the user changes it after signing in |
--username | string | (none) | Unique sign-in name (lowercase letters, digits, and . _ -) |
Example:
omniglass principal create --username usernameomniglass principal disable
Section titled “omniglass principal disable”Disable a principal
omniglass principal disable <id>Soft-disables a principal so it can no longer authenticate; its audit trail is kept. Gated by principal:update (all-scope). The last active owner cannot be disabled.
Example:
omniglass principal disable <id>omniglass principal enable
Section titled “omniglass principal enable”Enable a principal
omniglass principal enable <id>Re-enables a disabled principal, restoring its ability to authenticate. Gated by principal:update (all-scope).
Example:
omniglass principal enable <id>omniglass principal get
Section titled “omniglass principal get”Get a principal
omniglass principal get <id>Fetches one principal by id with its profile and grants. Gated by principal:read:admin.
Example:
omniglass principal get <id>omniglass principal grant
Section titled “omniglass principal grant”Commands for the grant resource
omniglass principal grant create
Section titled “omniglass principal grant create”Grant a role to a principal
omniglass principal grant create <id> [flags]Assigns a role at a scope to a principal. Gated by principal_grant:create (all-scope). Refused (403) when the granted role’s capabilities exceed the granter’s own (no promoting anyone, including yourself, to a higher tier such as owner). A duplicate is 409, an unknown role or bad scope 422.
| Flag | Type | Default | Description |
|---|---|---|---|
--role | string | (none) | A role id (viewer, operator, admin, owner, or a custom role) |
--scope-id | string | (none) | The scope root id; omit for the all scope |
--scope-kind | string | (none) | The scope kind; ‘all’ confers the whole estate |
--scope-op | string | (none) | How the scope root matches the tree: subtree (root + descendants, the default), subtree_excl_root (descendants only for update/delete, root kept for read/create), or self (the root row only). Moot for the all scope. |
Example:
omniglass principal grant create <id> --role role --scope-kind scope_kindomniglass principal grant delete
Section titled “omniglass principal grant delete”Revoke a grant
omniglass principal grant delete <id> <grantId>Removes one grant from a principal. Gated by principal_grant:delete (all-scope). The last owner grant cannot be revoked.
Example:
omniglass principal grant delete <id> <grantId>omniglass principal impersonate
Section titled “omniglass principal impersonate”Impersonate a principal (view-as or act-as)
omniglass principal impersonate <id> [flags]Mints a bounded, revocable token to view as (read-only) or act as (full) the target. Gated by principal:impersonate (all-scope). Refused on self, on an owner target (owners are un-impersonatable by anyone), when it would grant a capability the caller lacks (the escalation guard), or from within an existing impersonation.
| Flag | Type | Default | Description |
|---|---|---|---|
--duration-minutes | string | (none) | Session lifetime in minutes (default 30, max 1440) |
--mode | string | (none) | view_as is read-only; act_as is full, with mutations attributed to both the real actor and the impersonated principal |
Example:
omniglass principal impersonate <id> --mode modeomniglass principal list
Section titled “omniglass principal list”List principals
omniglass principal list [flags]Lists all principals (humans and service accounts) with their grants. Gated by principal:read:admin.
| Flag | Type | Default | Description |
|---|---|---|---|
--include-archived | bool | false | Include archived (soft-deleted) principals, hidden by default |
--kind | string | (none) | Optionally filter by principal kind |
Example:
omniglass principal listomniglass principal purge
Section titled “omniglass principal purge”Purge a principal
omniglass principal purge <id>Hard-deletes an archived principal and its owned rows (profile, credentials, grants, memberships); the audit trail is preserved. Irreversible. Gated by principal:purge (admin-sensitive, all-scope), and the principal must be archived first.
Example:
omniglass principal purge <id>omniglass principal removeAvatar
Section titled “omniglass principal removeAvatar”Remove a principal’s profile picture
omniglass principal removeAvatar <id>Clears another human principal’s profile picture. Gated by principal:set-avatar (all-scope). Removing an absent picture is a no-op. Audited with the administrator as the actor.
Example:
omniglass principal removeAvatar <id>omniglass principal resetPassword
Section titled “omniglass principal resetPassword”Reset a principal’s password
omniglass principal resetPassword <id> [flags]Sets a new password for another human principal (an administrator action; the target’s current password is not required). Gated by principal:reset-password (all-scope). The new password must meet the password policy; a violation is a 422. Refused on yourself (change your own password from your profile, which verifies your current one), on an owner (owners cannot be reset by anyone), or when it would exceed the caller’s own capabilities (the takeover guard, shared with impersonation). The action is audited with the administrator as the actor.
| Flag | Type | Default | Description |
|---|---|---|---|
--password | string | (none) | The new password (at least 12 characters, not a common password, not containing the username) |
Example:
omniglass principal resetPassword <id> --password passwordomniglass principal restore
Section titled “omniglass principal restore”Restore a principal
omniglass principal restore <id>Reverses an archive: the account is restored to active and can authenticate again. Gated by principal:archive (all-scope).
Example:
omniglass principal restore <id>omniglass principal session
Section titled “omniglass principal session”Commands for the session resource
omniglass principal session list
Section titled “omniglass principal session list”List a principal’s sessions
omniglass principal session list <id>Lists another principal’s active bearer credentials (login sessions and API tokens) with their non-secret metadata, newest first, so an administrator can see where an account is signed in and revoke a session that should not be. Gated by principal:revoke-session (all-scope). The token secret is never returned, and current is always false (there is no “this request’s own session” when viewing another principal).
Example:
omniglass principal session list <id>omniglass principal session revoke
Section titled “omniglass principal session revoke”Revoke a principal’s session
omniglass principal session revoke <id> <sid>Revokes one of another principal’s sessions or tokens by id (an administrator action; the target is immediately signed out of that credential). Gated by principal:revoke-session (all-scope). Bounded to the target, so a credential id that is not theirs is a non-disclosing 404, never a cross-principal revoke. Refused (403) on an owner (an owner’s sessions cannot be revoked by anyone, the takeover guard shared with impersonation and password reset) or when it would exceed the caller’s own capabilities. Audited with the administrator as the actor.
Example:
omniglass principal session revoke <id> <sid>omniglass principal session revokeAll
Section titled “omniglass principal session revokeAll”Revoke all of a principal’s sessions or tokens
omniglass principal session revokeAll <id> [flags]Revokes every one of another principal’s web-login sessions, or every one of its CLI/API tokens (chosen by purpose), in a single administrator action, returning how many were ended. Gated by principal:revoke-session (all-scope). Bounded to the target and never crosses purpose (revoking sessions leaves tokens, and vice versa). Refused (403) on an owner (the takeover guard shared with impersonation and the password reset) or when it would exceed the caller’s own capabilities. Audited with the administrator as the actor.
| Flag | Type | Default | Description |
|---|---|---|---|
--purpose | string | (none) | Which credentials to revoke: all of the principal’s web-login sessions, or all its CLI/API tokens |
Example:
omniglass principal session revokeAll <id> --purpose purposeomniglass principal setAvatar
Section titled “omniglass principal setAvatar”Set a principal’s profile picture
omniglass principal setAvatar <id> [flags]Sets another human principal’s profile picture (an administrator action). Gated by principal:set-avatar (all-scope). The image (JPEG, PNG, or WebP, base64-encoded) is normalized server-side to a 256x256 JPEG; a bad or oversize image is a 422. Audited with the administrator as the actor.
| Flag | Type | Default | Description |
|---|---|---|---|
--image-base64 | string | (none) | The image (JPEG, PNG, or WebP), base64-encoded; normalized server-side to a 256x256 JPEG |
Example:
omniglass principal setAvatar <id> --image-base64 image_base64omniglass principal update
Section titled “omniglass principal update”Update a principal
omniglass principal update <id> [flags]Updates a human principal’s display name, email, and username. Gated by principal:update (all-scope). Renaming is safe: nothing keys on the username.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | Display name; empty clears it |
--email | string | (none) | Email; empty clears it |
--username | string | (none) | Sign-in name (lowercase letters, digits, and . _ -); renaming is safe |
Example:
omniglass principal update <id>omniglass principal-group
Section titled “omniglass principal-group”Commands for the principal-group resource
omniglass principal-group create
Section titled “omniglass principal-group create”Create a principal group
omniglass principal-group create [flags]Creates a principal group. Gated by principal_group:create (all-scope). A duplicate name is 409.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | |
--display-name | string | (none) | |
--name | string | (none) | Unique group name (lowercase letters, digits, and . _ -) |
Example:
omniglass principal-group create --name nameomniglass principal-group delete
Section titled “omniglass principal-group delete”Delete a principal group
omniglass principal-group delete <id>Removes a group and, by cascade, its memberships and grants. Gated by principal_group:delete (all-scope).
Example:
omniglass principal-group delete <id>omniglass principal-group get
Section titled “omniglass principal-group get”Get a principal group
omniglass principal-group get <id>One principal group by id. Gated by principal_group:read:admin.
Example:
omniglass principal-group get <id>omniglass principal-group grant
Section titled “omniglass principal-group grant”Commands for the grant resource
omniglass principal-group grant create
Section titled “omniglass principal-group grant create”Grant a role to a group
omniglass principal-group grant create <id> [flags]Assigns a role at a scope to a group; its members inherit it. Gated by principal_grant:create (all-scope). Refused (403) when the granted role’s capabilities exceed the granter’s own, exactly as for a direct grant. A duplicate is 409.
| Flag | Type | Default | Description |
|---|---|---|---|
--role | string | (none) | A role id (viewer, operator, admin, owner, or a custom role) |
--scope-id | string | (none) | The scope root id; omit for the all scope |
--scope-kind | string | (none) | The scope kind; ‘all’ confers the whole estate |
--scope-op | string | (none) | How the scope root matches the tree; moot for the all scope |
Example:
omniglass principal-group grant create <id> --role role --scope-kind scope_kindomniglass principal-group grant delete
Section titled “omniglass principal-group grant delete”Revoke a group grant
omniglass principal-group grant delete <id> <grantId>Removes one grant from a group. Gated by principal_grant:delete (all-scope).
Example:
omniglass principal-group grant delete <id> <grantId>omniglass principal-group grant list
Section titled “omniglass principal-group grant list”List a group’s grants
omniglass principal-group grant list <id>The role x scope grants a group confers on its members. Gated by principal_group:read:admin.
Example:
omniglass principal-group grant list <id>omniglass principal-group list
Section titled “omniglass principal-group list”List principal groups
omniglass principal-group listEvery principal group. Gated by principal_group:read:admin.
Example:
omniglass principal-group listomniglass principal-group member
Section titled “omniglass principal-group member”Commands for the member resource
omniglass principal-group member create
Section titled “omniglass principal-group member create”Add a member to a group
omniglass principal-group member create <id> [flags]Adds a principal to a group; its members inherit the group’s grants. Gated by principal_group:update (all-scope). Idempotent.
| Flag | Type | Default | Description |
|---|---|---|---|
--principal-id | string | (none) | The principal to add to the group |
Example:
omniglass principal-group member create <id> --principal-id principal_idomniglass principal-group member delete
Section titled “omniglass principal-group member delete”Remove a member from a group
omniglass principal-group member delete <id> <principalId>Removes a principal from a group; it stops inheriting the group’s grants. Gated by principal_group:update (all-scope).
Example:
omniglass principal-group member delete <id> <principalId>omniglass principal-group member list
Section titled “omniglass principal-group member list”List a group’s members
omniglass principal-group member list <id>The principals in a group. Gated by principal_group:read:admin.
Example:
omniglass principal-group member list <id>omniglass principal-group update
Section titled “omniglass principal-group update”Update a principal group
omniglass principal-group update <id> [flags]Updates a group’s name and presentational fields. Gated by principal_group:update (all-scope). A duplicate name is 409.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | Description; empty clears it |
--display-name | string | (none) | Display name; empty clears it |
--name | string | (none) | Group name (lowercase letters, digits, and . _ -); renaming is safe |
Example:
omniglass principal-group update <id>omniglass product
Section titled “omniglass product”Commands for the product resource
omniglass product create
Section titled “omniglass product create”Create a product
omniglass product create [flags]Creates a custom (non-official) product and sets its capabilities. Gated by product:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--capabilities | string | (none) | |
--display-name | string | (none) | |
--driver-id | string | (none) | |
--kind | string | (none) | |
--name | string | (none) | The globally unique kebab handle; renameable |
--parent-product-id | string | (none) | The parent product, by handle or uuid |
--vendor-id | string | (none) | The vendor, by handle or uuid |
Example:
omniglass product create --display-name display_name --name nameomniglass product delete
Section titled “omniglass product delete”Delete a product
omniglass product delete <id>Deletes a custom product, refused if official (422) or still referenced by a component (409). Gated by product:delete.
Example:
omniglass product delete <id>omniglass product get
Section titled “omniglass product get”Get a product
omniglass product get <id>Fetches a product by id, with its capabilities. Gated by product:read.
Example:
omniglass product get <id>omniglass product list
Section titled “omniglass product list”List products
omniglass product listLists the product registry, ordered alphabetically by display name. Each product carries its vendor, driver, kind, and capabilities. Gated by product:read.
Example:
omniglass product listomniglass product property
Section titled “omniglass product property”Commands for the property resource
omniglass product property delete
Section titled “omniglass product property delete”Withdraw a property from a product
omniglass product property delete <id> <property>Removes one line from a custom product’s contract; instances keep any value they set for it, now off-contract. A property the product does not declare is a 404, and an official product is read-only (422). Gated by product:delete.
Example:
omniglass product property delete <id> <property>omniglass product property list
Section titled “omniglass product property list”List a product’s declared properties
omniglass product property list <id>Lists the product’s declared-property contract (what every instance of the product exposes), ordered by property name, each with its optional default and required flag. Gated by product:read.
Example:
omniglass product property list <id>omniglass product property update
Section titled “omniglass product property update”Declare a property on a product
omniglass product property update <id> <property> [flags]Declares a catalog property on a custom product, or revises the declaration in place (the line is addressed by name, so the write is idempotent). Official products are read-only (422), and an unknown product or property is a 422. Gated by product:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--default-value | string | (none) | The contract default, validated against the property’s data_type; omit for no default |
--required | string | (none) | Whether every instance of this product must set the property; defaults to false |
Example:
omniglass product property update <id> <property>omniglass product update
Section titled “omniglass product update”Update a product
omniglass product update <id> [flags]Patches a custom product’s display_name, vendor, driver, kind, or parent, and replaces its capabilities when provided. Official products are read-only (422). Gated by product:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--capabilities | string | (none) | |
--display-name | string | (none) | |
--driver-id | string | (none) | |
--kind | string | (none) | |
--parent-product-id | string | (none) | |
--vendor-id | string | (none) |
Example:
omniglass product update <id>omniglass property-type
Section titled “omniglass property-type”Commands for the property-type resource
omniglass property-type create
Section titled “omniglass property-type create”Create a property
omniglass property-type create [flags]Registers a custom property (official=false). The name must be a valid property key. Gated by property_type:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--data-type | string | (none) | The value type |
--description | string | (none) | What the property means |
--display-name | string | (none) | A human label |
--kind | string | (none) | The observed kind; omit for a declared-only property |
--name | string | (none) | The property name (lowercase, dot-hierarchied) |
--unit | string | (none) | A display unit (observed properties) |
--validation | string | (none) | A JSON Schema fragment constraining the value |
Example:
omniglass property-type create --data-type data_type --name nameomniglass property-type delete
Section titled “omniglass property-type delete”Delete a property
omniglass property-type delete <name>Removes a custom property by name. Official properties are read-only. Gated by property_type:delete.
Example:
omniglass property-type delete <name>omniglass property-type get
Section titled “omniglass property-type get”Get a property
omniglass property-type get <name>Returns one property by name. Gated by property_type:read.
Example:
omniglass property-type get <name>omniglass property-type list
Section titled “omniglass property-type list”List properties
omniglass property-type listLists every registered property (official and custom). The catalog is estate-wide reference data. Gated by property_type:read.
Example:
omniglass property-type listomniglass property-type update
Section titled “omniglass property-type update”Update a property
omniglass property-type update <name> [flags]Patches a custom property’s label, description, unit, or validation (a nil field is unchanged). Data type and kind are fixed at creation. Official properties are read-only. Gated by property_type:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | What the property means |
--display-name | string | (none) | A human label |
--unit | string | (none) | A display unit |
--validation | string | (none) | A JSON Schema fragment (replaces wholesale) |
Example:
omniglass property-type update <name>omniglass role
Section titled “omniglass role”Commands for the role resource
omniglass role list
Section titled “omniglass role list”List roles
omniglass role listLists the roles with their metadata and effective (flattened) permissions. Gated by the role:read:admin capability.
Example:
omniglass role listomniglass secret
Section titled “omniglass secret”Commands for the secret resource
omniglass secret copy
Section titled “omniglass secret copy”Decrypt a secret for clipboard copy
omniglass secret copy <id>Decrypts and returns a secret’s field values for a clipboard copy, audited under the copy verb (distinct from an on-screen reveal). Same exposure and the same secret:reveal gate as reveal.
Example:
omniglass secret copy <id>omniglass secret create
Section titled “omniglass secret create”Create a secret
omniglass secret create [flags]Seals a secret at an owner scope. Fields are validated and encrypted against the type shape. Gated by secret:create, plus platform:create when owner_kind is platform (the install-wide tier).
| Flag | Type | Default | Description |
|---|---|---|---|
--admin-sensitive | string | (none) | Admin-only visibility; omit to use the type default. Setting true requires the admin tier |
--fields | string | (none) | The operator field map, validated against the type shape |
--name | string | (none) | The cascade key; unique per owner |
--owner | string | (none) | The owning entity’s name; omit for a platform secret |
--owner-kind | string | (none) | Which tier owns this secret |
--secret-type | string | (none) | A secret_type id |
Example:
omniglass secret create --fields fields --name name --owner-kind owner_kind --secret-type secret_typeomniglass secret delete
Section titled “omniglass secret delete”Delete a secret
omniglass secret delete <id>Removes a secret by id. Gated by secret:delete, plus platform:delete when the secret sits at the platform tier; read and delete scopes on the owner drive the 404 versus 403 split.
Example:
omniglass secret delete <id>omniglass secret list
Section titled “omniglass secret list”List secrets
omniglass secret listLists the secrets the caller may see, with masked fields, filtered to the read scope; admin-sensitive secrets appear only to the admin tier. Gated by secret:read, which the viewer floor does not carry (secret is a sensitive resource).
Example:
omniglass secret listomniglass secret reveal
Section titled “omniglass secret reveal”Reveal a secret’s plaintext
omniglass secret reveal <id>Decrypts and returns a secret’s field values, auditing the decrypt. Gated by secret:reveal at the caller’s scope; an admin-sensitive secret additionally needs the admin tier (secret:reveal:admin), so a scoped operator reveals device secrets but never a platform credential.
Example:
omniglass secret reveal <id>omniglass secret update
Section titled “omniglass secret update”Update a secret’s field values
omniglass secret update <id> [flags]Replaces the given field values on a secret, re-sealing secret fields. Only values change; name, type, and owner are fixed at creation. An omitted field keeps its value. Gated by secret:update, plus platform:update when the secret sits at the platform tier.
| Flag | Type | Default | Description |
|---|---|---|---|
--fields | string | (none) | The field values to replace; an omitted field keeps its value |
Example:
omniglass secret update <id> --fields fieldsomniglass secret-type
Section titled “omniglass secret-type”Commands for the secret-type resource
omniglass secret-type list
Section titled “omniglass secret-type list”List secret types
omniglass secret-type listLists the secret_type shapes a secret can take, for the create form. Gated by secret:read.
Example:
omniglass secret-type listomniglass seed-dev
Section titled “omniglass seed-dev”Seed a dev database with example locations, users, and grants (idempotent; never for production)
omniglass seed-devPopulate a fresh dev database with a small example estate so make dev comes up with locations, sign-in-able users, and their grants instead of empty. The same trusted direct-DB lane as bootstrap, and idempotent, so it runs on every make dev. Not for production: these are operator rows, not ship-with reference data.
omniglass server
Section titled “omniglass server”Run the control-plane server (HTTP API)
omniglass serveromniglass session
Section titled “omniglass session”Commands for the session resource
omniglass session list
Section titled “omniglass session list”List your own sessions and tokens
omniglass session listLists the caller’s own active bearer credentials (time-bounded web-login sessions and CLI/API tokens) with their non-secret metadata; the current one is flagged. Requires authentication; self-scoped (never another principal’s). The token secret is never returned.
Example:
omniglass session listomniglass session revoke
Section titled “omniglass session revoke”Revoke one of your own sessions
omniglass session revoke <id>Revokes one of the caller’s own sessions or tokens by id (from the session list); revoking the current one signs it out. Requires authentication; self-scoped, so a credential id that is not yours is a 404.
Example:
omniglass session revoke <id>omniglass session revoke-all
Section titled “omniglass session revoke-all”Revoke all of your own sessions or tokens
omniglass session revoke-all [flags]Revokes every one of the caller’s own web-login sessions, or every one of its CLI/API tokens (chosen by purpose), returning how many were ended. Requires authentication; self-scoped. Always keeps the credential that made this request, so you are never signed out of the one you are on; sessions and tokens never cross.
| Flag | Type | Default | Description |
|---|---|---|---|
--purpose | string | (none) | Which of your own credentials to revoke: all your web-login sessions, or all your CLI/API tokens |
Example:
omniglass session revoke-all --purpose purposeomniglass set-password
Section titled “omniglass set-password”Set or rotate a user’s console password, revoking their sessions (direct DB)
omniglass set-password <username> <password> [flags]Installs or replaces a human’s password credential (argon2id), addressed by username, and revokes the user’s live SESSIONS so a break-glass reset locks out any stolen login at once. API tokens are a separate bearer secret, not tied to the password, and are kept unless —revoke-tokens is given (a full lockout of a compromised account). The same trusted direct-DB lane as bootstrap and token: dev setup, break-glass, or a password reset before the admin UI lands.
| Flag | Type | Default | Description |
|---|---|---|---|
--revoke-tokens | bool | false | also revoke the user’s API tokens (a full lockout of a compromised account) |
omniglass setting
Section titled “omniglass setting”Commands for the setting resource
omniglass setting delete
Section titled “omniglass setting delete”Restore a settings namespace to defaults
omniglass setting delete <namespace>Drops the namespace’s platform override, restoring the file layer and the declared defaults. Gated by settings:update and platform:update.
Example:
omniglass setting delete <namespace>omniglass setting list
Section titled “omniglass setting list”Get effective settings with provenance
omniglass setting listThe effective settings document plus per-key provenance (which level won) and lock state. Gated by settings:read (admin).
Example:
omniglass setting listomniglass setting me
Section titled “omniglass setting me”Commands for the me resource
omniglass setting me list
Section titled “omniglass setting me list”Get the caller’s effective settings
omniglass setting me listThe current principal’s resolved settings, client-visible namespaces only, no provenance. Feeds the SPA at boot. Requires authentication.
Example:
omniglass setting me listomniglass setting restoreDefaults
Section titled “omniglass setting restoreDefaults”Restore all settings to defaults
omniglass setting restoreDefaultsRemoves every platform override (a factory reset). Gated by settings:update and platform:update.
Example:
omniglass setting restoreDefaultsomniglass setting update
Section titled “omniglass setting update”Update a settings namespace
omniglass setting update <namespace>Applies an RFC 7386 JSON Merge Patch to the namespace’s platform override; null on a key restores it. Gated by settings:update and platform:update.
Example:
omniglass setting update <namespace>omniglass standard
Section titled “omniglass standard”Commands for the standard resource
omniglass standard create
Section titled “omniglass standard create”Create a standard
omniglass standard create [flags]Creates a custom (non-official) standard, optionally as a variant of another. Gated by standard:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--name | string | (none) | The globally unique kebab handle; renameable |
--parent-standard-id | string | (none) | A standard this one is a variant of, by handle or uuid |
Example:
omniglass standard create --display-name display_name --name nameomniglass standard delete
Section titled “omniglass standard delete”Delete a standard
omniglass standard delete <id>Deletes a custom standard, refused if official (422) or still referenced by a system (409). Gated by standard:delete.
Example:
omniglass standard delete <id>omniglass standard get
Section titled “omniglass standard get”Get a standard
omniglass standard get <id>Fetches a standard by id. Gated by standard:read.
Example:
omniglass standard get <id>omniglass standard list
Section titled “omniglass standard list”List standards
omniglass standard listLists the standard catalog, ordered alphabetically by display name. A standard is the blueprint a system conforms to. Gated by standard:read.
Example:
omniglass standard listomniglass standard property
Section titled “omniglass standard property”Commands for the property resource
omniglass standard property delete
Section titled “omniglass standard property delete”Withdraw a property from a standard
omniglass standard property delete <id> <property>Removes one line from a custom standard’s contract; conforming systems keep any value they set for it, now off-contract. A property the standard does not declare is a 404, and an official standard is read-only (422). Gated by standard:delete.
Example:
omniglass standard property delete <id> <property>omniglass standard property list
Section titled “omniglass standard property list”List a standard’s declared properties
omniglass standard property list <id>Lists the standard’s declared-property contract (what every system conforming to it exposes), ordered by property name, each with its optional default and required flag. Gated by standard:read.
Example:
omniglass standard property list <id>omniglass standard property update
Section titled “omniglass standard property update”Declare a property on a standard
omniglass standard property update <id> <property> [flags]Declares a catalog property on a custom standard, or revises the declaration in place (the line is addressed by name, so the write is idempotent). Official standards are read-only (422); an unknown standard is a 404 and a property the catalog does not know is a 422. Gated by standard:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--default-value | string | (none) | The contract default, validated against the property’s data_type; omit for no default |
--required | string | (none) | Whether every system conforming to this standard must set the property; defaults to false |
Example:
omniglass standard property update <id> <property>omniglass standard role
Section titled “omniglass standard role”Commands for the role resource
omniglass standard role delete
Section titled “omniglass standard role delete”Withdraw a role from a standard
omniglass standard role delete <id> <role>Removes the role from the standard, and with it every assignment conforming systems made to it. A role the standard does not declare is a 404. Gated by standard:delete.
Example:
omniglass standard role delete <id> <role>omniglass standard role list
Section titled “omniglass standard role list”List a standard’s declared roles
omniglass standard role list <id>Lists the roles this standard declares (every conforming system inherits them live), ordered by name, each with its quorum and the capabilities a component must provide to fill it. Gated by standard:read.
Example:
omniglass standard role list <id>omniglass standard role update
Section titled “omniglass standard role update”Declare a role on a standard
omniglass standard role update <id> <role> [flags]Declares a role every conforming system needs filled, or revises it in place (the role is addressed by name, so the write is idempotent). The capability list replaces the required set wholesale. An unknown standard or capability is a 422. Gated by standard:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--capabilities | string | (none) | The capabilities a component must ALL provide; replaces the required set wholesale |
--display-name | string | (none) | The role’s human label; defaults to the role name |
--impact | string | (none) | What an impaired role means for its system; omit for degraded. The same broken component matters differently depending on the slot it was filling: a dead confidence monitor is not a dead main display |
--quorum | string | (none) | How many components must fill the role; omit for one |
Example:
omniglass standard role update <id> <role>omniglass standard update
Section titled “omniglass standard update”Update a standard
omniglass standard update <id> [flags]Patches a custom standard’s display_name or parent. Official standards are read-only (422). Gated by standard:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--parent-standard-id | string | (none) |
Example:
omniglass standard update <id>omniglass system
Section titled “omniglass system”Commands for the system resource
omniglass system checkName
Section titled “omniglass system checkName”Check a system technical name
omniglass system checkName [flags]Reports whether a proposed technical name is a valid slug and currently free. Advisory (Save is still gated by the unique constraint). Availability is scope-blind to match the global unique constraint. Gated by system:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--name | string | (none) | The proposed technical name to check |
Example:
omniglass system checkName --name nameomniglass system create
Section titled “omniglass system create”Create a system
omniglass system create [flags]Creates a system, optionally under a parent (a root needs an all-scoped grant) and at a location. Gated by system:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--location | string | (none) | Location name this system is placed at |
--name | string | (none) | Globally unique name (the address; lowercase letters, digits, hyphens) |
--parent | string | (none) | Parent system name; omit for a root system |
--standard-id | string | (none) | A standard id; omit for a one-off system that conforms to none |
Example:
omniglass system create --name nameomniglass system delete
Section titled “omniglass system delete”Delete a system
omniglass system delete <name>Deletes a system, refused (409) while it still has child systems or is still referenced elsewhere. Gated by system:delete; read and delete scopes drive the 404 versus 403 split.
Example:
omniglass system delete <name>omniglass system get
Section titled “omniglass system get”Get a system
omniglass system get <name>Fetches a system by name within the caller’s read scope. Out of scope is a non-disclosing 404. Gated by system:read.
Example:
omniglass system get <name>omniglass system health
Section titled “omniglass system health”Commands for the health resource
omniglass system health list
Section titled “omniglass system health list”Read a system’s health
omniglass system health list <name>The system’s current verdict and why: every role it needs filled, whether it is impaired, what an impaired role means for the system (impact), and for an impaired role the required capabilities an alarm has taken away plus the alarms that took them. Transitions are the recorded edges over the last 30 days, one entry per change. Gated by system:read; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system health list <name>omniglass system list
Section titled “omniglass system list”List systems in scope
omniglass system listLists the systems the caller may read, each filtered to its scope subtree. Gated by system:read.
Example:
omniglass system listomniglass system listTags
Section titled “omniglass system listTags”List tags on a system
omniglass system listTags <name>Lists the tags bound directly on a system (not the resolved cascade). Gated by system:read.
Example:
omniglass system listTags <name>omniglass system member
Section titled “omniglass system member”Commands for the member resource
omniglass system member delete
Section titled “omniglass system member delete”Take a component out of a system
omniglass system member delete <name> <component>Unbinds this component from the system. Refused with a 409 while it still fills a role here, since removing it would leave the system staffed by a non-member: unassign the role first. A component that was not a member is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system member delete <name> <component>omniglass system member list
Section titled “omniglass system member list”List the components in a system
omniglass system member list <name>The components bound into this system, ordered by name. Membership is what a role attaches to: every component staffing a role here is a member, and a member may also carry no role at all (a power conditioner is in the room without filling a declared slot). Gated by system:read; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system member list <name>omniglass system member setPrimary
Section titled “omniglass system member setPrimary”Make this the component’s default system
omniglass system member setPrimary <name> <component>Moves the component’s default to this membership. The default answers questions asked without a system in hand; it does not decide anything that names a system explicitly. A component that was not a member here is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system member setPrimary <name> <component>omniglass system member update
Section titled “omniglass system member update”Put a component in a system
omniglass system member update <name> <component>Binds this component into the system. Idempotent. A component’s first membership becomes its primary with nobody asking, so a component in exactly one system never has to think about the concept; a later membership does not take that default away. Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system member update <name> <component>omniglass system property
Section titled “omniglass system property”Commands for the property resource
omniglass system property delete
Section titled “omniglass system property delete”Clear a property on a system
omniglass system property delete <name> <property>Removes the system’s declared value, so the property falls back to the standard contract’s default (or leaves the effective read entirely when it was off-contract). Clearing a property the system never set is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system property delete <name> <property>omniglass system property list
Section titled “omniglass system property list”List a system’s effective properties
omniglass system property list <name>Every property the system’s standard declares, resolved to the system’s own value or the contract default (is_set marks the override), plus any property set directly on the system (from_contract false). Gated by system:read; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system property list <name>omniglass system property update
Section titled “omniglass system property update”Set a property on a system
omniglass system property update <name> <property> [flags]Declares a value for the property on this system, overriding the standard contract’s default. Idempotent: the first set stores the value, a later set replaces it. The property need not be on the contract, but it must exist in the catalog (422 otherwise). Gated by system:update; an out-of-scope system is a non-disclosing 404.
| Flag | Type | Default | Description |
|---|---|---|---|
--value | string | (none) | The value to declare, shape given by the property’s data_type |
Example:
omniglass system property update <name> <property> --value valueomniglass system removeTag
Section titled “omniglass system removeTag”Remove a tag value from a system
omniglass system removeTag <name> [flags]Removes a key’s value from a system. Gated by system:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key to remove |
Example:
omniglass system removeTag <name> --key keyomniglass system role
Section titled “omniglass system role”Commands for the role resource
omniglass system role assignment
Section titled “omniglass system role assignment”Commands for the assignment resource
omniglass system role assignment delete
Section titled “omniglass system role assignment delete”Unassign a component from a role
omniglass system role assignment delete <name> <role> <component>Takes this component out of the role, leaving the role understaffed until another fills it. A component that was not filling the role is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system role assignment delete <name> <role> <component>omniglass system role assignment update
Section titled “omniglass system role assignment update”Assign a component to a role
omniglass system role assignment update <name> <role> <component>Puts this component in the role for this system. Refused with a 422 naming the missing capabilities when the component does not provide everything the role requires (its product’s capabilities, plus what it adds, minus what it suppresses). Idempotent. Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system role assignment update <name> <role> <component>omniglass system role delete
Section titled “omniglass system role delete”Withdraw a role from a system
omniglass system role delete <name> <role>Removes a role declared on this system, and with it every assignment to it. A role the system does not declare itself is a 404 (a role inherited from its standard is withdrawn on the standard, not here). Gated by system:update; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system role delete <name> <role>omniglass system role list
Section titled “omniglass system role list”List a system’s effective roles
omniglass system role list <name>Every role this system needs filled: those its standard declares (from_standard true) plus those declared directly on it, each with the capabilities it requires, the components filling it, and how many more it wants before quorum (understaffed). A one-off system shows only its own. Gated by system:read; an out-of-scope system is a non-disclosing 404.
Example:
omniglass system role list <name>omniglass system role update
Section titled “omniglass system role update”Declare a role on a system
omniglass system role update <name> <role> [flags]Declares a role directly on this system (how a one-off system gets roles at all, and how a conforming one adds what its standard does not cover), or revises it in place. The capability list replaces the required set wholesale. Gated by system:update; an out-of-scope system is a non-disclosing 404.
| Flag | Type | Default | Description |
|---|---|---|---|
--capabilities | string | (none) | The capabilities a component must ALL provide; replaces the required set wholesale |
--display-name | string | (none) | The role’s human label; defaults to the role name |
--impact | string | (none) | What an impaired role means for its system; omit for degraded. The same broken component matters differently depending on the slot it was filling: a dead confidence monitor is not a dead main display |
--quorum | string | (none) | How many components must fill the role; omit for one |
Example:
omniglass system role update <name> <role>omniglass system setTag
Section titled “omniglass system setTag”Set a tag value on a system
omniglass system setTag <name> [flags]Binds a value for a key on a system. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by system:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--key | string | (none) | The tag key (must exist and apply to this kind) |
--value | string | (none) | The bound value |
Example:
omniglass system setTag <name> --key key --value valueomniglass system update
Section titled “omniglass system update”Update a system
omniglass system update <name> [flags]Patches a system’s display_name or standard. An omitted standard_id leaves it unchanged; an explicit empty string clears it, converting the system to a one-off. Gated by system:update; read and update scopes drive the 404 versus 403 split.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--name | string | (none) | A new globally unique technical name (rename) |
--standard-id | string | (none) |
Example:
omniglass system update <name>omniglass tag
Section titled “omniglass tag”Commands for the tag resource
omniglass tag clearPlatform
Section titled “omniglass tag clearPlatform”Clear a platform tag value
omniglass tag clearPlatform <name>Removes the platform-tier binding for a key. Gated by tag:update (all-scope) and platform:update.
Example:
omniglass tag clearPlatform <name>omniglass tag create
Section titled “omniglass tag create”Mint a tag key
omniglass tag create [flags]Adds a key to the governed vocabulary. The name is normalized (a lowercase identifier). Gated by tag:create (all-scope, an admin action).
| Flag | Type | Default | Description |
|---|---|---|---|
--allowed-values | string | (none) | The value enum a bound value must belong to; omit for free text |
--applies-to | string | (none) | Entity kinds this key may bind to (component, system, location); omit for universal |
--name | string | (none) | The normalized key: a lowercase identifier, unique tenant-wide |
--propagates | string | (none) | Whether bindings cascade to descendants; defaults true |
Example:
omniglass tag create --name nameomniglass tag delete
Section titled “omniglass tag delete”Delete a tag key
omniglass tag delete <name>Removes a key from the vocabulary, cascading its bindings. Gated by tag:delete (all-scope).
Example:
omniglass tag delete <name>omniglass tag list
Section titled “omniglass tag list”List tag keys
omniglass tag listLists the governed key vocabulary. Rides the tag:read floor.
Example:
omniglass tag listomniglass tag setPlatform
Section titled “omniglass tag setPlatform”Set a platform tag value
omniglass tag setPlatform <name> [flags]Binds an install-wide default value for a key at the platform tier. Gated by tag:update (all-scope) and platform:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--value | string | (none) | The bound value |
Example:
omniglass tag setPlatform <name> --value valueomniglass tag update
Section titled “omniglass tag update”Update a tag key
omniglass tag update <name> [flags]Replaces a key’s governance fields (applies_to, propagates); the name is fixed. Gated by tag:update (all-scope).
| Flag | Type | Default | Description |
|---|---|---|---|
--allowed-values | string | (none) | The value enum a bound value must belong to; omit for free text |
--applies-to | string | (none) | Entity kinds this key may bind to; omit for universal |
--propagates | string | (none) | Whether bindings cascade to descendants; defaults true |
Example:
omniglass tag update <name>omniglass tag values
Section titled “omniglass tag values”List the distinct values bound for a key
omniglass tag values <name>Returns the distinct values already bound for a key across the estate, for value autocomplete on a free-text key (an enum key carries its allowed set on the key itself). Rides the tag:read floor.
Example:
omniglass tag values <name>omniglass task
Section titled “omniglass task”Commands for the task resource
omniglass task get
Section titled “omniglass task get”Get a task
omniglass task get <id>Fetches a task by id. A task whose component is out of the caller’s read scope is a non-disclosing 404. Gated by task:read.
Example:
omniglass task get <id>omniglass task list
Section titled “omniglass task list”List tasks in scope
omniglass task listLists the tasks whose interface’s owning component the caller may read (the component cascade). Tasks are derived from interfaces, not authored. Gated by task:read.
Example:
omniglass task listomniglass token
Section titled “omniglass token”Mint an additional bearer token for an existing principal (direct DB)
omniglass token <username> [flags]Issues a new bearer credential for an existing principal, addressed by username, and prints the token once. The same trusted direct-DB lane as bootstrap: token reissue, break-glass, or a fresh login token for make dev when the owner already exists. A —description (required) names what the token is for. The token expires after —ttl (default 90 days, hard maximum 365 days); every credential is time-bounded.
| Flag | Type | Default | Description |
|---|---|---|---|
--description | string | (none) | what the token is for (required) |
--ttl | duration | 2160h0m0s | how long the token is valid before it expires (max 365 days) |
omniglass variable
Section titled “omniglass variable”Commands for the variable resource
omniglass variable create
Section titled “omniglass variable create”Create a variable
omniglass variable create [flags]Sets a variable at an owner scope. The value is validated against value_type. Gated by variable:create, plus platform:create when owner_kind is platform (the install-wide tier).
| Flag | Type | Default | Description |
|---|---|---|---|
--name | string | (none) | The cascade key; unique per owner |
--owner | string | (none) | The owning entity’s name; omit for a platform variable |
--owner-kind | string | (none) | Which tier owns this variable |
--value | string | (none) | The value, validated against value_type |
--value-type | string | (none) | The declared value type |
Example:
omniglass variable create --name name --owner-kind owner_kind --value value --value-type value_typeomniglass variable delete
Section titled “omniglass variable delete”Delete a variable
omniglass variable delete <id>Removes a variable by id. Gated by variable:delete, plus platform:delete when the variable sits at the platform tier; read and delete scopes on the owner drive the 404 versus 403 split.
Example:
omniglass variable delete <id>omniglass variable list
Section titled “omniglass variable list”List variables (admin directory)
omniglass variable listLists every variable. Requires an all-scope read. Gated by variable:read.
Example:
omniglass variable listomniglass variable update
Section titled “omniglass variable update”Update a variable’s value
omniglass variable update <id> [flags]Replaces a variable’s value, validated against its fixed value_type. Only the value changes; name, type, and owner are fixed at creation. Gated by variable:update, plus platform:update when the variable sits at the platform tier.
| Flag | Type | Default | Description |
|---|---|---|---|
--value | string | (none) | The new value, validated against the fixed value_type |
Example:
omniglass variable update <id> --value valueomniglass vendor
Section titled “omniglass vendor”Commands for the vendor resource
omniglass vendor create
Section titled “omniglass vendor create”Create a vendor
omniglass vendor create [flags]Creates a custom (non-official) vendor. Gated by vendor:create.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--icon | string | (none) | |
--kind | string | (none) | |
--name | string | (none) | The globally unique kebab handle; renameable |
--support-phone | string | (none) | |
--website | string | (none) |
Example:
omniglass vendor create --display-name display_name --name nameomniglass vendor delete
Section titled “omniglass vendor delete”Delete a vendor
omniglass vendor delete <id>Deletes a custom vendor, refused if official (422). Gated by vendor:delete.
Example:
omniglass vendor delete <id>omniglass vendor get
Section titled “omniglass vendor get”Get a vendor
omniglass vendor get <id>Fetches a vendor by id. Gated by vendor:read.
Example:
omniglass vendor get <id>omniglass vendor list
Section titled “omniglass vendor list”List vendors
omniglass vendor listLists the vendor registry, ordered alphabetically by display name. Populates the vendor picker on the product form. Gated by vendor:read.
Example:
omniglass vendor listomniglass vendor update
Section titled “omniglass vendor update”Update a vendor
omniglass vendor update <id> [flags]Patches a custom vendor’s display_name, kind, icon, support_phone, or website. Official vendors are read-only (422). Gated by vendor:update.
| Flag | Type | Default | Description |
|---|---|---|---|
--display-name | string | (none) | |
--icon | string | (none) | |
--kind | string | (none) | |
--support-phone | string | (none) | |
--website | string | (none) |
Example:
omniglass vendor update <id>