Skip to content

CLI reference

Every omniglass command, generated from the binary’s own command tree. The data commands are generated from the API (make gen), so this reference is a faithful mirror of what the server exposes. For the narrative, connecting, authenticating, and the generated-versus- hand-written split, see the CLI guide.

Every command accepts these, each with an environment-variable default:

FlagTypeDefaultDescription
--serverstringhttp://localhost:8080Omniglass server base URL (env OMNIGLASS_SERVER)
--tokenstring(none)bearer token (env OMNIGLASS_TOKEN)

Commands for the audit-log resource

List audit-trail events

omniglass audit-log list [flags]

Recent audit-trail events, newest first, each with the actor and, for an impersonated action, the real actor behind it. Read-only; gated by audit:read:admin (admin/owner only, since the audit trail is admin-sensitive).

FlagTypeDefaultDescription
--beforestring(none)Only events strictly older than this RFC3339 timestamp (paging backward)
--limitint0Max rows to return, newest first (default 100, capped at 500)
--resourcestring(none)Filter to one resource kind (e.g. auth, principal_grant)
--verbstring(none)Filter to one verb (e.g. login, create)

Example:

Terminal window
omniglass audit-log list

Commands for the auth resource

Get your own profile picture

omniglass auth avatar

Returns the caller’s profile picture as a base64-encoded JPEG. Requires authentication; self-scoped. No picture is a 404.

Example:

Terminal window
omniglass auth avatar

Change your own password

omniglass auth change-password [flags]

Verifies the current password and sets a new one. Requires authentication; self-scoped.

FlagTypeDefaultDescription
--current-passwordstring(none)Your current password
--new-passwordstring(none)The new password (at least 12 characters, not a common password, not containing the username)

Example:

Terminal window
omniglass auth change-password --current-password current_password --new-password new_password

Create one of your own API tokens

omniglass auth create-token [flags]

Mints a CLI/API token for the caller and returns it once (store it now; it cannot be retrieved again). A description is required (what the token is for); an optional ttl_days bounds its lifetime (default 90, maximum 365). Requires authentication; self-scoped (always issued for you). The token is stamped with the device and address that created it.

FlagTypeDefaultDescription
--descriptionstring(none)What the token is for (required)
--ttl-daysstring(none)Days until the token expires (default 90, maximum 365)

Example:

Terminal window
omniglass auth create-token --description description

Log in with a username and password

omniglass auth login [flags]

Verifies a human’s password and sets an httpOnly session cookie. Public; a bad credential is a flat 401, and a correct password against a disabled account is a distinct 403 so the screen can explain it.

FlagTypeDefaultDescription
--passwordstring(none)
--usernamestring(none)

Example:

Terminal window
omniglass auth login --password password --username username

Log out the current session

omniglass auth logout

Revokes the session token and clears the cookie. Public.

Example:

Terminal window
omniglass auth logout

The authenticated principal, its permissions, and grants

omniglass auth me

Returns the caller’s principal, flattened permissions (a UI hint and the fast-reject set), and grants. Requires authentication.

Example:

Terminal window
omniglass auth me

Remove your own profile picture

omniglass auth remove-avatar

Clears the caller’s profile picture. Requires authentication; self-scoped.

Example:

Terminal window
omniglass auth remove-avatar

Set your own profile picture

omniglass auth set-avatar [flags]

Sets the caller’s profile picture (JPEG, PNG, or WebP, base64-encoded), normalized server-side to a 256x256 JPEG. Requires authentication; self-scoped. A bad or oversize image is a 422.

FlagTypeDefaultDescription
--image-base64string(none)The image (JPEG, PNG, or WebP), base64-encoded; normalized server-side to a 256x256 JPEG

Example:

Terminal window
omniglass auth set-avatar --image-base64 image_base64

Commands for the status resource

Whether the system has an owner yet

omniglass auth status list

Public: reports whether any owner has been bootstrapped, so the login screen can hide the bootstrap hint.

Example:

Terminal window
omniglass auth status list

Stop the current impersonation session

omniglass auth stop-impersonation

Revokes the impersonation session presented by the request token, ending the view-as / act-as. Requires an impersonation token.

Example:

Terminal window
omniglass auth stop-impersonation

Update your own profile

omniglass auth update-profile [flags]

Updates the caller’s own display name (email is administrator-set). Requires authentication; self-scoped (edits only your own principal).

FlagTypeDefaultDescription
--display-namestring(none)Your display name; empty clears it

Example:

Terminal window
omniglass auth update-profile

Create the first owner (idempotent per username) and mint its bearer token

omniglass bootstrap <username> [flags]
FlagTypeDefaultDescription
--display-namestring(none)owner display name (optional)
--emailstring(none)owner email (optional)
--passwordstring(none)owner password, so the owner can sign in to the console (optional)
--ttlduration2160h0m0show long the bootstrap token is valid before it expires (max 365 days)

Commands for the capability resource

Create a capability

omniglass capability create [flags]

Creates a custom (non-official) capability. Gated by capability:create.

FlagTypeDefaultDescription
--display-namestring(none)
--namestring(none)The globally unique kebab handle; renameable

Example:

Terminal window
omniglass capability create --display-name display_name --name name

Delete a capability

omniglass capability delete <id>

Deletes a custom capability, refused if official (422). Gated by capability:delete.

Example:

Terminal window
omniglass capability delete <id>

Get a capability

omniglass capability get <id>

Fetches a capability by id. Gated by capability:read.

Example:

Terminal window
omniglass capability get <id>

List capabilities

omniglass capability list

Lists the capability registry, ordered alphabetically by display name. Populates the capability picker on the product form. Gated by capability:read.

Example:

Terminal window
omniglass capability list

Update a capability

omniglass capability update <id> [flags]

Patches a custom capability’s display_name. Official capabilities are read-only (422). Gated by capability:update.

FlagTypeDefaultDescription
--display-namestring(none)

Example:

Terminal window
omniglass capability update <id>

Commands for the component resource

Commands for the alarm resource

Raise an alarm on a component

omniglass component alarm create <name> [flags]

Records a condition on this component and the capabilities it degrades, then recomputes health in the same transaction: any role requiring a degraded capability can no longer be filled by this component, and its system and location verdicts move with it. An unknown capability is a 422. Gated by component:update; an out-of-scope component is a non-disclosing 404.

FlagTypeDefaultDescription
--capabilitiesstring(none)The capabilities this condition degrades; a role requiring one of them can no longer be filled by this component
--messagestring(none)What is wrong, for the operator reading it later
--severitystring(none)How bad it is; critical puts the component itself in outage

Example:

Terminal window
omniglass component alarm create <name> --severity severity

Clear an alarm

omniglass component alarm delete <name> <id>

Marks the alarm cleared and recomputes health in the same transaction, so the recovery is recorded as a transition at the moment it happened. The row is kept: what was wrong and when outlives the fix. Clearing an alarm that is already cleared or does not exist is a 404. Gated by component:update; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component alarm delete <name> <id>

List a component’s alarms

omniglass component alarm list <name> [flags]

What is currently wrong with this component, newest first, each with the capabilities it degrades. Pass include_cleared for the history rather than the active set. Gated by component:read; an out-of-scope component is a non-disclosing 404.

FlagTypeDefaultDescription
--include-clearedboolfalseInclude cleared alarms, so the list is the history rather than what is wrong now

Example:

Terminal window
omniglass component alarm list <name>

Commands for the capability resource

Clear a capability declaration on a component

omniglass component capability delete <name> <capability>

Removes the component’s own fact about the capability, so it falls back to whatever its product declares. Clearing a fact the component never declared is a 404. Gated by component:update; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component capability delete <name> <capability>

List a component’s effective capabilities

omniglass component capability list <name>

What this component actually provides: the capabilities its product declares, plus the ones the component adds, minus the ones it suppresses. This is the set the role-assignment guard checks, so a productless component that declares its own can still be staffed. Gated by component:read; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component capability list <name>

Declare a capability on a component

omniglass component capability update <name> <capability> [flags]

Records this component’s own fact about a capability: present true adds one its product does not claim, present false suppresses one it does. Idempotent. An unknown capability is a 422; an unknown or out-of-scope component is a non-disclosing 404 (the component is resolved in scope first). Gated by component:update.

FlagTypeDefaultDescription
--presentstring(none)True to add the capability, false to suppress one the product declares

Example:

Terminal window
omniglass component capability update <name> <capability> --present present

Check a component technical name

omniglass component checkName [flags]

Reports whether a proposed technical name is a valid slug and currently free. Advisory (Save is still gated by the unique constraint). Availability is scope-blind to match the global unique constraint. Gated by component:update.

FlagTypeDefaultDescription
--namestring(none)The proposed technical name to check

Example:

Terminal window
omniglass component checkName --name name

Create a component

omniglass component create [flags]

Creates a component, optionally under a parent (a root needs an all-scoped grant), bound to a system and a location. Gated by component:create.

FlagTypeDefaultDescription
--display-namestring(none)
--locationstring(none)Location name this component is placed at
--namestring(none)Globally unique name (the address; lowercase letters, digits, hyphens)
--parentstring(none)Parent component name; omit for a root component
--productstring(none)Product id (catalog SKU) this component is an instance of
--systemstring(none)Primary system name this component belongs to

Example:

Terminal window
omniglass component create --name name

Delete a component

omniglass component delete <name>

Deletes a component, refused (409) while it still has child components or is still referenced elsewhere, such as by a system role it staffs. Gated by component:delete; read and delete scopes drive the 404 versus 403 split.

Example:

Terminal window
omniglass component delete <name>

Commands for the effective-secret resource

Effective secrets for a component

omniglass component effective-secret list <name>

Resolves the secrets that cascade onto a component (platform -> location -> component), with the winner and the shadowed candidates it overrode. There is NO system band: a secret is device-facing, and the room a component happens to serve is the wrong owner for a credential the device itself answers with. Fields are masked, as in the directory; plaintext is only ever the audited reveal. Gated by secret:read, which the viewer floor does not carry, and admin-sensitive secrets appear only to the admin tier.

Example:

Terminal window
omniglass component effective-secret list <name>

Commands for the effective-tag resource

Effective tags for a component

omniglass component effective-tag list <name> [flags]

Resolves the tags that cascade onto a component (platform -> location -> system -> component): keys union, values override most-specific-wins, with the winner and shadowed candidates. A non-propagating key resolves only from a binding on the component itself. The system band comes from MEMBERSHIP: pass ?system= to resolve against one the component belongs to (a shared device answers differently for each), or omit it to resolve against its primary membership. Gated by component:read; the component must be in the caller’s component read scope.

FlagTypeDefaultDescription
--systemstring(none)Resolve against this system, which the component must be a member of. Omit to resolve against its primary membership, the default for a caller with no system in hand.

Example:

Terminal window
omniglass component effective-tag list <name>

Commands for the effective-variable resource

omniglass component effective-variable list

Section titled “omniglass component effective-variable list”

Effective variables for a component

omniglass component effective-variable list <name>

Resolves the variables that cascade onto a component (platform -> location -> system -> component): names union, values override most-specific-wins, with the winner and the shadowed candidates it overrode. The system band comes from the component’s PRIMARY membership; resolving against a named system is not offered here yet, unlike effective-tags. Gated by variable:read; the component must be in the caller’s component read scope.

Example:

Terminal window
omniglass component effective-variable list <name>

Commands for the event resource

List a component’s recent events

omniglass component event list <name>

Returns the component’s recent log occurrences (the log-kind sink), newest first, bounded to the last 24 hours. Gated by component:read; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component event list <name>

Get a component

omniglass component get <name>

Fetches a component by name within the caller’s read scope. Out of scope is a non-disclosing 404. Gated by component:read.

Example:

Terminal window
omniglass component get <name>

List components in scope

omniglass component list

Lists the components the caller may read, each filtered to its scope subtree. Gated by component:read.

Example:

Terminal window
omniglass component list

List tags on a component

omniglass component listTags <name>

Lists the tags bound directly on a component (not the resolved cascade). Gated by component:read.

Example:

Terminal window
omniglass component listTags <name>

Commands for the membership resource

List the systems a component is in

omniglass component membership list <name>

The systems this component is bound into, ordered by name. A component may belong to several: a rack DSP serving three rooms is a member of all three, and each of them depends on it. Exactly one membership may be marked primary, the default for a question asked without a system in hand. Gated by component:read; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component membership list <name>

Commands for the property resource

Clear a property on a component

omniglass component property delete <name> <property>

Removes the component’s declared value, so the property falls back to the product contract’s default (or leaves the effective read entirely when it was off-contract). Clearing a property the component never set is a 404. Gated by component:update; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component property delete <name> <property>

List a component’s effective properties

omniglass component property list <name>

Every property the component’s product declares, resolved to the component’s own value or the contract default (is_set marks the override), plus any property set directly on the component (from_contract false). Gated by component:read; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component property list <name>

Set a property on a component

omniglass component property update <name> <property> [flags]

Declares a value for the property on this component, overriding the product contract’s default. Idempotent: the first set stores the value, a later set replaces it. The property need not be on the contract, but it must exist in the catalog (422 otherwise). Gated by component:update; an out-of-scope component is a non-disclosing 404.

FlagTypeDefaultDescription
--valuestring(none)The value to declare, shape given by the property’s data_type

Example:

Terminal window
omniglass component property update <name> <property> --value value

Commands for the reachability resource

Read a component’s per-interface reachability

omniglass component reachability list <name>

Composes, per interface, the latest reachability verdict, the probe-layer signals that compose it, and the recent verdict transitions for the availability strip. Gated by component:read; an out-of-scope component is a non-disclosing 404.

Example:

Terminal window
omniglass component reachability list <name>

Remove a tag value from a component

omniglass component removeTag <name> [flags]

Removes a key’s value from a component. Gated by component:update.

FlagTypeDefaultDescription
--keystring(none)The tag key to remove

Example:

Terminal window
omniglass component removeTag <name> --key key

Set a tag value on a component

omniglass component setTag <name> [flags]

Binds a value for a key on a component. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by component:update.

FlagTypeDefaultDescription
--keystring(none)The tag key (must exist and apply to this kind)
--valuestring(none)The bound value

Example:

Terminal window
omniglass component setTag <name> --key key --value value

Update a component

omniglass component update <name> [flags]

Patches a component’s technical name or display_name. Gated by component:update; read and update scopes drive the 404 versus 403 split.

FlagTypeDefaultDescription
--display-namestring(none)
--namestring(none)A new globally unique technical name (rename)

Example:

Terminal window
omniglass component update <name>

Commands for the driver resource

Create a driver

omniglass driver create [flags]

Creates a custom (non-official) driver. Gated by driver:create.

FlagTypeDefaultDescription
--display-namestring(none)
--namestring(none)The globally unique kebab handle; renameable
--versionstring(none)

Example:

Terminal window
omniglass driver create --display-name display_name --name name

Delete a driver

omniglass driver delete <id>

Deletes a custom driver, refused if official (422). Gated by driver:delete.

Example:

Terminal window
omniglass driver delete <id>

Get a driver

omniglass driver get <id>

Fetches a driver by id. Gated by driver:read.

Example:

Terminal window
omniglass driver get <id>

List drivers

omniglass driver list

Lists the driver registry, ordered alphabetically by display name. Populates the driver picker on the product form. Gated by driver:read.

Example:

Terminal window
omniglass driver list

Update a driver

omniglass driver update <id> [flags]

Patches a custom driver’s display_name or version. Official drivers are read-only (422). Gated by driver:update.

FlagTypeDefaultDescription
--display-namestring(none)
--versionstring(none)

Example:

Terminal window
omniglass driver update <id>

Commands for the file resource

Create a file from an upload

omniglass file create [flags]

Stores the uploaded bytes as a content-addressed blob (identical bytes dedup to one blob) and writes the file handle pointing at it. Gated by file:create; a sensitive file additionally needs the admin tier (file:create:admin).

FlagTypeDefaultDescription
--contentstring(none)The file bytes, base64-encoded
--content-typestring(none)The MIME type used to serve the file
--namestring(none)The file’s display name (a label, no path separators)
--sensitivestring(none)Admin-only visibility; defaults false. Setting true requires the admin tier

Example:

Terminal window
omniglass file create --content content --content-type content_type --name name

Delete a file

omniglass file delete <id>

Removes a file handle. The underlying blob is left in place (garbage collection is a later slice). A sensitive file is a non-disclosing 404 without the admin tier. Gated by file:delete.

Example:

Terminal window
omniglass file delete <id>

Download a file’s bytes

omniglass file download <id>

Returns a file’s bytes (base64-encoded) read from the blob it points at, the hash verified on read. A sensitive file is a non-disclosing 404 without the admin tier. Gated by file:read.

Example:

Terminal window
omniglass file download <id>

Get a file’s metadata

omniglass file get <id>

Returns one file handle’s searchable metadata (no bytes). A sensitive file is a non-disclosing 404 without the admin tier. Gated by file:read.

Example:

Terminal window
omniglass file get <id>

List files

omniglass file list

Lists the file handles the caller may see (searchable metadata, no bytes). Sensitive files appear only to the admin tier. Gated by file:read.

Example:

Terminal window
omniglass file list

Liveness and database-reachability probe

omniglass healthz

Reports process health and the database leg, pinged through the Storage Gateway.

Example:

Terminal window
omniglass healthz

Commands for the interface resource

Create an interface

omniglass interface create [flags]

Creates an interface owned by a component (or a server-hosted one, which needs an all-scoped grant). The create scope cascades through the owning component. Gated by interface:create.

FlagTypeDefaultDescription
--componentstring(none)Owning component, by name or id; omit for a server-hosted interface (needs an all-scoped grant)
--interface-typestring(none)An interface_type name (the protocol); the interface is named by it, unique within the component
--nodestring(none)Node placement, by name or id
--paramsstring(none)Endpoint/target settings (jsonb)

Example:

Terminal window
omniglass interface create --interface-type interface_type

Delete an interface

omniglass interface delete <id>

Deletes an interface, refused while a task still references it. Gated by interface:delete; read and delete scopes (through the component) drive the 404 versus 403 split.

Example:

Terminal window
omniglass interface delete <id>

Get an interface

omniglass interface get <id>

Fetches an interface by id. An interface whose component is out of the caller’s read scope is a non-disclosing 404. Gated by interface:read.

Example:

Terminal window
omniglass interface get <id>

List interfaces in scope

omniglass interface list

Lists the interfaces whose owning component the caller may read (the component cascade). Gated by interface:read.

Example:

Terminal window
omniglass interface list

Update an interface

omniglass interface update <id> [flags]

Patches an interface’s node placement or params. Gated by interface:update; read and update scopes (through the component) drive the 404 versus 403 split.

FlagTypeDefaultDescription
--nodestring(none)Reassign the node placement, by name or id
--paramsstring(none)Replace the endpoint/target settings (jsonb)

Example:

Terminal window
omniglass interface update <id>

Commands for the location resource

Check a location technical name

omniglass location checkName [flags]

Reports whether a proposed technical name is a valid slug and currently free. Advisory (Save is still gated by the unique constraint). Availability is scope-blind to match the global unique constraint. Gated by location:update.

FlagTypeDefaultDescription
--namestring(none)The proposed technical name to check

Example:

Terminal window
omniglass location checkName --name name

Create a location

omniglass location create [flags]

Creates a location, optionally under a parent (a root needs an all-scoped grant). Gated by location:create.

FlagTypeDefaultDescription
--display-namestring(none)
--location-typestring(none)A location_type id (campus, building, …)
--namestring(none)Globally unique name (the address; lowercase letters, digits, hyphens)
--parentstring(none)Parent location name; omit for a root location

Example:

Terminal window
omniglass location create --location-type location_type --name name

Delete a location

omniglass location delete <name>

Deletes a location, refused (409) while it still has child locations or is still referenced elsewhere. Gated by location:delete; read and delete scopes drive the 404 versus 403 split.

Example:

Terminal window
omniglass location delete <name>

Get a location

omniglass location get <name>

Fetches a location by name within the caller’s read scope. Out of scope is a non-disclosing 404. Gated by location:read.

Example:

Terminal window
omniglass location get <name>

Commands for the health resource

Read a location’s health

omniglass location health list <name>

The location’s current verdict, worst-wins over every system placed anywhere beneath it, with those systems and their verdicts as the drill-down (the system health read names the role, the capability, and the alarm). Transitions are the recorded edges over the last 30 days. Gated by location:read; an out-of-scope location is a non-disclosing 404.

Example:

Terminal window
omniglass location health list <name>

List locations in scope

omniglass location list

Lists the locations the caller may read, each filtered to its scope subtree. Gated by location:read.

Example:

Terminal window
omniglass location list

List tags on a location

omniglass location listTags <name>

Lists the tags bound directly on a location (not the resolved cascade). Gated by location:read.

Example:

Terminal window
omniglass location listTags <name>

Commands for the property resource

Clear a property on a location

omniglass location property delete <name> <property>

Removes the location’s declared value, so the property falls back to the location type contract’s default (or leaves the effective read entirely when it was off-contract). Clearing a property the location never set is a 404. Gated by location:update; an out-of-scope location is a non-disclosing 404.

Example:

Terminal window
omniglass location property delete <name> <property>

List a location’s effective properties

omniglass location property list <name>

Every property the location’s type declares, resolved to the location’s own value or the contract default (is_set marks the override), plus any property set directly on the location (from_contract false). Gated by location:read; an out-of-scope location is a non-disclosing 404.

Example:

Terminal window
omniglass location property list <name>

Set a property on a location

omniglass location property update <name> <property> [flags]

Declares a value for the property on this location, overriding the location type contract’s default. Idempotent: the first set stores the value, a later set replaces it. The property need not be on the contract, but it must exist in the catalog (422 otherwise). Gated by location:update; an out-of-scope location is a non-disclosing 404.

FlagTypeDefaultDescription
--valuestring(none)The value to declare, shape given by the property’s data_type

Example:

Terminal window
omniglass location property update <name> <property> --value value

Remove a tag value from a location

omniglass location removeTag <name> [flags]

Removes a key’s value from a location. Gated by location:update.

FlagTypeDefaultDescription
--keystring(none)The tag key to remove

Example:

Terminal window
omniglass location removeTag <name> --key key

Set a tag value on a location

omniglass location setTag <name> [flags]

Binds a value for a key on a location. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by location:update.

FlagTypeDefaultDescription
--keystring(none)The tag key (must exist and apply to this kind)
--valuestring(none)The bound value

Example:

Terminal window
omniglass location setTag <name> --key key --value value

Update a location

omniglass location update <name> [flags]

Patches a location’s display_name, location_type, or parent (a move). Gated by location:update; the read and update scopes drive the 404 versus 403 split.

FlagTypeDefaultDescription
--display-namestring(none)
--location-typestring(none)
--namestring(none)A new globally unique technical name (rename)
--parentstring(none)Re-parents the location (a tree move) to this location name, cycle-guarded and placement-validated. Moving to root is not supported via update this slice.

Example:

Terminal window
omniglass location update <name>

Commands for the location-type resource

Create a location type

omniglass location-type create [flags]

Creates a custom (non-official) location_type. Gated by type:create.

FlagTypeDefaultDescription
--allowed-parent-typesstring(none)location_type ids and/or the reserved root sentinel this type may be placed under; empty means unconstrained
--display-namestring(none)
--iconstring(none)A glyph key; the console falls back to map-pin when empty
--namestring(none)The globally unique kebab handle (e.g. wing); “root” is reserved

Example:

Terminal window
omniglass location-type create --display-name display_name --name name

Delete a location type

omniglass location-type delete <id>

Deletes a custom location_type, refused if official (422) or still referenced by a location (409). Gated by type:delete.

Example:

Terminal window
omniglass location-type delete <id>

List location types

omniglass location-type list

Lists the location_type registry (the shape-definers a location is classified by), ordered alphabetically by display name. Populates the type picker on the location form. Gated by type:read.

Example:

Terminal window
omniglass location-type list

Commands for the property resource

Withdraw a property from a location type

omniglass location-type property delete <id> <property>

Removes one line from a custom location type’s contract; locations of the type keep any value they set for it, now off-contract. A property the type does not declare is a 404, and an official type is read-only (422). Gated by type:delete.

Example:

Terminal window
omniglass location-type property delete <id> <property>

List a location type’s declared properties

omniglass location-type property list <id>

Lists the location type’s declared-property contract (what every location of the type exposes), ordered by property name, each with its optional default and required flag. Gated by type:read.

Example:

Terminal window
omniglass location-type property list <id>

Declare a property on a location type

omniglass location-type property update <id> <property> [flags]

Declares a catalog property on a custom location type, or revises the declaration in place (the line is addressed by name, so the write is idempotent). Official location types are read-only (422); an unknown type is a 404 and a property the catalog does not know is a 422. Gated by type:update.

FlagTypeDefaultDescription
--default-valuestring(none)The contract default, validated against the property’s data_type; omit for no default
--requiredstring(none)Whether every location of this type must set the property; defaults to false

Example:

Terminal window
omniglass location-type property update <id> <property>

Update a location type

omniglass location-type update <id> [flags]

Patches a custom location_type’s display_name or icon. Official types are read-only (422). Gated by type:update.

FlagTypeDefaultDescription
--allowed-parent-typesstring(none)Replaces the allowed-parent set; omit to leave unchanged, [] to clear back to unconstrained
--display-namestring(none)
--iconstring(none)

Example:

Terminal window
omniglass location-type update <id>

Apply embedded database migrations (dbmate)

omniglass migrate

Commands for the node resource

Claim a node identity in exchange for its NATS credential

omniglass node claim [flags]

The node-facing exchange: a node presents its enrollment token and receives its NATS credential (url, username, password). Public (the token is the authentication); an invalid token is a 401.

FlagTypeDefaultDescription
--namestring(none)
--tokenstring(none)

Example:

Terminal window
omniglass node claim --name name --token token

Create a node

omniglass node create [flags]

Registers an edge node server-side (day-one enrollment: create, then :enroll to mint its token). Gated by node:create.

FlagTypeDefaultDescription
--descriptionstring(none)
--display-namestring(none)Operator label; falls back to the name when empty
--locationstring(none)Optional location the node sits in, by name or id (descriptive placement, not scope)
--namestring(none)Globally unique node name (also its NATS subject token, so no dots or whitespace)

Example:

Terminal window
omniglass node create --name name

Delete a node

omniglass node delete <name>

Decommissions a node: a hard delete that cascades its interfaces, their derived tasks, its node-owned tags and self-telemetry, and its enrollment credential. Component telemetry it collected is unaffected. Requires an all-scope action. Gated by node:delete.

Example:

Terminal window
omniglass node delete <name>

Mint a node’s enrollment token

omniglass node enroll <name>

Mints (or re-mints) the node’s enrollment token and returns it once. The token is stored only as a hash; it is never logged. Gated by node:enroll.

Example:

Terminal window
omniglass node enroll <name>

Get a node

omniglass node get <name>

Fetches a node by name. Requires an all-scope read. Gated by node:read.

Example:

Terminal window
omniglass node get <name>

List nodes

omniglass node list

Lists the edge nodes. A node is estate-wide, so listing requires an all-scope read. Gated by node:read.

Example:

Terminal window
omniglass node list

List tags on a node

omniglass node listTags <name>

Lists the tags bound directly on a node (not the resolved cascade). Gated by node:read.

Example:

Terminal window
omniglass node listTags <name>

Remove a tag value from a node

omniglass node removeTag <name> [flags]

Removes a key’s value from a node. Gated by node:update.

FlagTypeDefaultDescription
--keystring(none)The tag key to remove

Example:

Terminal window
omniglass node removeTag <name> --key key

Run the edge node: claim, pull the worklist, and heartbeat over NATS

omniglass node run [flags]
FlagTypeDefaultDescription
--heartbeatduration30sheartbeat interval
--namestring(none)this node’s registered name (env OMNIGLASS_NODE_NAME)
--onceboolfalserun a single claim + pull + heartbeat cycle and exit
--serverstring(none)Omniglass server base URL (env OMNIGLASS_SERVER)
--tokenstring(none)enrollment token from POST /nodes/{name}:enroll (env OMNIGLASS_NODE_TOKEN)

Set a tag value on a node

omniglass node setTag <name> [flags]

Binds a value for a key on a node. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by node:update.

FlagTypeDefaultDescription
--keystring(none)The tag key (must exist and apply to this kind)
--valuestring(none)The bound value

Example:

Terminal window
omniglass node setTag <name> --key key --value value

Update a node

omniglass node update <name> [flags]

Patches a node’s display name, description, and location (a nil field is unchanged; a location of "" clears it). The name is immutable. Requires an all-scope action. Gated by node:update.

FlagTypeDefaultDescription
--descriptionstring(none)
--display-namestring(none)
--locationstring(none)Set the node’s location by name or id, or "" to clear it

Example:

Terminal window
omniglass node update <name>

Commands for the principal resource

Archive a principal

omniglass principal archive <id>

Soft-deletes a principal: it is hidden from the directory, can no longer authenticate, and its rows stay intact, reversibly (restore) until purged. Gated by principal:archive (all-scope). The last active owner cannot be archived.

Example:

Terminal window
omniglass principal archive <id>

Commands for the avatar resource

Get a principal’s profile picture

omniglass principal avatar list <id>

Returns the principal’s profile picture as a base64-encoded JPEG. Gated by principal:read:admin. A principal without a picture is a 404.

Example:

Terminal window
omniglass principal avatar list <id>

Create a human principal

omniglass principal create [flags]

Creates a human principal with an optional initial password. Gated by principal:create (all-scope). The new principal holds no grants; assign roles separately.

FlagTypeDefaultDescription
--display-namestring(none)
--emailstring(none)
--passwordstring(none)Optional initial password (at least 12 characters, not a common password, not containing the username); the user changes it after signing in
--usernamestring(none)Unique sign-in name (lowercase letters, digits, and . _ -)

Example:

Terminal window
omniglass principal create --username username

Disable a principal

omniglass principal disable <id>

Soft-disables a principal so it can no longer authenticate; its audit trail is kept. Gated by principal:update (all-scope). The last active owner cannot be disabled.

Example:

Terminal window
omniglass principal disable <id>

Enable a principal

omniglass principal enable <id>

Re-enables a disabled principal, restoring its ability to authenticate. Gated by principal:update (all-scope).

Example:

Terminal window
omniglass principal enable <id>

Get a principal

omniglass principal get <id>

Fetches one principal by id with its profile and grants. Gated by principal:read:admin.

Example:

Terminal window
omniglass principal get <id>

Commands for the grant resource

Grant a role to a principal

omniglass principal grant create <id> [flags]

Assigns a role at a scope to a principal. Gated by principal_grant:create (all-scope). Refused (403) when the granted role’s capabilities exceed the granter’s own (no promoting anyone, including yourself, to a higher tier such as owner). A duplicate is 409, an unknown role or bad scope 422.

FlagTypeDefaultDescription
--rolestring(none)A role id (viewer, operator, admin, owner, or a custom role)
--scope-idstring(none)The scope root id; omit for the all scope
--scope-kindstring(none)The scope kind; ‘all’ confers the whole estate
--scope-opstring(none)How the scope root matches the tree: subtree (root + descendants, the default), subtree_excl_root (descendants only for update/delete, root kept for read/create), or self (the root row only). Moot for the all scope.

Example:

Terminal window
omniglass principal grant create <id> --role role --scope-kind scope_kind

Revoke a grant

omniglass principal grant delete <id> <grantId>

Removes one grant from a principal. Gated by principal_grant:delete (all-scope). The last owner grant cannot be revoked.

Example:

Terminal window
omniglass principal grant delete <id> <grantId>

Impersonate a principal (view-as or act-as)

omniglass principal impersonate <id> [flags]

Mints a bounded, revocable token to view as (read-only) or act as (full) the target. Gated by principal:impersonate (all-scope). Refused on self, on an owner target (owners are un-impersonatable by anyone), when it would grant a capability the caller lacks (the escalation guard), or from within an existing impersonation.

FlagTypeDefaultDescription
--duration-minutesstring(none)Session lifetime in minutes (default 30, max 1440)
--modestring(none)view_as is read-only; act_as is full, with mutations attributed to both the real actor and the impersonated principal

Example:

Terminal window
omniglass principal impersonate <id> --mode mode

List principals

omniglass principal list [flags]

Lists all principals (humans and service accounts) with their grants. Gated by principal:read:admin.

FlagTypeDefaultDescription
--include-archivedboolfalseInclude archived (soft-deleted) principals, hidden by default
--kindstring(none)Optionally filter by principal kind

Example:

Terminal window
omniglass principal list

Purge a principal

omniglass principal purge <id>

Hard-deletes an archived principal and its owned rows (profile, credentials, grants, memberships); the audit trail is preserved. Irreversible. Gated by principal:purge (admin-sensitive, all-scope), and the principal must be archived first.

Example:

Terminal window
omniglass principal purge <id>

Remove a principal’s profile picture

omniglass principal removeAvatar <id>

Clears another human principal’s profile picture. Gated by principal:set-avatar (all-scope). Removing an absent picture is a no-op. Audited with the administrator as the actor.

Example:

Terminal window
omniglass principal removeAvatar <id>

Reset a principal’s password

omniglass principal resetPassword <id> [flags]

Sets a new password for another human principal (an administrator action; the target’s current password is not required). Gated by principal:reset-password (all-scope). The new password must meet the password policy; a violation is a 422. Refused on yourself (change your own password from your profile, which verifies your current one), on an owner (owners cannot be reset by anyone), or when it would exceed the caller’s own capabilities (the takeover guard, shared with impersonation). The action is audited with the administrator as the actor.

FlagTypeDefaultDescription
--passwordstring(none)The new password (at least 12 characters, not a common password, not containing the username)

Example:

Terminal window
omniglass principal resetPassword <id> --password password

Restore a principal

omniglass principal restore <id>

Reverses an archive: the account is restored to active and can authenticate again. Gated by principal:archive (all-scope).

Example:

Terminal window
omniglass principal restore <id>

Commands for the session resource

List a principal’s sessions

omniglass principal session list <id>

Lists another principal’s active bearer credentials (login sessions and API tokens) with their non-secret metadata, newest first, so an administrator can see where an account is signed in and revoke a session that should not be. Gated by principal:revoke-session (all-scope). The token secret is never returned, and current is always false (there is no “this request’s own session” when viewing another principal).

Example:

Terminal window
omniglass principal session list <id>

Revoke a principal’s session

omniglass principal session revoke <id> <sid>

Revokes one of another principal’s sessions or tokens by id (an administrator action; the target is immediately signed out of that credential). Gated by principal:revoke-session (all-scope). Bounded to the target, so a credential id that is not theirs is a non-disclosing 404, never a cross-principal revoke. Refused (403) on an owner (an owner’s sessions cannot be revoked by anyone, the takeover guard shared with impersonation and password reset) or when it would exceed the caller’s own capabilities. Audited with the administrator as the actor.

Example:

Terminal window
omniglass principal session revoke <id> <sid>

Revoke all of a principal’s sessions or tokens

omniglass principal session revokeAll <id> [flags]

Revokes every one of another principal’s web-login sessions, or every one of its CLI/API tokens (chosen by purpose), in a single administrator action, returning how many were ended. Gated by principal:revoke-session (all-scope). Bounded to the target and never crosses purpose (revoking sessions leaves tokens, and vice versa). Refused (403) on an owner (the takeover guard shared with impersonation and the password reset) or when it would exceed the caller’s own capabilities. Audited with the administrator as the actor.

FlagTypeDefaultDescription
--purposestring(none)Which credentials to revoke: all of the principal’s web-login sessions, or all its CLI/API tokens

Example:

Terminal window
omniglass principal session revokeAll <id> --purpose purpose

Set a principal’s profile picture

omniglass principal setAvatar <id> [flags]

Sets another human principal’s profile picture (an administrator action). Gated by principal:set-avatar (all-scope). The image (JPEG, PNG, or WebP, base64-encoded) is normalized server-side to a 256x256 JPEG; a bad or oversize image is a 422. Audited with the administrator as the actor.

FlagTypeDefaultDescription
--image-base64string(none)The image (JPEG, PNG, or WebP), base64-encoded; normalized server-side to a 256x256 JPEG

Example:

Terminal window
omniglass principal setAvatar <id> --image-base64 image_base64

Update a principal

omniglass principal update <id> [flags]

Updates a human principal’s display name, email, and username. Gated by principal:update (all-scope). Renaming is safe: nothing keys on the username.

FlagTypeDefaultDescription
--display-namestring(none)Display name; empty clears it
--emailstring(none)Email; empty clears it
--usernamestring(none)Sign-in name (lowercase letters, digits, and . _ -); renaming is safe

Example:

Terminal window
omniglass principal update <id>

Commands for the principal-group resource

Create a principal group

omniglass principal-group create [flags]

Creates a principal group. Gated by principal_group:create (all-scope). A duplicate name is 409.

FlagTypeDefaultDescription
--descriptionstring(none)
--display-namestring(none)
--namestring(none)Unique group name (lowercase letters, digits, and . _ -)

Example:

Terminal window
omniglass principal-group create --name name

Delete a principal group

omniglass principal-group delete <id>

Removes a group and, by cascade, its memberships and grants. Gated by principal_group:delete (all-scope).

Example:

Terminal window
omniglass principal-group delete <id>

Get a principal group

omniglass principal-group get <id>

One principal group by id. Gated by principal_group:read:admin.

Example:

Terminal window
omniglass principal-group get <id>

Commands for the grant resource

Grant a role to a group

omniglass principal-group grant create <id> [flags]

Assigns a role at a scope to a group; its members inherit it. Gated by principal_grant:create (all-scope). Refused (403) when the granted role’s capabilities exceed the granter’s own, exactly as for a direct grant. A duplicate is 409.

FlagTypeDefaultDescription
--rolestring(none)A role id (viewer, operator, admin, owner, or a custom role)
--scope-idstring(none)The scope root id; omit for the all scope
--scope-kindstring(none)The scope kind; ‘all’ confers the whole estate
--scope-opstring(none)How the scope root matches the tree; moot for the all scope

Example:

Terminal window
omniglass principal-group grant create <id> --role role --scope-kind scope_kind

Revoke a group grant

omniglass principal-group grant delete <id> <grantId>

Removes one grant from a group. Gated by principal_grant:delete (all-scope).

Example:

Terminal window
omniglass principal-group grant delete <id> <grantId>

List a group’s grants

omniglass principal-group grant list <id>

The role x scope grants a group confers on its members. Gated by principal_group:read:admin.

Example:

Terminal window
omniglass principal-group grant list <id>

List principal groups

omniglass principal-group list

Every principal group. Gated by principal_group:read:admin.

Example:

Terminal window
omniglass principal-group list

Commands for the member resource

Add a member to a group

omniglass principal-group member create <id> [flags]

Adds a principal to a group; its members inherit the group’s grants. Gated by principal_group:update (all-scope). Idempotent.

FlagTypeDefaultDescription
--principal-idstring(none)The principal to add to the group

Example:

Terminal window
omniglass principal-group member create <id> --principal-id principal_id

Remove a member from a group

omniglass principal-group member delete <id> <principalId>

Removes a principal from a group; it stops inheriting the group’s grants. Gated by principal_group:update (all-scope).

Example:

Terminal window
omniglass principal-group member delete <id> <principalId>

List a group’s members

omniglass principal-group member list <id>

The principals in a group. Gated by principal_group:read:admin.

Example:

Terminal window
omniglass principal-group member list <id>

Update a principal group

omniglass principal-group update <id> [flags]

Updates a group’s name and presentational fields. Gated by principal_group:update (all-scope). A duplicate name is 409.

FlagTypeDefaultDescription
--descriptionstring(none)Description; empty clears it
--display-namestring(none)Display name; empty clears it
--namestring(none)Group name (lowercase letters, digits, and . _ -); renaming is safe

Example:

Terminal window
omniglass principal-group update <id>

Commands for the product resource

Create a product

omniglass product create [flags]

Creates a custom (non-official) product and sets its capabilities. Gated by product:create.

FlagTypeDefaultDescription
--capabilitiesstring(none)
--display-namestring(none)
--driver-idstring(none)
--kindstring(none)
--namestring(none)The globally unique kebab handle; renameable
--parent-product-idstring(none)The parent product, by handle or uuid
--vendor-idstring(none)The vendor, by handle or uuid

Example:

Terminal window
omniglass product create --display-name display_name --name name

Delete a product

omniglass product delete <id>

Deletes a custom product, refused if official (422) or still referenced by a component (409). Gated by product:delete.

Example:

Terminal window
omniglass product delete <id>

Get a product

omniglass product get <id>

Fetches a product by id, with its capabilities. Gated by product:read.

Example:

Terminal window
omniglass product get <id>

List products

omniglass product list

Lists the product registry, ordered alphabetically by display name. Each product carries its vendor, driver, kind, and capabilities. Gated by product:read.

Example:

Terminal window
omniglass product list

Commands for the property resource

Withdraw a property from a product

omniglass product property delete <id> <property>

Removes one line from a custom product’s contract; instances keep any value they set for it, now off-contract. A property the product does not declare is a 404, and an official product is read-only (422). Gated by product:delete.

Example:

Terminal window
omniglass product property delete <id> <property>

List a product’s declared properties

omniglass product property list <id>

Lists the product’s declared-property contract (what every instance of the product exposes), ordered by property name, each with its optional default and required flag. Gated by product:read.

Example:

Terminal window
omniglass product property list <id>

Declare a property on a product

omniglass product property update <id> <property> [flags]

Declares a catalog property on a custom product, or revises the declaration in place (the line is addressed by name, so the write is idempotent). Official products are read-only (422), and an unknown product or property is a 422. Gated by product:update.

FlagTypeDefaultDescription
--default-valuestring(none)The contract default, validated against the property’s data_type; omit for no default
--requiredstring(none)Whether every instance of this product must set the property; defaults to false

Example:

Terminal window
omniglass product property update <id> <property>

Update a product

omniglass product update <id> [flags]

Patches a custom product’s display_name, vendor, driver, kind, or parent, and replaces its capabilities when provided. Official products are read-only (422). Gated by product:update.

FlagTypeDefaultDescription
--capabilitiesstring(none)
--display-namestring(none)
--driver-idstring(none)
--kindstring(none)
--parent-product-idstring(none)
--vendor-idstring(none)

Example:

Terminal window
omniglass product update <id>

Commands for the property-type resource

Create a property

omniglass property-type create [flags]

Registers a custom property (official=false). The name must be a valid property key. Gated by property_type:create.

FlagTypeDefaultDescription
--data-typestring(none)The value type
--descriptionstring(none)What the property means
--display-namestring(none)A human label
--kindstring(none)The observed kind; omit for a declared-only property
--namestring(none)The property name (lowercase, dot-hierarchied)
--unitstring(none)A display unit (observed properties)
--validationstring(none)A JSON Schema fragment constraining the value

Example:

Terminal window
omniglass property-type create --data-type data_type --name name

Delete a property

omniglass property-type delete <name>

Removes a custom property by name. Official properties are read-only. Gated by property_type:delete.

Example:

Terminal window
omniglass property-type delete <name>

Get a property

omniglass property-type get <name>

Returns one property by name. Gated by property_type:read.

Example:

Terminal window
omniglass property-type get <name>

List properties

omniglass property-type list

Lists every registered property (official and custom). The catalog is estate-wide reference data. Gated by property_type:read.

Example:

Terminal window
omniglass property-type list

Update a property

omniglass property-type update <name> [flags]

Patches a custom property’s label, description, unit, or validation (a nil field is unchanged). Data type and kind are fixed at creation. Official properties are read-only. Gated by property_type:update.

FlagTypeDefaultDescription
--descriptionstring(none)What the property means
--display-namestring(none)A human label
--unitstring(none)A display unit
--validationstring(none)A JSON Schema fragment (replaces wholesale)

Example:

Terminal window
omniglass property-type update <name>

Commands for the role resource

List roles

omniglass role list

Lists the roles with their metadata and effective (flattened) permissions. Gated by the role:read:admin capability.

Example:

Terminal window
omniglass role list

Commands for the secret resource

Decrypt a secret for clipboard copy

omniglass secret copy <id>

Decrypts and returns a secret’s field values for a clipboard copy, audited under the copy verb (distinct from an on-screen reveal). Same exposure and the same secret:reveal gate as reveal.

Example:

Terminal window
omniglass secret copy <id>

Create a secret

omniglass secret create [flags]

Seals a secret at an owner scope. Fields are validated and encrypted against the type shape. Gated by secret:create, plus platform:create when owner_kind is platform (the install-wide tier).

FlagTypeDefaultDescription
--admin-sensitivestring(none)Admin-only visibility; omit to use the type default. Setting true requires the admin tier
--fieldsstring(none)The operator field map, validated against the type shape
--namestring(none)The cascade key; unique per owner
--ownerstring(none)The owning entity’s name; omit for a platform secret
--owner-kindstring(none)Which tier owns this secret
--secret-typestring(none)A secret_type id

Example:

Terminal window
omniglass secret create --fields fields --name name --owner-kind owner_kind --secret-type secret_type

Delete a secret

omniglass secret delete <id>

Removes a secret by id. Gated by secret:delete, plus platform:delete when the secret sits at the platform tier; read and delete scopes on the owner drive the 404 versus 403 split.

Example:

Terminal window
omniglass secret delete <id>

List secrets

omniglass secret list

Lists the secrets the caller may see, with masked fields, filtered to the read scope; admin-sensitive secrets appear only to the admin tier. Gated by secret:read, which the viewer floor does not carry (secret is a sensitive resource).

Example:

Terminal window
omniglass secret list

Reveal a secret’s plaintext

omniglass secret reveal <id>

Decrypts and returns a secret’s field values, auditing the decrypt. Gated by secret:reveal at the caller’s scope; an admin-sensitive secret additionally needs the admin tier (secret:reveal:admin), so a scoped operator reveals device secrets but never a platform credential.

Example:

Terminal window
omniglass secret reveal <id>

Update a secret’s field values

omniglass secret update <id> [flags]

Replaces the given field values on a secret, re-sealing secret fields. Only values change; name, type, and owner are fixed at creation. An omitted field keeps its value. Gated by secret:update, plus platform:update when the secret sits at the platform tier.

FlagTypeDefaultDescription
--fieldsstring(none)The field values to replace; an omitted field keeps its value

Example:

Terminal window
omniglass secret update <id> --fields fields

Commands for the secret-type resource

List secret types

omniglass secret-type list

Lists the secret_type shapes a secret can take, for the create form. Gated by secret:read.

Example:

Terminal window
omniglass secret-type list

Seed a dev database with example locations, users, and grants (idempotent; never for production)

omniglass seed-dev

Populate a fresh dev database with a small example estate so make dev comes up with locations, sign-in-able users, and their grants instead of empty. The same trusted direct-DB lane as bootstrap, and idempotent, so it runs on every make dev. Not for production: these are operator rows, not ship-with reference data.

Run the control-plane server (HTTP API)

omniglass server

Commands for the session resource

List your own sessions and tokens

omniglass session list

Lists the caller’s own active bearer credentials (time-bounded web-login sessions and CLI/API tokens) with their non-secret metadata; the current one is flagged. Requires authentication; self-scoped (never another principal’s). The token secret is never returned.

Example:

Terminal window
omniglass session list

Revoke one of your own sessions

omniglass session revoke <id>

Revokes one of the caller’s own sessions or tokens by id (from the session list); revoking the current one signs it out. Requires authentication; self-scoped, so a credential id that is not yours is a 404.

Example:

Terminal window
omniglass session revoke <id>

Revoke all of your own sessions or tokens

omniglass session revoke-all [flags]

Revokes every one of the caller’s own web-login sessions, or every one of its CLI/API tokens (chosen by purpose), returning how many were ended. Requires authentication; self-scoped. Always keeps the credential that made this request, so you are never signed out of the one you are on; sessions and tokens never cross.

FlagTypeDefaultDescription
--purposestring(none)Which of your own credentials to revoke: all your web-login sessions, or all your CLI/API tokens

Example:

Terminal window
omniglass session revoke-all --purpose purpose

Set or rotate a user’s console password, revoking their sessions (direct DB)

omniglass set-password <username> <password> [flags]

Installs or replaces a human’s password credential (argon2id), addressed by username, and revokes the user’s live SESSIONS so a break-glass reset locks out any stolen login at once. API tokens are a separate bearer secret, not tied to the password, and are kept unless —revoke-tokens is given (a full lockout of a compromised account). The same trusted direct-DB lane as bootstrap and token: dev setup, break-glass, or a password reset before the admin UI lands.

FlagTypeDefaultDescription
--revoke-tokensboolfalsealso revoke the user’s API tokens (a full lockout of a compromised account)

Commands for the setting resource

Restore a settings namespace to defaults

omniglass setting delete <namespace>

Drops the namespace’s platform override, restoring the file layer and the declared defaults. Gated by settings:update and platform:update.

Example:

Terminal window
omniglass setting delete <namespace>

Get effective settings with provenance

omniglass setting list

The effective settings document plus per-key provenance (which level won) and lock state. Gated by settings:read (admin).

Example:

Terminal window
omniglass setting list

Commands for the me resource

Get the caller’s effective settings

omniglass setting me list

The current principal’s resolved settings, client-visible namespaces only, no provenance. Feeds the SPA at boot. Requires authentication.

Example:

Terminal window
omniglass setting me list

Restore all settings to defaults

omniglass setting restoreDefaults

Removes every platform override (a factory reset). Gated by settings:update and platform:update.

Example:

Terminal window
omniglass setting restoreDefaults

Update a settings namespace

omniglass setting update <namespace>

Applies an RFC 7386 JSON Merge Patch to the namespace’s platform override; null on a key restores it. Gated by settings:update and platform:update.

Example:

Terminal window
omniglass setting update <namespace>

Commands for the standard resource

Create a standard

omniglass standard create [flags]

Creates a custom (non-official) standard, optionally as a variant of another. Gated by standard:create.

FlagTypeDefaultDescription
--display-namestring(none)
--namestring(none)The globally unique kebab handle; renameable
--parent-standard-idstring(none)A standard this one is a variant of, by handle or uuid

Example:

Terminal window
omniglass standard create --display-name display_name --name name

Delete a standard

omniglass standard delete <id>

Deletes a custom standard, refused if official (422) or still referenced by a system (409). Gated by standard:delete.

Example:

Terminal window
omniglass standard delete <id>

Get a standard

omniglass standard get <id>

Fetches a standard by id. Gated by standard:read.

Example:

Terminal window
omniglass standard get <id>

List standards

omniglass standard list

Lists the standard catalog, ordered alphabetically by display name. A standard is the blueprint a system conforms to. Gated by standard:read.

Example:

Terminal window
omniglass standard list

Commands for the property resource

Withdraw a property from a standard

omniglass standard property delete <id> <property>

Removes one line from a custom standard’s contract; conforming systems keep any value they set for it, now off-contract. A property the standard does not declare is a 404, and an official standard is read-only (422). Gated by standard:delete.

Example:

Terminal window
omniglass standard property delete <id> <property>

List a standard’s declared properties

omniglass standard property list <id>

Lists the standard’s declared-property contract (what every system conforming to it exposes), ordered by property name, each with its optional default and required flag. Gated by standard:read.

Example:

Terminal window
omniglass standard property list <id>

Declare a property on a standard

omniglass standard property update <id> <property> [flags]

Declares a catalog property on a custom standard, or revises the declaration in place (the line is addressed by name, so the write is idempotent). Official standards are read-only (422); an unknown standard is a 404 and a property the catalog does not know is a 422. Gated by standard:update.

FlagTypeDefaultDescription
--default-valuestring(none)The contract default, validated against the property’s data_type; omit for no default
--requiredstring(none)Whether every system conforming to this standard must set the property; defaults to false

Example:

Terminal window
omniglass standard property update <id> <property>

Commands for the role resource

Withdraw a role from a standard

omniglass standard role delete <id> <role>

Removes the role from the standard, and with it every assignment conforming systems made to it. A role the standard does not declare is a 404. Gated by standard:delete.

Example:

Terminal window
omniglass standard role delete <id> <role>

List a standard’s declared roles

omniglass standard role list <id>

Lists the roles this standard declares (every conforming system inherits them live), ordered by name, each with its quorum and the capabilities a component must provide to fill it. Gated by standard:read.

Example:

Terminal window
omniglass standard role list <id>

Declare a role on a standard

omniglass standard role update <id> <role> [flags]

Declares a role every conforming system needs filled, or revises it in place (the role is addressed by name, so the write is idempotent). The capability list replaces the required set wholesale. An unknown standard or capability is a 422. Gated by standard:update.

FlagTypeDefaultDescription
--capabilitiesstring(none)The capabilities a component must ALL provide; replaces the required set wholesale
--display-namestring(none)The role’s human label; defaults to the role name
--impactstring(none)What an impaired role means for its system; omit for degraded. The same broken component matters differently depending on the slot it was filling: a dead confidence monitor is not a dead main display
--quorumstring(none)How many components must fill the role; omit for one

Example:

Terminal window
omniglass standard role update <id> <role>

Update a standard

omniglass standard update <id> [flags]

Patches a custom standard’s display_name or parent. Official standards are read-only (422). Gated by standard:update.

FlagTypeDefaultDescription
--display-namestring(none)
--parent-standard-idstring(none)

Example:

Terminal window
omniglass standard update <id>

Commands for the system resource

Check a system technical name

omniglass system checkName [flags]

Reports whether a proposed technical name is a valid slug and currently free. Advisory (Save is still gated by the unique constraint). Availability is scope-blind to match the global unique constraint. Gated by system:update.

FlagTypeDefaultDescription
--namestring(none)The proposed technical name to check

Example:

Terminal window
omniglass system checkName --name name

Create a system

omniglass system create [flags]

Creates a system, optionally under a parent (a root needs an all-scoped grant) and at a location. Gated by system:create.

FlagTypeDefaultDescription
--display-namestring(none)
--locationstring(none)Location name this system is placed at
--namestring(none)Globally unique name (the address; lowercase letters, digits, hyphens)
--parentstring(none)Parent system name; omit for a root system
--standard-idstring(none)A standard id; omit for a one-off system that conforms to none

Example:

Terminal window
omniglass system create --name name

Delete a system

omniglass system delete <name>

Deletes a system, refused (409) while it still has child systems or is still referenced elsewhere. Gated by system:delete; read and delete scopes drive the 404 versus 403 split.

Example:

Terminal window
omniglass system delete <name>

Get a system

omniglass system get <name>

Fetches a system by name within the caller’s read scope. Out of scope is a non-disclosing 404. Gated by system:read.

Example:

Terminal window
omniglass system get <name>

Commands for the health resource

Read a system’s health

omniglass system health list <name>

The system’s current verdict and why: every role it needs filled, whether it is impaired, what an impaired role means for the system (impact), and for an impaired role the required capabilities an alarm has taken away plus the alarms that took them. Transitions are the recorded edges over the last 30 days, one entry per change. Gated by system:read; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system health list <name>

List systems in scope

omniglass system list

Lists the systems the caller may read, each filtered to its scope subtree. Gated by system:read.

Example:

Terminal window
omniglass system list

List tags on a system

omniglass system listTags <name>

Lists the tags bound directly on a system (not the resolved cascade). Gated by system:read.

Example:

Terminal window
omniglass system listTags <name>

Commands for the member resource

Take a component out of a system

omniglass system member delete <name> <component>

Unbinds this component from the system. Refused with a 409 while it still fills a role here, since removing it would leave the system staffed by a non-member: unassign the role first. A component that was not a member is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system member delete <name> <component>

List the components in a system

omniglass system member list <name>

The components bound into this system, ordered by name. Membership is what a role attaches to: every component staffing a role here is a member, and a member may also carry no role at all (a power conditioner is in the room without filling a declared slot). Gated by system:read; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system member list <name>

Make this the component’s default system

omniglass system member setPrimary <name> <component>

Moves the component’s default to this membership. The default answers questions asked without a system in hand; it does not decide anything that names a system explicitly. A component that was not a member here is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system member setPrimary <name> <component>

Put a component in a system

omniglass system member update <name> <component>

Binds this component into the system. Idempotent. A component’s first membership becomes its primary with nobody asking, so a component in exactly one system never has to think about the concept; a later membership does not take that default away. Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system member update <name> <component>

Commands for the property resource

Clear a property on a system

omniglass system property delete <name> <property>

Removes the system’s declared value, so the property falls back to the standard contract’s default (or leaves the effective read entirely when it was off-contract). Clearing a property the system never set is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system property delete <name> <property>

List a system’s effective properties

omniglass system property list <name>

Every property the system’s standard declares, resolved to the system’s own value or the contract default (is_set marks the override), plus any property set directly on the system (from_contract false). Gated by system:read; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system property list <name>

Set a property on a system

omniglass system property update <name> <property> [flags]

Declares a value for the property on this system, overriding the standard contract’s default. Idempotent: the first set stores the value, a later set replaces it. The property need not be on the contract, but it must exist in the catalog (422 otherwise). Gated by system:update; an out-of-scope system is a non-disclosing 404.

FlagTypeDefaultDescription
--valuestring(none)The value to declare, shape given by the property’s data_type

Example:

Terminal window
omniglass system property update <name> <property> --value value

Remove a tag value from a system

omniglass system removeTag <name> [flags]

Removes a key’s value from a system. Gated by system:update.

FlagTypeDefaultDescription
--keystring(none)The tag key to remove

Example:

Terminal window
omniglass system removeTag <name> --key key

Commands for the role resource

Commands for the assignment resource

Unassign a component from a role

omniglass system role assignment delete <name> <role> <component>

Takes this component out of the role, leaving the role understaffed until another fills it. A component that was not filling the role is a 404. Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system role assignment delete <name> <role> <component>

Assign a component to a role

omniglass system role assignment update <name> <role> <component>

Puts this component in the role for this system. Refused with a 422 naming the missing capabilities when the component does not provide everything the role requires (its product’s capabilities, plus what it adds, minus what it suppresses). Idempotent. Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system role assignment update <name> <role> <component>

Withdraw a role from a system

omniglass system role delete <name> <role>

Removes a role declared on this system, and with it every assignment to it. A role the system does not declare itself is a 404 (a role inherited from its standard is withdrawn on the standard, not here). Gated by system:update; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system role delete <name> <role>

List a system’s effective roles

omniglass system role list <name>

Every role this system needs filled: those its standard declares (from_standard true) plus those declared directly on it, each with the capabilities it requires, the components filling it, and how many more it wants before quorum (understaffed). A one-off system shows only its own. Gated by system:read; an out-of-scope system is a non-disclosing 404.

Example:

Terminal window
omniglass system role list <name>

Declare a role on a system

omniglass system role update <name> <role> [flags]

Declares a role directly on this system (how a one-off system gets roles at all, and how a conforming one adds what its standard does not cover), or revises it in place. The capability list replaces the required set wholesale. Gated by system:update; an out-of-scope system is a non-disclosing 404.

FlagTypeDefaultDescription
--capabilitiesstring(none)The capabilities a component must ALL provide; replaces the required set wholesale
--display-namestring(none)The role’s human label; defaults to the role name
--impactstring(none)What an impaired role means for its system; omit for degraded. The same broken component matters differently depending on the slot it was filling: a dead confidence monitor is not a dead main display
--quorumstring(none)How many components must fill the role; omit for one

Example:

Terminal window
omniglass system role update <name> <role>

Set a tag value on a system

omniglass system setTag <name> [flags]

Binds a value for a key on a system. The key must exist and apply to this entity kind. Setting a value is the ordinary entity write, gated by system:update.

FlagTypeDefaultDescription
--keystring(none)The tag key (must exist and apply to this kind)
--valuestring(none)The bound value

Example:

Terminal window
omniglass system setTag <name> --key key --value value

Update a system

omniglass system update <name> [flags]

Patches a system’s display_name or standard. An omitted standard_id leaves it unchanged; an explicit empty string clears it, converting the system to a one-off. Gated by system:update; read and update scopes drive the 404 versus 403 split.

FlagTypeDefaultDescription
--display-namestring(none)
--namestring(none)A new globally unique technical name (rename)
--standard-idstring(none)

Example:

Terminal window
omniglass system update <name>

Commands for the tag resource

Clear a platform tag value

omniglass tag clearPlatform <name>

Removes the platform-tier binding for a key. Gated by tag:update (all-scope) and platform:update.

Example:

Terminal window
omniglass tag clearPlatform <name>

Mint a tag key

omniglass tag create [flags]

Adds a key to the governed vocabulary. The name is normalized (a lowercase identifier). Gated by tag:create (all-scope, an admin action).

FlagTypeDefaultDescription
--allowed-valuesstring(none)The value enum a bound value must belong to; omit for free text
--applies-tostring(none)Entity kinds this key may bind to (component, system, location); omit for universal
--namestring(none)The normalized key: a lowercase identifier, unique tenant-wide
--propagatesstring(none)Whether bindings cascade to descendants; defaults true

Example:

Terminal window
omniglass tag create --name name

Delete a tag key

omniglass tag delete <name>

Removes a key from the vocabulary, cascading its bindings. Gated by tag:delete (all-scope).

Example:

Terminal window
omniglass tag delete <name>

List tag keys

omniglass tag list

Lists the governed key vocabulary. Rides the tag:read floor.

Example:

Terminal window
omniglass tag list

Set a platform tag value

omniglass tag setPlatform <name> [flags]

Binds an install-wide default value for a key at the platform tier. Gated by tag:update (all-scope) and platform:update.

FlagTypeDefaultDescription
--valuestring(none)The bound value

Example:

Terminal window
omniglass tag setPlatform <name> --value value

Update a tag key

omniglass tag update <name> [flags]

Replaces a key’s governance fields (applies_to, propagates); the name is fixed. Gated by tag:update (all-scope).

FlagTypeDefaultDescription
--allowed-valuesstring(none)The value enum a bound value must belong to; omit for free text
--applies-tostring(none)Entity kinds this key may bind to; omit for universal
--propagatesstring(none)Whether bindings cascade to descendants; defaults true

Example:

Terminal window
omniglass tag update <name>

List the distinct values bound for a key

omniglass tag values <name>

Returns the distinct values already bound for a key across the estate, for value autocomplete on a free-text key (an enum key carries its allowed set on the key itself). Rides the tag:read floor.

Example:

Terminal window
omniglass tag values <name>

Commands for the task resource

Get a task

omniglass task get <id>

Fetches a task by id. A task whose component is out of the caller’s read scope is a non-disclosing 404. Gated by task:read.

Example:

Terminal window
omniglass task get <id>

List tasks in scope

omniglass task list

Lists the tasks whose interface’s owning component the caller may read (the component cascade). Tasks are derived from interfaces, not authored. Gated by task:read.

Example:

Terminal window
omniglass task list

Mint an additional bearer token for an existing principal (direct DB)

omniglass token <username> [flags]

Issues a new bearer credential for an existing principal, addressed by username, and prints the token once. The same trusted direct-DB lane as bootstrap: token reissue, break-glass, or a fresh login token for make dev when the owner already exists. A —description (required) names what the token is for. The token expires after —ttl (default 90 days, hard maximum 365 days); every credential is time-bounded.

FlagTypeDefaultDescription
--descriptionstring(none)what the token is for (required)
--ttlduration2160h0m0show long the token is valid before it expires (max 365 days)

Commands for the variable resource

Create a variable

omniglass variable create [flags]

Sets a variable at an owner scope. The value is validated against value_type. Gated by variable:create, plus platform:create when owner_kind is platform (the install-wide tier).

FlagTypeDefaultDescription
--namestring(none)The cascade key; unique per owner
--ownerstring(none)The owning entity’s name; omit for a platform variable
--owner-kindstring(none)Which tier owns this variable
--valuestring(none)The value, validated against value_type
--value-typestring(none)The declared value type

Example:

Terminal window
omniglass variable create --name name --owner-kind owner_kind --value value --value-type value_type

Delete a variable

omniglass variable delete <id>

Removes a variable by id. Gated by variable:delete, plus platform:delete when the variable sits at the platform tier; read and delete scopes on the owner drive the 404 versus 403 split.

Example:

Terminal window
omniglass variable delete <id>

List variables (admin directory)

omniglass variable list

Lists every variable. Requires an all-scope read. Gated by variable:read.

Example:

Terminal window
omniglass variable list

Update a variable’s value

omniglass variable update <id> [flags]

Replaces a variable’s value, validated against its fixed value_type. Only the value changes; name, type, and owner are fixed at creation. Gated by variable:update, plus platform:update when the variable sits at the platform tier.

FlagTypeDefaultDescription
--valuestring(none)The new value, validated against the fixed value_type

Example:

Terminal window
omniglass variable update <id> --value value

Commands for the vendor resource

Create a vendor

omniglass vendor create [flags]

Creates a custom (non-official) vendor. Gated by vendor:create.

FlagTypeDefaultDescription
--display-namestring(none)
--iconstring(none)
--kindstring(none)
--namestring(none)The globally unique kebab handle; renameable
--support-phonestring(none)
--websitestring(none)

Example:

Terminal window
omniglass vendor create --display-name display_name --name name

Delete a vendor

omniglass vendor delete <id>

Deletes a custom vendor, refused if official (422). Gated by vendor:delete.

Example:

Terminal window
omniglass vendor delete <id>

Get a vendor

omniglass vendor get <id>

Fetches a vendor by id. Gated by vendor:read.

Example:

Terminal window
omniglass vendor get <id>

List vendors

omniglass vendor list

Lists the vendor registry, ordered alphabetically by display name. Populates the vendor picker on the product form. Gated by vendor:read.

Example:

Terminal window
omniglass vendor list

Update a vendor

omniglass vendor update <id> [flags]

Patches a custom vendor’s display_name, kind, icon, support_phone, or website. Official vendors are read-only (422). Gated by vendor:update.

FlagTypeDefaultDescription
--display-namestring(none)
--iconstring(none)
--kindstring(none)
--support-phonestring(none)
--websitestring(none)

Example:

Terminal window
omniglass vendor update <id>