CLI reference

Every command and option of limen, generated from the binary. For examples and how the commands fit together, see the CLI guide.

limen

Limen command-line client.

Usage: limen [OPTIONS] <COMMAND>

Options:

• --color <WHEN>: When to use colour: auto, always, or never. Values: auto, always, never. Default: auto.
• --proxy <PROXY>: Proxy address, for example limen.example.com:443. Defaults to the last one used. Environment: LIMEN_PROXY.
• -d, --detach: Run a connect command in the background and return once it is listening.

limen login

Log in through the identity provider and get short-lived credentials

Usage: limen login [OPTIONS]

Options:

• --device: Use the device code flow, for machines without a browser.
• --no-browser: Print the login URL instead of opening a browser.
• --ca-file <CA_FILE>: CA certificate to trust for the proxy. Pinned for later commands.
• --bot <METHOD>: Log in as a bot with this CI platform’s identity token, instead of as a person. In GitHub Actions the token is requested for you. Values: github_actions, gitlab, oidc.
• --bot-name <NAME>: Which bot, if more than one could match the token.
• --token-env <VAR>: Read the token from this environment variable (default for gitlab and oidc: LIMEN_ID_TOKEN).
• --token-file <FILE>: Read the token from this file, or - for standard input.
• --audience <AUD>: The audience to ask GitHub for. Defaults to the one the control plane expects.

limen logout

Delete local credentials

Usage: limen logout [OPTIONS]

limen status

Show the current identity, roles, and when the credentials expire

Usage: limen status [OPTIONS]

Options:

• --json: Output JSON instead of text.

limen ls

List resources you are allowed to access

Usage: limen ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.
• --type <KIND>: Only resources of this type, such as postgres or ssh.

limen request

Ask for access to a resource for a limited time, with a reason

Usage: limen request [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --role <ROLE>: Which requestable role, when more than one reaches the resource.
• --for <DURATION>: How long you need it, such as 30m or 2h. The role sets the limit.
• -m, --reason <REASON>: Why. Approvers and auditors read it; some roles want a ticket id in it.
• --break-glass: Use a break-glass role: granted at once, and reviewed afterwards.
• --wait: Wait for an approver instead of returning.
• --json

limen requests

Your access requests. --approvals shows the ones waiting for you

Usage: limen requests [OPTIONS]

Options:

• --approvals: Requests you may approve or deny.
• --all: Every request (limen:admin or limen:auditor).
• --status <STATUS>: pending, approved, denied, expired, cancelled, or revoked.
• --json

limen approve

Approve an access request. Never your own

Usage: limen approve [OPTIONS] <ID>

Arguments:

• <ID>

Options:

• -m, --comment <COMMENT>

limen deny

Deny an access request

Usage: limen deny [OPTIONS] <ID>

Arguments:

• <ID>

Options:

• -m, --comment <COMMENT>

limen cancel

Withdraw an access request of yours that is still waiting

Usage: limen cancel [OPTIONS] <ID>

Arguments:

• <ID>

limen explain

Say why you can or cannot reach a resource

Usage: limen explain [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --as <KIND=NAME>: What you would use on it, such as login=ubuntu or db_role=limen_read.
• --database <DATABASE>: With db_role or mongo_role: the database.
• --user <USER>: Explain for this user, with the full trace (limen:admin).
• --json

limen review

Access reviews waiting for you: limen review ls, certify, flag

Usage: limen review [OPTIONS] <COMMAND>

limen review start

Start an access review: a snapshot of who holds which role, sent to its owners

Usage: limen review start [OPTIONS]

Options:

• --name <NAME>
• --due-days <DUE_DAYS>: Days the reviewers have (default 14). Default: 14.
• --override-days <OVERRIDE_DAYS>: Days a flagged role stays withheld (default 30). Default: 30.

limen review ls

Reviews. By default those with items for you

Usage: limen review ls [OPTIONS]

Options:

• --all: Every review (limen:admin or limen:auditor).
• --json

limen review items

The items of a review: yours, or all of them for admins and auditors

Usage: limen review items [OPTIONS] <REVIEW>

Arguments:

• <REVIEW>

Options:

• --mine
• --open
• --json

limen review certify

Certify an item: the person should keep the role

Usage: limen review certify [OPTIONS] <ITEM>

Arguments:

• <ITEM>

Options:

• -m, --comment <COMMENT> Default: ``.

limen review flag

Flag an item for removal. The role is withheld from them at once

Usage: limen review flag [OPTIONS] --comment <COMMENT> <ITEM>

Arguments:

• <ITEM>

Options:

• -m, --comment <COMMENT>

limen review overrides

Roles withheld by a review

Usage: limen review overrides [OPTIONS]

Options:

• --all
• --json

limen review lift

Give a withheld role back

Usage: limen review lift [OPTIONS] --reason <REASON> <ID>

Arguments:

• <ID>

Options:

• --reason <REASON>

limen audit

Search the audit trail (limen:admin or limen:auditor)

Usage: limen audit [OPTIONS] <COMMAND>

limen audit search

Find audit events and, if the operator indexes them, text from recordings.

Words must all appear. “Quoted phrases” match as written. Filters: user: resource: kind: session: after: before: outcome: Dates are 2026-10-01 or an age such as 24h or 7d. Every search is itself recorded in the audit trail.

Usage: limen audit search [OPTIONS] <QUERY>

Arguments:

• <QUERY>

Options:

• --limit <LIMIT>: The most hits to return (up to 200). Default: 50.
• --json: Output JSON instead of text.

limen policy

Ask a policy questions: test it, who can reach what, what changes

Usage: limen policy [OPTIONS] <COMMAND>

limen policy test

Run the policy_test cases in a policy. Exits non-zero if any fails, for CI

Usage: limen policy test [OPTIONS] <PATHS>...

Arguments:

• <PATHS>: Policy files or directories (roles, mappings, resources, and tests).

Options:

• --coverage: Also list the resources and roles that no case touches.
• --require-cases: Fail if there are no test cases at all.
• --json: Output JSON instead of text.

limen policy who-can

Who can reach a resource: the roles, groups, bots, and requestable roles

Usage: limen policy who-can [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --from <PATH>: Read the policy from these files or directories (offline).
• --active: Ask the running control plane for its active policy (needs limen:admin).
• --json

limen policy what-can

What a group, or a bot, can reach and could ask for

Usage: limen policy what-can [OPTIONS]

Options:

• --group <GROUPS>: IdP groups. Repeat for a person in several.
• --bot <BOT>: A bot instead of groups.
• --from <PATH>: Read the policy from these files or directories (offline).
• --active: Ask the running control plane for its active policy (needs limen:admin).
• --json

limen policy diff

What changes in who can reach what between two policies, not between two YAML files

Usage: limen policy diff [OPTIONS] --new <NEW> [OLD]...

Arguments:

• <OLD>: The old policy: files or directories, or active for the running one.

Options:

• --new <NEW>: The new policy: files or directories (after --new).
• --format <FORMAT>: text, json, or markdown (for a pull request comment). Values: text, json, markdown. Default: text.
• --fail-on-widening: Exit non-zero if anyone gains standing access, so CI can ask for a closer look.

limen connect

Open any resource by name: picks ssh, db connect, redis connect, … from its type

Usage: limen connect [OPTIONS] <RESOURCE> [ARGS]...

Arguments:

• <RESOURCE>
• <ARGS>: Options passed to the command it picks, e.g. --listen 127.0.0.1:6380 or --role readonly.

limen conns

List and stop connections started with --detach

Usage: limen conns [OPTIONS] <COMMAND>

limen conns ls

List detached connections

Usage: limen conns ls [OPTIONS]

Options:

• --json: Output JSON instead of a table.

limen conns stop

End detached connections

Usage: limen conns stop [OPTIONS] [IDS]...

Arguments:

• <IDS>: Connection ids from limen conns ls.

Options:

• --all: End all of them.

limen completions

Print a shell completion script: limen completions zsh > ~/.zfunc/_limen

Usage: limen completions [OPTIONS] <SHELL>

Arguments:

• <SHELL> Values: bash, elvish, fish, powershell, zsh.

limen show

Show one resource: type, labels, how you may access it, and the command to connect

Usage: limen show [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --json: Output JSON instead of text.

limen ssh

Open an SSH session: limen ssh [login@]resource [command...]

Usage: limen ssh [OPTIONS] <TARGET> [COMMAND]...

Arguments:

• <TARGET>
• <COMMAND>

limen config

Print configuration snippets for other tools

Usage: limen config [OPTIONS] <COMMAND>

limen config ssh

An ~/.ssh/config block so ssh <login>@<resource>.limen works directly

Usage: limen config ssh [OPTIONS]

limen db

PostgreSQL, MySQL, Aurora, and Redshift

Usage: limen db [OPTIONS] <COMMAND>

limen db ls

List the postgres/mysql/redshift resources you can access

Usage: limen db ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen db connect

Open a local listener for psql or mysql to connect to without a password

Usage: limen db connect [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --db-role <DB_ROLE>
• --database <DATABASE>
• --listen <ADDR>: Local address to listen on. Defaults to a free port on 127.0.0.1.
• --socket <PATH>: Listen on a Unix socket (mode 0600) instead of TCP.

limen redis

Redis and Valkey: limen redis connect <resource>

Usage: limen redis [OPTIONS] <COMMAND>

limen redis ls

List the redis resources you can access

Usage: limen redis ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen redis connect

Open a local listener that redis-cli (or any Redis or Valkey client) connects to without a password

Usage: limen redis connect [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --user <USER>: The Redis ACL user to act as (Valkey has the same). Optional when policy allows only one.
• --listen <ADDR>: Local address to listen on. Defaults to a free port on 127.0.0.1.
• --socket <PATH>: Listen on a unix socket (mode 0600, in a directory only you can enter) instead of TCP.
• --idle-timeout <DURATION>: Stop after this long with no connection, e.g. 30m. 0 never stops. Default: 1h.

limen kube

Kubernetes and EKS

Usage: limen kube [OPTIONS] <COMMAND>

limen kube ls

List the kubernetes resources you can access

Usage: limen kube ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen kube login

Write a kubeconfig for a cluster; kubectl then asks limen kube credentials

Usage: limen kube login [OPTIONS] <CLUSTER>

Arguments:

• <CLUSTER>

Options:

• --kubeconfig <FILE>: Write the kubeconfig here instead of in the profile directory.
• --print: Print the kubeconfig instead of writing it.

limen kube credentials

The kubectl exec credential plugin: prints your short-lived certificate

Usage: limen kube credentials [OPTIONS]

limen mongo

MongoDB, Atlas, and DocumentDB: limen mongo connect <resource>

Usage: limen mongo [OPTIONS] <COMMAND>

limen mongo ls

List the mongodb resources you can access

Usage: limen mongo ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen mongo connect

Open a local listener that mongosh (or any MongoDB driver) connects to without a password

Usage: limen mongo connect [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --role <ROLE>: The MongoDB role to act as. Optional when policy allows only one.
• --database <DATABASE>: The database to open. Defaults to the resource’s default_database.
• --listen <ADDR>: Local address to listen on. Defaults to a free port on 127.0.0.1.
• --socket <PATH>: Listen on a unix socket (mode 0600, in a directory only you can enter) instead of TCP.
• --idle-timeout <DURATION>: Stop after this long with no connection, e.g. 30m. 0 never stops. Default: 1h.

limen search

OpenSearch and Elasticsearch: limen search connect <resource>

Usage: limen search [OPTIONS] <COMMAND>

limen search ls

List the opensearch/elasticsearch resources you can access

Usage: limen search ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen search connect

Open a local listener that curl and the Elasticsearch and OpenSearch clients use without a credential

Usage: limen search connect [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --role <ROLE>: The engine role to act as. Optional when policy allows only one.
• --listen <ADDR>: Local address to listen on (loopback only). Defaults to a free port on 127.0.0.1.
• --socket <PATH>: Listen on a unix socket (mode 0600, in a directory only you can enter) instead of TCP.
• --idle-timeout <DURATION>: Stop after this long with no connection, e.g. 30m. 0 never stops. Default: 1h.

limen mq

RabbitMQ and Amazon MQ: limen mq connect <resource>

Usage: limen mq [OPTIONS] <COMMAND>

limen mq ls

List the rabbitmq resources you can access

Usage: limen mq ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen mq connect

Open a local listener that AMQP 0-9-1 clients (pika, amqplib, Bunny, …) connect to without a password

Usage: limen mq connect [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --user <USER>: The broker user to act as. Optional when policy allows only one.
• --vhost <VHOST>: The vhost the printed URL names. The client chooses the real one; policy limits it. Default: /.
• --listen <ADDR>: Local address to listen on. Defaults to a free port on 127.0.0.1.
• --idle-timeout <DURATION>: Stop after this long with no connection, e.g. 30m. 0 never stops. Default: 1h.

limen kafka

Kafka and MSK: limen kafka connect <resource>

Usage: limen kafka [OPTIONS] <COMMAND>

limen kafka ls

List the kafka resources you can access

Usage: limen kafka ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen kafka connect

Open local listeners that Kafka clients (kcat, the Java client, librdkafka, …) bootstrap from without a password

Usage: limen kafka connect [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --user <USER>: The broker user to act as. Optional when policy allows only one.
• --listen <ADDR>: Local address of the bootstrap listener. Defaults to a free port on 127.0.0.1.
• --brokers <BROKERS>: Broker slots to open (one local listener per broker of the cluster). Default: 8.
• --idle-timeout <DURATION>: Stop after this long with no connection, e.g. 30m. 0 never stops. Default: 1h.

limen web

Internal web apps behind browser SSO

Usage: limen web [OPTIONS] <COMMAND>

limen web ls

List the web resources you can access

Usage: limen web ls [OPTIONS] [QUERY]

Arguments:

• <QUERY>: Only resources whose name or a label contains this text (case-insensitive).

Options:

• --json: Output JSON instead of a table.
• --watch <SECS>: Redraw the list every SECS seconds (default 2) until interrupted.
• -q, --quiet: Print only the resource names, one per line, for scripts and shell loops.
• --label <KEY=VALUE>: Only resources with this label (key=value). Repeat to require several.

limen web open

Open an internal web app in your browser after single sign-on

Usage: limen web open [OPTIONS] <APP>

Arguments:

• <APP>

Options:

• --no-browser: Print the address instead of opening a browser.

limen tcp

Open a local TCP forward to an authorized resource

Usage: limen tcp [OPTIONS] <RESOURCE>

Arguments:

• <RESOURCE>

Options:

• --listen <ADDR>: Local address to listen on. Defaults to a free port on 127.0.0.1.

limen admin

Administrative commands. These require the limen:admin role

Usage: limen admin [OPTIONS] <COMMAND>

limen admin apply

Validate and apply role, mapping, and resource YAML. Files or directories

Usage: limen admin apply [OPTIONS] <PATHS>...

Arguments:

• <PATHS>

Options:

• --dry-run: Show what would change without applying it.
• --source-ref <SOURCE_REF>: Where the policy came from, recorded in the audit trail (for example a Git SHA).
• --require-tests: Refuse to apply unless the policy’s own policy_test cases pass.
• --source <SOURCE>: The source these files replace. Documents other sources (and Terraform) manage are left alone; naming one is refused. Default: default.

limen admin policy

Show the active policy version

Usage: limen admin policy [OPTIONS]

limen admin token

Join tokens for proxies and workers

Usage: limen admin token [OPTIONS] <COMMAND>

limen admin token create

Create a single-use join token

Usage: limen admin token create [OPTIONS]

Options:

• --kind <KIND>: proxy or worker. Default: worker.
• --label <LABELS>: Labels for the enrolled component, as key=value. Repeatable.
• --ttl <TTL>: How long the token stays valid, for example 15m. Default: 15m.
• --dns-name <DNS_NAMES>: DNS names a proxy may put in its certificate. Repeatable.
• --name <NAME>: Name the enrolled component may have: exact (given to it even if it asks for none), or a pattern with one * matching zero or more of a-z, 0-9 and - (it then picks one with --name), such as ‘prod-a-*’. Names are for display; the ID stays the identity.

limen admin components

List enrolled proxies and workers, with their tunnels

Usage: limen admin components [OPTIONS]

limen admin lock

Refuse a user’s logins and sessions, and end their open sessions

Usage: limen admin lock [OPTIONS] --reason <REASON> <USERNAME>

Arguments:

• <USERNAME>: The user’s name, as in the audit trail.

Options:

• --reason <REASON>: Why. Recorded in the audit trail.

limen admin unlock

Lift a lock. The user can log in again

Usage: limen admin unlock [OPTIONS] <USERNAME>

Arguments:

• <USERNAME>

limen admin locks

List locked users

Usage: limen admin locks [OPTIONS]

limen admin revoke

Stop honouring a proxy’s or worker’s certificate. Its tunnels drop within about 10 seconds

Usage: limen admin revoke [OPTIONS] --reason <REASON> <COMPONENT_ID>

Arguments:

• <COMPONENT_ID>: The component ID, from limen admin components.

Options:

• --reason <REASON>: Why. Recorded in the audit trail.

limen admin review

Access reviews and the roles they withhold (ADR-0029)

Usage: limen admin review [OPTIONS] <COMMAND>

limen admin review start

Start an access review: a snapshot of who holds which role, sent to its owners

Usage: limen admin review start [OPTIONS]

Options:

• --name <NAME>
• --due-days <DUE_DAYS>: Days the reviewers have (default 14). Default: 14.
• --override-days <OVERRIDE_DAYS>: Days a flagged role stays withheld (default 30). Default: 30.

limen admin review ls

Reviews. By default those with items for you

Usage: limen admin review ls [OPTIONS]

Options:

• --all: Every review (limen:admin or limen:auditor).
• --json

limen admin review items

The items of a review: yours, or all of them for admins and auditors

Usage: limen admin review items [OPTIONS] <REVIEW>

Arguments:

• <REVIEW>

Options:

• --mine
• --open
• --json

limen admin review certify

Certify an item: the person should keep the role

Usage: limen admin review certify [OPTIONS] <ITEM>

Arguments:

• <ITEM>

Options:

• -m, --comment <COMMENT> Default: ``.

limen admin review flag

Flag an item for removal. The role is withheld from them at once

Usage: limen admin review flag [OPTIONS] --comment <COMMENT> <ITEM>

Arguments:

• <ITEM>

Options:

• -m, --comment <COMMENT>

limen admin review overrides

Roles withheld by a review

Usage: limen admin review overrides [OPTIONS]

Options:

• --all
• --json

limen admin review lift

Give a withheld role back

Usage: limen admin review lift [OPTIONS] --reason <REASON> <ID>

Arguments:

• <ID>

Options:

• --reason <REASON>

limen admin evidence

A signed pack of compliance evidence for a period

Usage: limen admin evidence [OPTIONS] --from <FROM> --to <TO>

Options:

• --from <FROM>: First day, as 2026-01-01.
• --to <TO>: The day after the last, as 2026-04-01.
• --out <OUT> Default: limen-evidence.json.

limen admin discovery

Resources workers found in a cloud account, waiting for you (ADR-0027)

Usage: limen admin discovery [OPTIONS] <COMMAND>

limen admin discovery status

List discovered resources. Pending ones and pending changes come first

Usage: limen admin discovery status [OPTIONS]

Options:

• --state <STATE>: pending, accepted, rejected, stale, or changed.
• --json

limen admin discovery accept

Make a discovered resource (or its pending change) real

Usage: limen admin discovery accept [OPTIONS] <KEY>

Arguments:

• <KEY>

Options:

• --note <NOTE>

limen admin discovery reject

Turn a discovered resource away

Usage: limen admin discovery reject [OPTIONS] <KEY>

Arguments:

• <KEY>

Options:

• --note <NOTE>

limen admin grants

Active access grants, from approved requests and break-glass

Usage: limen admin grants [OPTIONS]

Options:

• --all: Also grants that ended in the last 30 days.
• --json

limen admin revoke-grant

End an access grant, and the sessions it allowed

Usage: limen admin revoke-grant [OPTIONS] --reason <REASON> <REQUEST_ID>

Arguments:

• <REQUEST_ID>: The request id, from limen admin grants.

Options:

• --reason <REASON>: Why. Recorded in the audit trail.

limen admin kill-session

End one live session

Usage: limen admin kill-session [OPTIONS] --reason <REASON> <SESSION_ID>

Arguments:

• <SESSION_ID>: The session ID, from session.start in the audit trail.

Options:

• --reason <REASON>: Why. Recorded in the audit trail.

limen manage

The management API: read policy documents and write resources, as an admin or as a bot with a policy_writer grant (ADR-0042)

Usage: limen manage [OPTIONS] <COMMAND>

limen manage whoami

What you may read and write: admin, or your writer grant

Usage: limen manage whoami [OPTIONS]

limen manage ls

List documents of one kind (resource, role, resource_profile, …)

Usage: limen manage ls [OPTIONS] <KIND>

Arguments:

• <KIND>

Options:

• --namespace <NAMESPACE>: Only this namespace (a writer’s own is implied).
• --source <SOURCE>: Only documents this source manages.

limen manage get

Show one document, with its owner and etag

Usage: limen manage get [OPTIONS] <KIND> <NAME>

Arguments:

• <KIND>
• <NAME>

limen manage put-resource

Create a resource, or with –etag replace it. A writer completes a profile: –spec holds only the fields the profile lets it set

Usage: limen manage put-resource [OPTIONS] --spec <SPEC> --source <SOURCE> <NAME>

Arguments:

• <NAME>

Options:

• --profile <PROFILE>: The profile it completes. Required for bot writers.
• --spec <SPEC>: The resource spec as JSON, for example ‘{“postgres”:{“endpoint”:“db.internal:5432”}}’.
• --label <LABELS>: key=value. Repeatable.
• --description <DESCRIPTION>
• --source <SOURCE>: Who you write as, such as terraform/payments-prod.
• --namespace <NAMESPACE>: Defaults to a writer’s namespace, or default for admins.
• --etag <ETAG>: Replace the resource with this etag (from limen manage get).
• --dry-run: Check everything and show the impact, but change nothing.
• --request-id <REQUEST_ID>: Makes a retry safe: the same id returns the first result.

limen manage delete-resource

Delete a resource you manage

Usage: limen manage delete-resource [OPTIONS] --source <SOURCE> <NAME>

Arguments:

• <NAME>

Options:

• --source <SOURCE>
• --namespace <NAMESPACE>
• --etag <ETAG>: Required unless –if-exists.
• --if-exists: Succeed when it’s already gone.

limen manage put

Create a document of any kind, or with –etag replace it: a role, role_mapping, policy_test, bot, discovery, resource_profile, or policy_writer. Bot writers write only the kinds their grant names

Usage: limen manage put [OPTIONS] --spec <SPEC> --source <SOURCE> <KIND> <NAME>

Arguments:

• <KIND>
• <NAME>

Options:

• --spec <SPEC>: The spec as JSON (a list for role_mapping), or @file to read it.
• --label <LABELS>: key=value. Repeatable.
• --description <DESCRIPTION>
• --source <SOURCE>
• --namespace <NAMESPACE>
• --etag <ETAG>
• --dry-run
• --reason <REASON>: Why, shown to approvers if the write is held.

limen manage delete

Delete a document of any kind you manage

Usage: limen manage delete [OPTIONS] --source <SOURCE> <KIND> <NAME>

Arguments:

• <KIND>
• <NAME>

Options:

• --source <SOURCE>
• --namespace <NAMESPACE>
• --etag <ETAG>: Required unless –if-exists.
• --if-exists

limen manage changes

Changes held for approval because they widen standing access

Usage: limen manage changes [OPTIONS] <COMMAND>

limen manage changes ls

Held changes, newest first: pending ones unless –state

Usage: limen manage changes ls [OPTIONS]

Options:

• --state <STATE>: pending, applied, rejected, cancelled, expired, or superseded.

limen manage changes show

One change: its writes, the access it gives, and the CI run behind it

Usage: limen manage changes show [OPTIONS] <ID>

Arguments:

• <ID>

limen manage changes approve

Approve a change and apply it. Not its author, nor whoever started its CI run. If the policy moved so that it would give access you didn’t see here, it is superseded instead

Usage: limen manage changes approve [OPTIONS] <ID>

Arguments:

• <ID>

Options:

• --note <NOTE>

limen manage changes reject

Refuse a change

Usage: limen manage changes reject [OPTIONS] --note <NOTE> <ID>

Arguments:

• <ID>

Options:

• --note <NOTE>: Why. Required.

limen manage changes cancel

Withdraw a change you made

Usage: limen manage changes cancel [OPTIONS] <ID>

Arguments:

• <ID>