Command reference

This page is generated from the CLI’s command table. Do not edit it by hand; run npm run generate:cli-reference after changing a command.

Global options

These work with every command.

Option	Meaning
`--output` `<value>`	Output format: text (default) or json.
`--profile` `<value>`	Named API address from the config file.
`--api-url` `<value>`	API address; overrides PARMANA_API_URL and the profile.
`--dry-run`	Print the request without sending it.
`--verbose`	Log each request and response code, with secrets removed.
`--timeout` `<value>`	Seconds to wait for each request (default 30).
`--help`	Show help for this command.

`policy status`

List pending policy changes for one policy version.

parmana-ops policy status <name> <version>

Options

This command takes no options of its own.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops policy status customer-refund 1.3.0

`policy propose`

Propose a policy change. The file must match the name and version.

parmana-ops policy propose <policy.json> --name <name> --version <version> --reason "<why>"

Options

Option	Meaning
`--name` `<value>`	Policy name; must equal the file’s policyId.
`--version` `<value>`	Policy version; must equal the file’s policyVersion.
`--reason` `<value>`	Why the change is needed. Required.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops policy propose policy.json --name customer-refund --version 1.3.0 --reason "Refuse all refunds" --dry-run

`approval sign`

Sign a step-up envelope on the checker’s own machine. Nothing is sent.

parmana-ops approval sign --key-file <private.pem> --key-id <id> --pending <id> --action <approve|reject> [--out <file>]

Options

Option	Meaning
`--key-file` `<value>`	The checker’s step-up private key (PEM). Never leaves this machine.
`--key-id` `<value>`	The key label the operator registered for the checker.
`--pending` `<value>`	The pending change ID.
`--action` `<value>`	approve or reject.
`--out` `<value>`	Write the envelope to this file instead of stdout.

Environment

This command reads no environment variables.

Example

parmana-ops approval sign --key-file .\checker.step-up.private.pem --key-id mamta-checker --pending <id> --action approve --out envelope.json

`approval submit`

Send a signed envelope with the checker’s own token.

parmana-ops approval submit --pending <id> --action <approve|reject> --envelope <file>

Options

Option	Meaning
`--pending` `<value>`	The pending change ID.
`--action` `<value>`	approve or reject.
`--envelope` `<value>`	The file written by approval sign.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops approval submit --pending <id> --action approve --envelope envelope.json --dry-run

`approver list`

List approver-key changes (add or revoke), optionally by status.

parmana-ops approver list [--status <PENDING_APPROVAL|APPROVED|REJECTED>]

Options

Option	Meaning
`--status` `<value>`	Only changes with this status.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops approver list --status PENDING_APPROVAL

`approver propose-add`

Propose adding an approver key, granted the listed capabilities.

parmana-ops approver propose-add --approver <id> --key <id> --public-key-file <pem> --capabilities <a,b> --reason <why>

Options

Option	Meaning
`--approver` `<value>`	The approver ID.
`--key` `<value>`	The key ID.
`--public-key-file` `<value>`	The Ed25519 public key, PEM.
`--capabilities` `<value>`	Comma-separated capability names.
`--reason` `<value>`	Why the key is being added.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops approver propose-add --approver pavan --key pavan-key-1 --public-key-file pavan.public.pem --capabilities razorpay:refund --reason rotation --dry-run

`approver propose-revoke`

Propose revoking an approver key that was added through approver changes.

parmana-ops approver propose-revoke --approver <id> --key <id> --reason <why>

Options

Option	Meaning
`--approver` `<value>`	The approver ID.
`--key` `<value>`	The key ID.
`--reason` `<value>`	Why the key is being revoked.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops approver propose-revoke --approver manager-charak1987 --key manager-charak1987-key-2 --reason rotation --dry-run

`approver submit`

Approve or reject an approver change, with the checker’s signed step-up envelope.

parmana-ops approver submit --change <id> --action <approve|reject> --envelope <file> [--reason <why>]

Options

Option	Meaning
`--change` `<value>`	The approver change ID.
`--action` `<value>`	approve or reject.
`--envelope` `<value>`	The file written by approval sign.
`--reason` `<value>`	Required with reject: why it is rejected.

Environment

PARMANA_TOKEN
PARMANA_API_URL
PARMANA_PROFILE
PARMANA_CONFIG

Example

parmana-ops approver submit --change <id> --action approve --envelope step.json --dry-run

`keys generate-api-key`

Generate a caller API key on this machine: the raw key, its PARMANA_API_KEYS entry, and optionally a step-up key pair. Writes owner-only files; prints no secret.

parmana-ops keys generate-api-key --caller-id <id> --out-dir <dir> [--allowed-capabilities <a,b>] [--allowed-principal-ids <a,b>] [--credential-holder-type <type>] [--generate-step-up-key]

Options

Option	Meaning
`--caller-id` `<value>`	The caller ID, for example pavancharak.
`--out-dir` `<value>`	Folder for the generated files.
`--allowed-capabilities` `<value>`	Comma-separated capabilities this key may request.
`--allowed-principal-ids` `<value>`	Comma-separated principal IDs this key may assert.
`--credential-holder-type` `<value>`	Who holds the credential, for example USER for a person.
`--generate-step-up-key`	Also create a step-up key pair. Requires —credential-holder-type USER.

Environment

This command reads no environment variables.

Example

parmana-ops keys generate-api-key --caller-id mamta-checker --out-dir ~/parmana-keys --credential-holder-type USER --generate-step-up-key

`keys generate-approver-key`

Generate an approver Ed25519 key pair. The private key stays with the approver; send the public key to the operator.

parmana-ops keys generate-approver-key --approver-id <id> --key-id <id> --out-dir <dir>

Options

Option	Meaning
`--approver-id` `<value>`	The approver ID, for example mamta-checker.
`--key-id` `<value>`	The key ID, for example mamta-checker-key-1.
`--out-dir` `<value>`	Folder for the generated files.

Environment

This command reads no environment variables.

Example

parmana-ops keys generate-approver-key --approver-id mamta-checker --key-id mamta-checker-key-1 --out-dir ~/parmana-approver

`log verify`

Check the approval log’s chain, signatures and policy coverage. Offline.

parmana-ops log verify [--policy <name>] [--base <ref>] [--require-coverage]

Options

Option	Meaning
`--policy` `<value>`	Check only this policy.
`--base` `<value>`	Git ref; check that the log only grew since it.
`--require-coverage`	Fail if a policy file has no logged approval.

Environment

This command reads no environment variables.

Example

parmana-ops log verify --require-coverage

`log export`

Append approvals from the database that the log does not hold yet.

parmana-ops log export [--policy <name>]

Options

Option	Meaning
`--policy` `<value>`	Export only this policy.

Environment

CI_DATABASE_URL

Example

parmana-ops log export --policy customer-refund

`log check-db`

Compare the log with the database without writing.

parmana-ops log check-db [--policy <name>]

Options

Option	Meaning
`--policy` `<value>`	Check only this policy.

Environment

CI_DATABASE_URL

Example

parmana-ops log check-db

`completion`

Print a shell completion script.

parmana-ops completion <bash|powershell>

Options

This command takes no options of its own.

Environment

This command reads no environment variables.

Example

parmana-ops completion powershell | Out-String | Invoke-Expression

Exit codes

Code	Meaning
0	Success.
1	The server, the network or a script reported a failure.
2	A usage error: a missing or unknown option, a bad value, or a file that does not match.

​Global options

​Commands

​policy status

​Options

​Environment

​Example

​policy propose

​Options

​Environment

​Example

​approval sign

​Options

​Environment

​Example

​approval submit

​Options

​Environment

​Example

​approver list

​Options

​Environment

​Example

​approver propose-add

​Options

​Environment

​Example

​approver propose-revoke

​Options

​Environment

​Example

​approver submit

​Options

​Environment

​Example

​keys generate-api-key

​Options

​Environment

​Example

​keys generate-approver-key

​Options

​Environment

​Example

​log verify

​Options

​Environment

​Example

​log export

​Options

​Environment

​Example

​log check-db

​Options

​Environment

​Example

​completion

​Options

​Environment

​Example

​Exit codes

Global options

Commands

`policy status`

Options

Environment

Example

`policy propose`

Options

Environment

Example

`approval sign`

Options

Environment

Example

`approval submit`

Options

Environment

Example

`approver list`

Options

Environment

Example

`approver propose-add`

Options

Environment

Example

`approver propose-revoke`

Options

Environment

Example

`approver submit`

Options

Environment

Example

`keys generate-api-key`

Options

Environment

Example

`keys generate-approver-key`

Options

Environment

Example

`log verify`

Options

Environment

Example

`log export`

Options

Environment

Example

`log check-db`

Options

Environment

Example

`completion`

Options

Environment

Example

Exit codes