> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parmanasystems.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Command reference

> Every parmana command, its options, environment variables and examples. Generated from the command table in the CLI source.

This page is generated from the CLI's command table. Do not edit it by hand; run `npm run generate:cli-reference` after changing a command.

## Global options

These work with every command.

| Option | Meaning |
| - | - |
| `--output` `<value>` | Output format: text (default) or json. |
| `--profile` `<value>` | Named API address from the config file. |
| `--api-url` `<value>` | API address; overrides PARMANA\_API\_URL and the profile. |
| `--dry-run` | Print the request without sending it. |
| `--verbose` | Log each request and response code, with secrets removed. |
| `--timeout` `<value>` | Seconds to wait for each request (default 30). |
| `--help` | Show help for this command. |

## Commands

* [`policy status`](#policy-status)
* [`policy propose`](#policy-propose)
* [`approval sign`](#approval-sign)
* [`approval submit`](#approval-submit)
* [`approver list`](#approver-list)
* [`approver propose-add`](#approver-propose-add)
* [`approver propose-revoke`](#approver-propose-revoke)
* [`approver submit`](#approver-submit)
* [`keys generate-api-key`](#keys-generate-api-key)
* [`keys generate-approver-key`](#keys-generate-approver-key)
* [`log verify`](#log-verify)
* [`log export`](#log-export)
* [`log check-db`](#log-check-db)
* [`completion`](#completion)

## `policy status`

List pending policy changes for one policy version.

```bash theme={null}
parmana-ops policy status <name> <version>
```

### Options

This command takes no options of its own.

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops policy status customer-refund 1.3.0
```

## `policy propose`

Propose a policy change. The file must match the name and version.

```bash theme={null}
parmana-ops policy propose <policy.json> --name <name> --version <version> --reason "<why>"
```

### Options

| Option | Meaning |
| - | - |
| `--name` `<value>` | Policy name; must equal the file's policyId. |
| `--version` `<value>` | Policy version; must equal the file's policyVersion. |
| `--reason` `<value>` | Why the change is needed. Required. |

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops policy propose policy.json --name customer-refund --version 1.3.0 --reason "Refuse all refunds" --dry-run
```

## `approval sign`

Sign a step-up envelope on the checker's own machine. Nothing is sent.

```bash theme={null}
parmana-ops approval sign --key-file <private.pem> --key-id <id> --pending <id> --action <approve|reject> [--out <file>]
```

### Options

| Option | Meaning |
| - | - |
| `--key-file` `<value>` | The checker's step-up private key (PEM). Never leaves this machine. |
| `--key-id` `<value>` | The key label the operator registered for the checker. |
| `--pending` `<value>` | The pending change ID. |
| `--action` `<value>` | approve or reject. |
| `--out` `<value>` | Write the envelope to this file instead of stdout. |

### Environment

This command reads no environment variables.

### Example

```bash theme={null}
parmana-ops approval sign --key-file .\checker.step-up.private.pem --key-id mamta-checker --pending <id> --action approve --out envelope.json
```

## `approval submit`

Send a signed envelope with the checker's own token.

```bash theme={null}
parmana-ops approval submit --pending <id> --action <approve|reject> --envelope <file>
```

### Options

| Option | Meaning |
| - | - |
| `--pending` `<value>` | The pending change ID. |
| `--action` `<value>` | approve or reject. |
| `--envelope` `<value>` | The file written by approval sign. |

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops approval submit --pending <id> --action approve --envelope envelope.json --dry-run
```

## `approver list`

List approver-key changes (add or revoke), optionally by status.

```bash theme={null}
parmana-ops approver list [--status <PENDING_APPROVAL|APPROVED|REJECTED>]
```

### Options

| Option | Meaning |
| - | - |
| `--status` `<value>` | Only changes with this status. |

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops approver list --status PENDING_APPROVAL
```

## `approver propose-add`

Propose adding an approver key, granted the listed capabilities.

```bash theme={null}
parmana-ops approver propose-add --approver <id> --key <id> --public-key-file <pem> --capabilities <a,b> --reason <why>
```

### Options

| Option | Meaning |
| - | - |
| `--approver` `<value>` | The approver ID. |
| `--key` `<value>` | The key ID. |
| `--public-key-file` `<value>` | The Ed25519 public key, PEM. |
| `--capabilities` `<value>` | Comma-separated capability names. |
| `--reason` `<value>` | Why the key is being added. |

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops approver propose-add --approver pavan --key pavan-key-1 --public-key-file pavan.public.pem --capabilities razorpay:refund --reason rotation --dry-run
```

## `approver propose-revoke`

Propose revoking an approver key that was added through approver changes.

```bash theme={null}
parmana-ops approver propose-revoke --approver <id> --key <id> --reason <why>
```

### Options

| Option | Meaning |
| - | - |
| `--approver` `<value>` | The approver ID. |
| `--key` `<value>` | The key ID. |
| `--reason` `<value>` | Why the key is being revoked. |

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops approver propose-revoke --approver manager-charak1987 --key manager-charak1987-key-2 --reason rotation --dry-run
```

## `approver submit`

Approve or reject an approver change, with the checker's signed step-up envelope.

```bash theme={null}
parmana-ops approver submit --change <id> --action <approve|reject> --envelope <file> [--reason <why>]
```

### Options

| Option | Meaning |
| - | - |
| `--change` `<value>` | The approver change ID. |
| `--action` `<value>` | approve or reject. |
| `--envelope` `<value>` | The file written by approval sign. |
| `--reason` `<value>` | Required with reject: why it is rejected. |

### Environment

* `PARMANA_TOKEN`
* `PARMANA_API_URL`
* `PARMANA_PROFILE`
* `PARMANA_CONFIG`

### Example

```bash theme={null}
parmana-ops approver submit --change <id> --action approve --envelope step.json --dry-run
```

## `keys generate-api-key`

Generate a caller API key on this machine: the raw key, its PARMANA\_API\_KEYS entry, and optionally a step-up key pair. Writes owner-only files; prints no secret.

```bash theme={null}
parmana-ops keys generate-api-key --caller-id <id> --out-dir <dir> [--allowed-capabilities <a,b>] [--allowed-principal-ids <a,b>] [--credential-holder-type <type>] [--generate-step-up-key]
```

### Options

| Option | Meaning |
| - | - |
| `--caller-id` `<value>` | The caller ID, for example pavancharak. |
| `--out-dir` `<value>` | Folder for the generated files. |
| `--allowed-capabilities` `<value>` | Comma-separated capabilities this key may request. |
| `--allowed-principal-ids` `<value>` | Comma-separated principal IDs this key may assert. |
| `--credential-holder-type` `<value>` | Who holds the credential, for example USER for a person. |
| `--generate-step-up-key` | Also create a step-up key pair. Requires --credential-holder-type USER. |

### Environment

This command reads no environment variables.

### Example

```bash theme={null}
parmana-ops keys generate-api-key --caller-id mamta-checker --out-dir ~/parmana-keys --credential-holder-type USER --generate-step-up-key
```

## `keys generate-approver-key`

Generate an approver Ed25519 key pair. The private key stays with the approver; send the public key to the operator.

```bash theme={null}
parmana-ops keys generate-approver-key --approver-id <id> --key-id <id> --out-dir <dir>
```

### Options

| Option | Meaning |
| - | - |
| `--approver-id` `<value>` | The approver ID, for example mamta-checker. |
| `--key-id` `<value>` | The key ID, for example mamta-checker-key-1. |
| `--out-dir` `<value>` | Folder for the generated files. |

### Environment

This command reads no environment variables.

### Example

```bash theme={null}
parmana-ops keys generate-approver-key --approver-id mamta-checker --key-id mamta-checker-key-1 --out-dir ~/parmana-approver
```

## `log verify`

Check the approval log's chain, signatures and policy coverage. Offline.

```bash theme={null}
parmana-ops log verify [--policy <name>] [--base <ref>] [--require-coverage]
```

### Options

| Option | Meaning |
| - | - |
| `--policy` `<value>` | Check only this policy. |
| `--base` `<value>` | Git ref; check that the log only grew since it. |
| `--require-coverage` | Fail if a policy file has no logged approval. |

### Environment

This command reads no environment variables.

### Example

```bash theme={null}
parmana-ops log verify --require-coverage
```

## `log export`

Append approvals from the database that the log does not hold yet.

```bash theme={null}
parmana-ops log export [--policy <name>]
```

### Options

| Option | Meaning |
| - | - |
| `--policy` `<value>` | Export only this policy. |

### Environment

* `CI_DATABASE_URL`

### Example

```bash theme={null}
parmana-ops log export --policy customer-refund
```

## `log check-db`

Compare the log with the database without writing.

```bash theme={null}
parmana-ops log check-db [--policy <name>]
```

### Options

| Option | Meaning |
| - | - |
| `--policy` `<value>` | Check only this policy. |

### Environment

* `CI_DATABASE_URL`

### Example

```bash theme={null}
parmana-ops log check-db
```

## `completion`

Print a shell completion script.

```bash theme={null}
parmana-ops completion <bash|powershell>
```

### Options

This command takes no options of its own.

### Environment

This command reads no environment variables.

### Example

```bash theme={null}
parmana-ops completion powershell | Out-String | Invoke-Expression
```

## Exit codes

| Code | Meaning |
| - | - |
| 0 | Success. |
| 1 | The server, the network or a script reported a failure. |
| 2 | A usage error: a missing or unknown option, a bad value, or a file that does not match. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.