airs gateway
Manage and observe Prisma AIRS AI Gateway resources
Usage: airs gateway [OPTIONS] [COMMAND]
Commands:
admin-guardrails Manage organisation guardrails on the admin plane (mutations specification-tested)
api-keys Manage service and user gateway credentials
audit-logs Inspect organisation audit activity
configs Manage routing configurations
deployments Manage self-hosted gateway registrations
guardrails Manage workspace guardrails
inference Call the gateway runtime (separate API key; no SCM OAuth required)
integrations Manage organisation provider integrations
mcp Manage MCP integrations and servers
organisations Manage organisation and authentication settings
plugins Manage gateway plugins
providers Manage workspace provider bindings
report Generate an AI Gateway environment report (read-only) [aliases: dashboard]
scopes Manage SCM IAM scopes — the objects a workspace scope_name points at (/iam/v1)
telemetry AI Gateway runtime telemetry (data plane)
workspaces Manage gateway workspaces [aliases: workspace]
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails
Manage organisation guardrails on the admin plane (mutations specification-tested)
Usage: airs gateway admin-guardrails [OPTIONS] [COMMAND]
Commands:
create Create an admin guardrail (specification-tested; no workspace fallback)
delete Permanently delete an admin guardrail [aliases: rm]
get Read an admin guardrail by UUID
list List organisation guardrails; optional workspace filtering may be denied by policy [aliases: ls]
mcp-servers Manage admin guardrail MCP mappings; does not sign in to MCP
update Update an admin guardrail (specification-tested)
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails create
Create an admin guardrail (specification-tested; no workspace fallback)
Usage: airs gateway admin-guardrails create [OPTIONS]
Options:
--actions <json> Actions object
--output <format> Output format: pretty, table, json
--checks <json> Checks array
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--name <name> Guardrail name
--organisation <uuid> Optional organisation UUID, not the numeric TSG
--tenant <name> Use this registered tenant for one invocation without changing the selection
--target <target> llm or mcp_tools
--workspace <uuid> Optional workspace UUID
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway admin-guardrails delete
Permanently delete an admin guardrail
Usage: airs gateway admin-guardrails delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails get
Read an admin guardrail by UUID
Usage: airs gateway admin-guardrails get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails list
List organisation guardrails; optional workspace filtering may be denied by policy
Usage: airs gateway admin-guardrails list [OPTIONS]
Options:
--current-page <number> Zero-based page number
--output <format> Output format: pretty, table, json
--page-size <number> Page size, 1–1000
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--workspace <uuid> Optional workspace UUID filter
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails mcp-servers
Manage admin guardrail MCP mappings; does not sign in to MCP
Usage: airs gateway admin-guardrails mcp-servers [OPTIONS] [COMMAND]
Commands:
list List MCP mappings [aliases: ls]
sync Replace all mappings (specification-tested)
upsert Set one mapping (specification-tested)
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails mcp-servers list
List MCP mappings
Usage: airs gateway admin-guardrails mcp-servers list [OPTIONS] <guardrail-id>
Arguments:
<guardrail-id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails mcp-servers sync
Replace all mappings (specification-tested)
Usage: airs gateway admin-guardrails mcp-servers sync [OPTIONS] <guardrail-id>
Arguments:
<guardrail-id>
Options:
--force Skip replacement confirmation
--output <format> Output format: pretty, table, json
--file <path> Advanced JSON request base; named flags override it
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails mcp-servers upsert
Set one mapping (specification-tested)
Usage: airs gateway admin-guardrails mcp-servers upsert [OPTIONS] <guardrail-id> <server-id>
Arguments:
<guardrail-id>
<server-id>
Options:
--file <path> Advanced JSON request base; named flags override it
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--set <path=value> Set a typed JSON value at a request path (repeatable)
--debug Write redacted API diagnostics to a private JSONL file
--set-string <path=value> Set a literal string at a request path (repeatable)
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway admin-guardrails update
Update an admin guardrail (specification-tested)
Usage: airs gateway admin-guardrails update [OPTIONS] <id>
Arguments:
<id>
Options:
--actions <json> Actions object
--output <format> Output format: pretty, table, json
--checks <json> Checks array
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--name <name> Guardrail name
--file <path> Advanced JSON request base; named flags override it
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway api-keys
Manage service and user gateway credentials
Usage: airs gateway api-keys [OPTIONS] [COMMAND]
Commands:
service Manage service API keys
user Manage user API keys
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys service
Manage service API keys
Usage: airs gateway api-keys service [OPTIONS] [COMMAND]
Commands:
create Create a service API key from structured flags
delete Revoke a service API key [aliases: rm]
get Get one service API key
list List service API keys in a workspace (data plane) [aliases: ls]
rotate Rotate a service API key
update Update a service API key with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys service create
Create a service API key from structured flags
Usage: airs gateway api-keys service create [OPTIONS]
Options:
--alert-emails <emails> Comma-separated alert email addresses
--output <format> Output format: pretty, table, json
--description <text> Credential description
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--expires-at <iso> Expiration as ISO-8601
--name <name> Credential name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--scopes <scopes> Comma-separated scopes (known: agents.invoke, completions.write, logs.write, mcp.invoke, prompts.render)
--secret-output <path> New private file (mode 0600) that receives the one-time credential; never overwritten (the credential is never printed)
--type <type> Credential type
--workspace <uuid> Workspace UUID
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway api-keys service delete
Revoke a service API key
Usage: airs gateway api-keys service delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys service get
Get one service API key
Usage: airs gateway api-keys service get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys service list
List service API keys in a workspace (data plane)
Usage: airs gateway api-keys service list [OPTIONS] --workspace <uuid>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--workspace <uuid> Workspace UUID
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys service rotate
Rotate a service API key
Usage: airs gateway api-keys service rotate [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--secret-output <path> New private file (mode 0600) that receives the one-time credential; never overwritten (the credential is never printed)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
--transition-ms <ms> Credential overlap in milliseconds
-h, --help Print help
airs gateway api-keys service update
Update a service API key with structured flags
Usage: airs gateway api-keys service update [OPTIONS] <id>
Arguments:
<id>
Options:
--alert-emails <emails> Comma-separated alert email addresses
--output <format> Output format: pretty, table, json
--description <text> Credential description
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--expires-at <iso> Expiration as ISO-8601
--force Skip the confirmation prompt
--tenant <name> Use this registered tenant for one invocation without changing the selection
--name <name> Credential name
--reset-usage <boolean> Reset accumulated usage: true or false
--scopes <scopes> Comma-separated scopes (known: agents.invoke, completions.write, logs.write, mcp.invoke, prompts.render)
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway api-keys user
Manage user API keys
Usage: airs gateway api-keys user [OPTIONS] [COMMAND]
Commands:
create Create a user API key from structured flags
delete Revoke a user API key [aliases: rm]
get Get one user API key
list List user API keys in a workspace (data plane) [aliases: ls]
rotate Rotate a user API key
update Update a user API key with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys user create
Create a user API key from structured flags
Usage: airs gateway api-keys user create [OPTIONS]
Options:
--alert-emails <emails> Comma-separated alert email addresses
--output <format> Output format: pretty, table, json
--description <text> Credential description
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--expires-at <iso> Expiration as ISO-8601
--name <name> Credential name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--scopes <scopes> Comma-separated scopes (known: agents.invoke, completions.write, logs.write, mcp.invoke, prompts.render)
--secret-output <path> New private file (mode 0600) that receives the one-time credential; never overwritten (the credential is never printed)
--type <type> Credential type
--workspace <uuid> Workspace UUID
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
--user-id <uuid> User UUID
-h, --help Print help
airs gateway api-keys user delete
Revoke a user API key
Usage: airs gateway api-keys user delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys user get
Get one user API key
Usage: airs gateway api-keys user get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys user list
List user API keys in a workspace (data plane)
Usage: airs gateway api-keys user list [OPTIONS] --workspace <uuid>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--workspace <uuid> Workspace UUID
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway api-keys user rotate
Rotate a user API key
Usage: airs gateway api-keys user rotate [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--secret-output <path> New private file (mode 0600) that receives the one-time credential; never overwritten (the credential is never printed)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
--transition-ms <ms> Credential overlap in milliseconds
-h, --help Print help
airs gateway api-keys user update
Update a user API key with structured flags
Usage: airs gateway api-keys user update [OPTIONS] <id>
Arguments:
<id>
Options:
--alert-emails <emails> Comma-separated alert email addresses
--output <format> Output format: pretty, table, json
--description <text> Credential description
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--expires-at <iso> Expiration as ISO-8601
--force Skip the confirmation prompt
--tenant <name> Use this registered tenant for one invocation without changing the selection
--name <name> Credential name
--reset-usage <boolean> Reset accumulated usage: true or false
--scopes <scopes> Comma-separated scopes (known: agents.invoke, completions.write, logs.write, mcp.invoke, prompts.render)
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway audit-logs
Inspect organisation audit activity
Usage: airs gateway audit-logs [OPTIONS] [COMMAND]
Commands:
list List audit activity for a UTC time window (admin plane) [aliases: ls]
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway audit-logs list
List audit activity for a UTC time window (admin plane)
Usage: airs gateway audit-logs list [OPTIONS]
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--reveal-sensitive Show request fields; credentials inside them stay withheld
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway configs
Manage routing configurations
Usage: airs gateway configs [OPTIONS] [COMMAND]
Commands:
create Create a config from structured flags
delete Permanently delete this resource [aliases: rm]
get Get one config by UUID (data plane)
list List configs in a workspace (data plane) [aliases: ls]
update Update a config with structured flags
versions List immutable config versions
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway configs create
Create a config from structured flags
Usage: airs gateway configs create [OPTIONS]
Options:
--name <name> Config name
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--workspace <uuid> Workspace UUID
--debug Write redacted API diagnostics to a private JSONL file
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway configs delete
Permanently delete this resource
Usage: airs gateway configs delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway configs get
Get one config by UUID (data plane)
Usage: airs gateway configs get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway configs list
List configs in a workspace (data plane)
Usage: airs gateway configs list [OPTIONS] --workspace <uuid>
Options:
--output <format> Output format: pretty, table, json
--workspace <uuid> Workspace UUID
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway configs update
Update a config with structured flags
Usage: airs gateway configs update [OPTIONS] <id>
Arguments:
<id>
Options:
--name <name> New config name
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--status <status> New config status
--debug Write redacted API diagnostics to a private JSONL file
--workspace <uuid> New workspace UUID
--file <path> Advanced JSON request base; named flags override it
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway configs versions
List immutable config versions
Usage: airs gateway configs versions [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway deployments
Manage self-hosted gateway registrations
Usage: airs gateway deployments [OPTIONS] [COMMAND]
Commands:
archive Archive a deployment registration
create Register a self-hosted deployment from structured flags
get Get a deployment by UUID (admin plane)
list List deployments (admin plane) [aliases: ls]
ping Run the optional control-plane ingress diagnostic
update Update a deployment registration with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway deployments archive
Archive a deployment registration
Usage: airs gateway deployments archive [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway deployments create
Register a self-hosted deployment from structured flags
Usage: airs gateway deployments create [OPTIONS]
Options:
--auth-settings <json> Deployment authentication settings object
--output <format> Output format: pretty, table, json
--deployment-config <json> Deployment configuration object
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--is-default <boolean> Make this the default deployment
--name <name> Deployment name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--secret-output <path> New private file (mode 0600) that receives the one-time credential; never overwritten (the credential is never printed)
--slug <slug> Stable deployment slug
--type <type> Deployment type: non_production, production
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway deployments get
Get a deployment by UUID (admin plane)
Usage: airs gateway deployments get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway deployments list
List deployments (admin plane)
Usage: airs gateway deployments list [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway deployments ping
Run the optional control-plane ingress diagnostic
Usage: airs gateway deployments ping [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway deployments update
Update a deployment registration with structured flags
Usage: airs gateway deployments update [OPTIONS] <id>
Arguments:
<id>
Options:
--auth-settings <json> Deployment authentication settings object
--output <format> Output format: pretty, table, json
--deployment-config <json> Deployment configuration object
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--force Skip the confirmation prompt
--is-default <boolean> Make this the default deployment
--tenant <name> Use this registered tenant for one invocation without changing the selection
--name <name> Deployment name
--override-existing <boolean> Override an existing registration
--rotate-auth <boolean> Rotate deployment authentication
--secret-output <path> New private file (mode 0600) that receives the one-time credential; never overwritten (the credential is never printed)
--status <status> Deployment status: active, archived
--type <type> Deployment type: non_production, production
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway guardrails
Manage workspace guardrails
Usage: airs gateway guardrails [OPTIONS] [COMMAND]
Commands:
catalog Get available guardrail evaluator schemas (not enabled policies)
create Create a guardrail from structured flags
delete Permanently delete this resource [aliases: rm]
get Get one guardrail by UUID (data plane)
list List guardrails in a workspace (data plane) [aliases: ls]
update Update a guardrail with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway guardrails catalog
Get available guardrail evaluator schemas (not enabled policies)
Usage: airs gateway guardrails catalog [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway guardrails create
Create a guardrail from structured flags
Usage: airs gateway guardrails create [OPTIONS]
Options:
--actions <json> Guardrail actions object
--output <format> Output format: pretty, table, json
--checks <json> Guardrail checks array
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--name <name> Guardrail name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <uuid> Workspace UUID
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway guardrails delete
Permanently delete this resource
Usage: airs gateway guardrails delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway guardrails get
Get one guardrail by UUID (data plane)
Usage: airs gateway guardrails get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway guardrails list
List guardrails in a workspace (data plane)
Usage: airs gateway guardrails list [OPTIONS] --workspace <uuid>
Options:
--output <format> Output format: pretty, table, json
--workspace <uuid> Workspace UUID
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway guardrails update
Update a guardrail with structured flags
Usage: airs gateway guardrails update [OPTIONS] <id>
Arguments:
<id>
Options:
--actions <json> Guardrail actions object
--output <format> Output format: pretty, table, json
--checks <json> Guardrail checks array
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--name <name> Guardrail name
--file <path> Advanced JSON request base; named flags override it
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway inference
Call the gateway runtime (separate API key; no SCM OAuth required)
Usage: airs gateway inference [OPTIONS] [COMMAND]
Commands:
chat Generate a model response through your runtime gateway
embeddings Create embeddings through your runtime gateway
responses Generate a model response through your runtime gateway
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway inference chat
Generate a model response through your runtime gateway
Usage: airs gateway inference chat [OPTIONS] [prompt]
Arguments:
[prompt]
Options:
--endpoint <url> Runtime base URL including /v1; overrides config
--output <format> Output format: pretty, table, json; streaming json emits one event per line (JSONL)
--file <path> JSON request file (mutually exclusive with prompt)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--model <id> Provider-prefixed model ID; overrides request file and config
--tenant <name> Use this registered tenant for one invocation without changing the selection
--timeout <ms> Total deadline including streaming, in milliseconds (default: "60000")
--max-tokens <n> Maximum completion/output tokens
--stream Stream text (pretty) or validated events (json/JSONL)
-h, --help Print help
airs gateway inference embeddings
Create embeddings through your runtime gateway
Usage: airs gateway inference embeddings [OPTIONS] [prompt]
Arguments:
[prompt]
Options:
--endpoint <url> Runtime base URL including /v1; overrides config
--output <format> Output format: pretty, table, json; streaming json emits one event per line (JSONL)
--file <path> JSON request file (mutually exclusive with prompt)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--model <id> Provider-prefixed model ID; overrides request file and config
--tenant <name> Use this registered tenant for one invocation without changing the selection
--timeout <ms> Total deadline including streaming, in milliseconds (default: "60000")
--dimensions <n> Embedding dimensions
--encoding <format> float or base64
-h, --help Print help
airs gateway inference responses
Generate a model response through your runtime gateway
Usage: airs gateway inference responses [OPTIONS] [prompt]
Arguments:
[prompt]
Options:
--endpoint <url> Runtime base URL including /v1; overrides config
--output <format> Output format: pretty, table, json; streaming json emits one event per line (JSONL)
--file <path> JSON request file (mutually exclusive with prompt)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--model <id> Provider-prefixed model ID; overrides request file and config
--tenant <name> Use this registered tenant for one invocation without changing the selection
--timeout <ms> Total deadline including streaming, in milliseconds (default: "60000")
--max-tokens <n> Maximum completion/output tokens
--stream Stream text (pretty) or validated events (json/JSONL)
-h, --help Print help
airs gateway integrations
Manage organisation provider integrations
Usage: airs gateway integrations [OPTIONS] [COMMAND]
Commands:
create Create an integration from structured flags
delete Permanently delete this integration [aliases: rm]
get Get a provider integration by UUID
list List provider integrations (admin plane) [aliases: ls]
models Inspect or replace model bindings
providers List the provider catalog: the slug or UUID that --ai-provider accepts
update Update an integration with structured flags
workspaces Inspect or replace workspace bindings
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations create
Create an integration from structured flags
Usage: airs gateway integrations create [OPTIONS]
Options:
--ai-provider <slug-or-uuid> Provider catalog slug (see 'integrations providers') or UUID
--output <format> Output format: pretty, table, json
--ai-provider-id <uuid> Provider catalog UUID
--quiet Suppress status and decorative output (data and errors still print)
--base-url <url> Self-hosted or OpenAI-compatible endpoint (configurations.custom_host)
--debug Write redacted API diagnostics to a private JSONL file
--configurations <json> Provider configuration object
--tenant <name> Use this registered tenant for one invocation without changing the selection
--description <text> Integration description
--header <name=value> Extra header sent to the custom host (repeatable)
--key <credential> Inline provider credential (visible in shell history)
--key-file <path> Read the provider credential from a file
--key-stdin Read the provider credential from piped stdin
--name <name> Integration name
--secret-mappings <json> Secret reference mapping array
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--slug <slug> Stable integration slug
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway integrations delete
Permanently delete this integration
Usage: airs gateway integrations delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations get
Get a provider integration by UUID
Usage: airs gateway integrations get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations list
List provider integrations (admin plane)
Usage: airs gateway integrations list [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations models
Inspect or replace model bindings
Usage: airs gateway integrations models [OPTIONS] [COMMAND]
Commands:
list List models for an integration [aliases: ls]
set Replace model bindings
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations models list
List models for an integration
Usage: airs gateway integrations models list [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations models set
Replace model bindings
Usage: airs gateway integrations models set [OPTIONS] <id>
Arguments:
<id>
Options:
--allow-all-models <boolean> Allow every model: true or false
--output <format> Output format: pretty, table, json
--force Skip confirmation prompt
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--model <slug=enabled> Model binding (repeatable)
--file <path> Advanced JSON request base; named flags override it
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway integrations providers
List the provider catalog: the slug or UUID that --ai-provider accepts
Usage: airs gateway integrations providers [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations update
Update an integration with structured flags
Usage: airs gateway integrations update [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip the confirmation prompt
--output <format> Output format: pretty, table, json
--base-url <url> Self-hosted or OpenAI-compatible endpoint (configurations.custom_host)
--quiet Suppress status and decorative output (data and errors still print)
--configurations <json> Provider configuration object
--debug Write redacted API diagnostics to a private JSONL file
--description <text> Integration description
--tenant <name> Use this registered tenant for one invocation without changing the selection
--header <name=value> Extra header sent to the custom host (repeatable)
--key <credential> Inline provider credential (visible in shell history)
--key-file <path> Read the provider credential from a file
--key-stdin Read the provider credential from piped stdin
--name <name> Integration name
--secret-mappings <json> Secret reference mapping array
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway integrations workspaces
Inspect or replace workspace bindings
Usage: airs gateway integrations workspaces [OPTIONS] [COMMAND]
Commands:
list List workspace bindings [aliases: ls]
set Replace workspace bindings
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations workspaces list
List workspace bindings
Usage: airs gateway integrations workspaces list [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway integrations workspaces set
Replace workspace bindings
Usage: airs gateway integrations workspaces set [OPTIONS] <id>
Arguments:
<id>
Options:
--create-default-provider <boolean>
Create defaults for new bindings
--output <format>
Output format: pretty, table, json
--default-provider-slug <slug>
Default provider slug
--quiet
Suppress status and decorative output (data and errors still print)
--debug
Write redacted API diagnostics to a private JSONL file
--force
Skip confirmation prompt
--global-access <boolean>
Enable or disable access to every workspace
--tenant <name>
Use this registered tenant for one invocation without changing the selection
--preserve-existing
Preserve bindings not named by this command
--workspace-binding <id=enabled>
Workspace binding (repeatable)
--file <path>
Advanced JSON request base; named flags override it
--set <path=value>
Set a typed JSON value at a request path (repeatable)
--set-string <path=value>
Set a literal string at a request path (repeatable)
-h, --help
Print help
airs gateway mcp
Manage MCP integrations and servers
Usage: airs gateway mcp [OPTIONS] [COMMAND]
Commands:
integrations Manage MCP server integrations
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations
Manage MCP server integrations
Usage: airs gateway mcp integrations [OPTIONS] [COMMAND]
Commands:
capabilities Inspect or replace MCP capabilities
create Create a MCP integration from structured flags
delete Permanently delete this resource [aliases: rm]
get Get an MCP integration by UUID
list List MCP integrations (admin plane) [aliases: ls]
metadata Get discovered MCP metadata
update Update a MCP integration with structured flags
workspaces Inspect or replace MCP workspace access
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations capabilities
Inspect or replace MCP capabilities
Usage: airs gateway mcp integrations capabilities [OPTIONS] [COMMAND]
Commands:
list List discovered MCP capabilities [aliases: ls]
set Replace enabled MCP capabilities
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations capabilities list
List discovered MCP capabilities
Usage: airs gateway mcp integrations capabilities list [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations capabilities set
Replace enabled MCP capabilities
Usage: airs gateway mcp integrations capabilities set [OPTIONS] <id>
Arguments:
<id>
Options:
--capability <type:name=enabled> Capability binding (repeatable; type: prompt, resource, tool)
--output <format> Output format: pretty, table, json
--force Skip confirmation prompt
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway mcp integrations create
Create a MCP integration from structured flags
Usage: airs gateway mcp integrations create [OPTIONS]
Options:
--auth-type <type> Authentication type (known: headers, none, oauth_auto, oauth_client_credentials)
--output <format> Output format: pretty, table, json
--configurations <json> MCP authentication/configuration object
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--description <text> Integration description
--name <name> Integration name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--secret-mappings <json> Secret reference mapping array
--slug <slug> Stable integration slug
--transport <transport> Transport (known: http, interactive, sse)
--url <url> MCP server URL
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway mcp integrations delete
Permanently delete this resource
Usage: airs gateway mcp integrations delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations get
Get an MCP integration by UUID
Usage: airs gateway mcp integrations get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations list
List MCP integrations (admin plane)
Usage: airs gateway mcp integrations list [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations metadata
Get discovered MCP metadata
Usage: airs gateway mcp integrations metadata [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations update
Update a MCP integration with structured flags
Usage: airs gateway mcp integrations update [OPTIONS] <id>
Arguments:
<id>
Options:
--auth-type <type> Authentication type (known: headers, none, oauth_auto, oauth_client_credentials)
--output <format> Output format: pretty, table, json
--configurations <json> MCP authentication/configuration object
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--description <text> Integration description
--force Skip the confirmation prompt
--tenant <name> Use this registered tenant for one invocation without changing the selection
--name <name> Integration name
--secret-mappings <json> Secret reference mapping array
--transport <transport> Transport (known: http, interactive, sse)
--url <url> MCP server URL
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway mcp integrations workspaces
Inspect or replace MCP workspace access
Usage: airs gateway mcp integrations workspaces [OPTIONS] [COMMAND]
Commands:
list Read workspace access from integration detail [aliases: ls]
set Replace MCP workspace access
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations workspaces list
Read workspace access from integration detail
Usage: airs gateway mcp integrations workspaces list [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway mcp integrations workspaces set
Replace MCP workspace access
Usage: airs gateway mcp integrations workspaces set [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Output format: pretty, table, json
--global-access <boolean> Enable or disable access to every workspace
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--preserve-existing Preserve bindings not named by this command
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace-binding <id=enabled> Workspace binding (repeatable)
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway organisations
Manage organisation and authentication settings
Usage: airs gateway organisations [OPTIONS] [COMMAND]
Commands:
auth-settings Manage organisation authentication settings
info Get organisation dashboard info (settings redacted)
self Manage the current organisation
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway organisations auth-settings
Manage organisation authentication settings
Usage: airs gateway organisations auth-settings [OPTIONS] [COMMAND]
Commands:
get Get authentication settings
update Update authentication settings with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway organisations auth-settings get
Get authentication settings
Usage: airs gateway organisations auth-settings get [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--tsg-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway organisations auth-settings update
Update authentication settings with structured flags
Usage: airs gateway organisations auth-settings update [OPTIONS]
Options:
--auth-settings <json> Authentication settings object
--output <format> Output format: pretty, table, json
--domains <domains> Comma-separated allowed domains
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--force Skip the confirmation prompt
--scim-token <token> SCIM token
--tenant <name> Use this registered tenant for one invocation without changing the selection
--tsg-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway organisations info
Get organisation dashboard info (settings redacted)
Usage: airs gateway organisations info [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--tsg-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway organisations self
Manage the current organisation
Usage: airs gateway organisations self [OPTIONS] [COMMAND]
Commands:
get Get the current organisation
update Update the current organisation with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway organisations self get
Get the current organisation
Usage: airs gateway organisations self get [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway organisations self update
Update the current organisation with structured flags
Usage: airs gateway organisations self update [OPTIONS]
Options:
--force Skip the confirmation prompt
--output <format> Output format: pretty, table, json
--name <name> Organisation name
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway plugins
Manage gateway plugins
Usage: airs gateway plugins [OPTIONS] [COMMAND]
Commands:
create Install a gateway plugin from structured flags
list List installed gateway plugins [aliases: ls]
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway plugins create
Install a gateway plugin from structured flags
Usage: airs gateway plugins create [OPTIONS]
Options:
--credential <key=value> Plugin credential (repeatable; treated as sensitive)
--output <format> Output format: pretty, table, json
--integration-id <uuid> Integration UUID
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--organisation-id <tsg> Numeric TSG id (default: the selected tenant's mgmtTsgId; another value is refused)
--file <path> Advanced JSON request base; named flags override it
--tenant <name> Use this registered tenant for one invocation without changing the selection
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway plugins list
List installed gateway plugins
Usage: airs gateway plugins list [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway providers
Manage workspace provider bindings
Usage: airs gateway providers [OPTIONS] [COMMAND]
Commands:
create Create a provider from structured flags
delete Permanently delete this resource [aliases: rm]
get Get one provider by UUID (data plane)
list List providers in a workspace (data plane) [aliases: ls]
update Update a provider with structured flags
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway providers create
Create a provider from structured flags
Usage: airs gateway providers create [OPTIONS]
Options:
--ai-provider-id <uuid> Provider catalog UUID
--output <format> Output format: pretty, table, json
--expires-at <iso> Expiration as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--integration-id <uuid> Organisation integration UUID
--name <name> Provider binding name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--note <text> Operator note
--rate-limit <json> Rate-limit object
--slug <slug> Provider binding slug
--usage-limit <json> Usage-limit object
--workspace <uuid> Workspace UUID
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway providers delete
Permanently delete this resource
Usage: airs gateway providers delete [OPTIONS] <id>
Arguments:
<id>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway providers get
Get one provider by UUID (data plane)
Usage: airs gateway providers get [OPTIONS] <id>
Arguments:
<id>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway providers list
List providers in a workspace (data plane)
Usage: airs gateway providers list [OPTIONS] --workspace <uuid>
Options:
--output <format> Output format: pretty, table, json
--workspace <uuid> Workspace UUID
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway providers update
Update a provider with structured flags
Usage: airs gateway providers update [OPTIONS] <id>
Arguments:
<id>
Options:
--expires-at <iso> Expiration as ISO-8601
--output <format> Output format: pretty, table, json
--force Skip the confirmation prompt
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--name <name> Provider binding name
--note <text> Operator note
--tenant <name> Use this registered tenant for one invocation without changing the selection
--rate-limit <json> Rate-limit object
--reset-usage <boolean> Reset accumulated usage: true or false
--usage-limit <json> Usage-limit object
--file <path> Advanced JSON request base; named flags override it
--set <path=value> Set a typed JSON value at a request path (repeatable)
--set-string <path=value> Set a literal string at a request path (repeatable)
-h, --help Print help
airs gateway report
Generate an AI Gateway environment report (read-only)
Usage: airs gateway report [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: 1)
--output <format> Refused by this command: the report is written as HTML (omit --output)
--end <iso> Explicit ISO-8601 end; requires --start
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--max-pages <n> Page budget per source, 1–100 (50 transactions/page) (default: "40")
--output-file <path> Destination (default: new timestamped file in CWD); - for stdout; never overwrite
--tenant <name> Use this registered tenant for one invocation without changing the selection
--start <iso> Explicit ISO-8601 start; requires --end
--strict Exit 1 after writing if any source is incomplete
--title <text> Report title (default: "AI Gateway environment report")
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
Examples:
$ airs gateway report --workspace ws-develo-71f8d8 --output-file ./airs-daily.html
$ airs gateway report --workspace ws-develo-71f8d8
$ airs gateway report --workspace ws-develo-71f8d8 --strict --max-pages 20 --output-file - > daily.html
airs gateway scopes
Manage SCM IAM scopes — the objects a workspace scope_name points at (/iam/v1)
Usage: airs gateway scopes [OPTIONS] [COMMAND]
Commands:
bind Bind a workspace to an existing IAM scope (step 3 of provisioning, on its own)
create Create an unbound IAM scope (step 1 of provisioning, on its own)
delete Delete an IAM scope by name (not live-verified upstream; the API may decline) [aliases: rm]
get Get one IAM scope by name
list List every IAM scope in the tenant (unbound scopes have no resources) [aliases: ls]
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway scopes bind
Bind a workspace to an existing IAM scope (step 3 of provisioning, on its own)
Usage: airs gateway scopes bind [OPTIONS] --workspace <ref> <name>
Arguments:
<name>
Options:
--output <format> Output format: pretty, table, json
--workspace <ref> Workspace slug, UUID, or unique display name
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway scopes bind ws_production_bx7qw0 --workspace ws-produc-985697
airs gateway scopes create
Create an unbound IAM scope (step 1 of provisioning, on its own)
Usage: airs gateway scopes create [OPTIONS] --name <name>
Options:
--description <text> Scope description
--output <format> Output format: pretty, table, json
--name <name> Scope name, e.g. ws_production_bx7qw0
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway scopes create --name ws_production_bx7qw0 --description 'All production applications'
airs gateway scopes delete
Delete an IAM scope by name (not live-verified upstream; the API may decline)
Usage: airs gateway scopes delete [OPTIONS] <name>
Arguments:
<name>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway scopes delete ws_truffles_ggolfu --force
airs gateway scopes get
Get one IAM scope by name
Usage: airs gateway scopes get [OPTIONS] <name>
Arguments:
<name>
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway scopes get ws_production_bx7qw0
airs gateway scopes list
List every IAM scope in the tenant (unbound scopes have no resources)
Usage: airs gateway scopes list [OPTIONS]
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway scopes list
$ airs gateway scopes list --output json
airs gateway telemetry
AI Gateway runtime telemetry (data plane)
Usage: airs gateway telemetry [OPTIONS] [COMMAND]
Commands:
cache Inspect cache telemetry
cost Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)
error-category-trends Get errors by HTTP status
error-trends Get error trends
errors Get error count
feedback Inspect model feedback telemetry
filter-boundaries Get available analytics filters and bounds
group-by Aggregate telemetry by ai_service, model, api_key, provider, status_code, users
grouped-errors Get HTTP error counts by time bucket
latency Get latency telemetry
logs Inspect request logs
requests Get request count
rescued-retries Get rescued retry telemetry
tokens Get token usage
user-trends Get user trends
users Get unique-user count
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway telemetry cache
Inspect cache telemetry
Usage: airs gateway telemetry cache [OPTIONS] [COMMAND]
Commands:
summary Get cache totals
trend Get cache-hit trend
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway telemetry cache summary
Get cache totals
Usage: airs gateway telemetry cache summary [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry cache trend
Get cache-hit trend
Usage: airs gateway telemetry cache trend [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry cost
Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)
Usage: airs gateway telemetry cost [OPTIONS] --workspace <ref>
Options:
--ai-org-models <pairs> Comma-separated provider__model pairs, e.g. openai__gpt-5.6-terra
--output <format> Output format: pretty, table, json
--api-key-ids <ids> Comma-separated service key UUIDs (not secret key values)
--quiet Suppress status and decorative output (data and errors still print)
--cost-max <cents> Inclusive maximum cost in cents (fractional cents allowed)
--debug Write redacted API diagnostics to a private JSONL file
--cost-min <cents> Inclusive minimum cost in cents (fractional cents allowed)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--metadata <json> Filter by string-valued metadata (JSON object)
--status-codes <codes> Comma-separated HTTP statuses (OR within the list)
--total-units-max <n> Inclusive maximum total tokens (nonnegative integer)
--total-units-min <n> Inclusive minimum total tokens (nonnegative integer)
--trace-id <id> Filter by one trace ID
--days <n> Rolling window in days, counted back from now (default: "7")
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
Examples:
$ airs gateway telemetry cost --workspace ws-main-a-349e0e
$ airs gateway telemetry cost --workspace ws-main-a-349e0e --days 30 --output json
airs gateway telemetry error-category-trends
Get errors by HTTP status
Usage: airs gateway telemetry error-category-trends [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry error-trends
Get error trends
Usage: airs gateway telemetry error-trends [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry errors
Get error count
Usage: airs gateway telemetry errors [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry feedback
Inspect model feedback telemetry
Usage: airs gateway telemetry feedback [OPTIONS] [COMMAND]
Commands:
distribution Get feedback distribution
models Get feedback models
trend Get feedback trend
weighted Get feedback weighted
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway telemetry feedback distribution
Get feedback distribution
Usage: airs gateway telemetry feedback distribution [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry feedback models
Get feedback models
Usage: airs gateway telemetry feedback models [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry feedback trend
Get feedback trend
Usage: airs gateway telemetry feedback trend [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry feedback weighted
Get feedback weighted
Usage: airs gateway telemetry feedback weighted [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry filter-boundaries
Get available analytics filters and bounds
Usage: airs gateway telemetry filter-boundaries [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry group-by
Aggregate telemetry by ai_service, model, api_key, provider, status_code, users
Usage: airs gateway telemetry group-by [OPTIONS] --workspace <ref> <dimension>
Arguments:
<dimension>
Options:
--columns <names> Comma-separated aggregate columns (not supported for users)
--output <format> Output format: pretty, table, json
--ai-org-models <pairs> Comma-separated provider__model pairs, e.g. openai__gpt-5.6-terra
--quiet Suppress status and decorative output (data and errors still print)
--api-key-ids <ids> Comma-separated service key UUIDs (not secret key values)
--debug Write redacted API diagnostics to a private JSONL file
--cost-max <cents> Inclusive maximum cost in cents (fractional cents allowed)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--cost-min <cents> Inclusive minimum cost in cents (fractional cents allowed)
--metadata <json> Filter by string-valued metadata (JSON object)
--status-codes <codes> Comma-separated HTTP statuses (OR within the list)
--total-units-max <n> Inclusive maximum total tokens (nonnegative integer)
--total-units-min <n> Inclusive minimum total tokens (nonnegative integer)
--trace-id <id> Filter by one trace ID
--days <n> Rolling window in days (default: "7")
--end <iso> Window end as ISO-8601
--start <iso> Window start as ISO-8601
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry grouped-errors
Get HTTP error counts by time bucket
Usage: airs gateway telemetry grouped-errors [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry latency
Get latency telemetry
Usage: airs gateway telemetry latency [OPTIONS] --workspace <ref>
Options:
--ai-org-models <pairs> Comma-separated provider__model pairs, e.g. openai__gpt-5.6-terra
--output <format> Output format: pretty, table, json
--api-key-ids <ids> Comma-separated service key UUIDs (not secret key values)
--quiet Suppress status and decorative output (data and errors still print)
--cost-max <cents> Inclusive maximum cost in cents (fractional cents allowed)
--debug Write redacted API diagnostics to a private JSONL file
--cost-min <cents> Inclusive minimum cost in cents (fractional cents allowed)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--metadata <json> Filter by string-valued metadata (JSON object)
--status-codes <codes> Comma-separated HTTP statuses (OR within the list)
--total-units-max <n> Inclusive maximum total tokens (nonnegative integer)
--total-units-min <n> Inclusive minimum total tokens (nonnegative integer)
--trace-id <id> Filter by one trace ID
--days <n> Rolling window in days (default: "7")
--end <iso> Window end as ISO-8601
--start <iso> Window start as ISO-8601
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry logs
Inspect request logs
Usage: airs gateway telemetry logs [OPTIONS] [COMMAND]
Commands:
list List request logs [aliases: ls]
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway telemetry logs list
List request logs
Usage: airs gateway telemetry logs list [OPTIONS] --workspace <ref>
Options:
--current-page <n> Zero-based transaction page (default: "0")
--output <format> Output format: pretty, table, json
--page-size <n> Rows per response (default: "50")
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--status-code <code> Filter by HTTP status
--tenant <name> Use this registered tenant for one invocation without changing the selection
--trace-id <id> Return one trace id
--days <n> Rolling window in days (default: "7")
--end <iso> Window end as ISO-8601
--start <iso> Window start as ISO-8601
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry requests
Get request count
Usage: airs gateway telemetry requests [OPTIONS] --workspace <ref>
Options:
--ai-org-models <pairs> Comma-separated provider__model pairs, e.g. openai__gpt-5.6-terra
--output <format> Output format: pretty, table, json
--api-key-ids <ids> Comma-separated service key UUIDs (not secret key values)
--quiet Suppress status and decorative output (data and errors still print)
--cost-max <cents> Inclusive maximum cost in cents (fractional cents allowed)
--debug Write redacted API diagnostics to a private JSONL file
--cost-min <cents> Inclusive minimum cost in cents (fractional cents allowed)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--metadata <json> Filter by string-valued metadata (JSON object)
--status-codes <codes> Comma-separated HTTP statuses (OR within the list)
--total-units-max <n> Inclusive maximum total tokens (nonnegative integer)
--total-units-min <n> Inclusive minimum total tokens (nonnegative integer)
--trace-id <id> Filter by one trace ID
--days <n> Rolling window in days (default: "7")
--end <iso> Window end as ISO-8601
--start <iso> Window start as ISO-8601
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry rescued-retries
Get rescued retry telemetry
Usage: airs gateway telemetry rescued-retries [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry tokens
Get token usage
Usage: airs gateway telemetry tokens [OPTIONS] --workspace <ref>
Options:
--ai-org-models <pairs> Comma-separated provider__model pairs, e.g. openai__gpt-5.6-terra
--output <format> Output format: pretty, table, json
--api-key-ids <ids> Comma-separated service key UUIDs (not secret key values)
--quiet Suppress status and decorative output (data and errors still print)
--cost-max <cents> Inclusive maximum cost in cents (fractional cents allowed)
--debug Write redacted API diagnostics to a private JSONL file
--cost-min <cents> Inclusive minimum cost in cents (fractional cents allowed)
--tenant <name> Use this registered tenant for one invocation without changing the selection
--metadata <json> Filter by string-valued metadata (JSON object)
--status-codes <codes> Comma-separated HTTP statuses (OR within the list)
--total-units-max <n> Inclusive maximum total tokens (nonnegative integer)
--total-units-min <n> Inclusive minimum total tokens (nonnegative integer)
--trace-id <id> Filter by one trace ID
--days <n> Rolling window in days (default: "7")
--end <iso> Window end as ISO-8601
--start <iso> Window start as ISO-8601
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry user-trends
Get user trends
Usage: airs gateway telemetry user-trends [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway telemetry users
Get unique-user count
Usage: airs gateway telemetry users [OPTIONS] --workspace <ref>
Options:
--days <n> Rolling window in days (default: "7")
--output <format> Output format: pretty, table, json
--end <iso> Window end as ISO-8601
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--start <iso> Window start as ISO-8601
--tenant <name> Use this registered tenant for one invocation without changing the selection
--workspace <ref> Workspace slug, UUID, or unique display name
-h, --help Print help
airs gateway workspaces
Manage gateway workspaces
Usage: airs gateway workspaces [OPTIONS] [COMMAND]
Commands:
archive Archive a workspace (soft delete — there is no hard delete)
create Create a workspace: IAM scope → workspace → bind scope (admin plane)
get Get one workspace by UUID or slug (includes settings blocks)
list List workspaces (default: active workspaces you are scoped to) [aliases: ls]
update Update a workspace (admin plane, partial patch)
help Print this message or the help of the given subcommand(s)
Options:
--output <format> Output format: pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
airs gateway workspaces archive
Archive a workspace (soft delete — there is no hard delete)
Usage: airs gateway workspaces archive [OPTIONS] <ref>
Arguments:
<ref>
Options:
--force Skip confirmation prompt
--output <format> Ignored by this command (it prints no data); must still be one of pretty, table, json
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway workspaces archive ws-produc-985697 --force
airs gateway workspaces create
Create a workspace: IAM scope → workspace → bind scope (admin plane)
Usage: airs gateway workspaces create [OPTIONS] --name <name>
Options:
--description <text> Workspace description
--output <format> Output format: pretty, table, json
--existing-scope Bind an IAM scope that already exists instead of creating one (requires --scope-name)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--icon <icon> Workspace icon
--name <name> Display name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--scope-name <scope> IAM scope to create and bind (e.g. ws_production_bx7qw0). Default: ws_<name>_<suffix>
--users <ids> Comma-separated user ids to seed the workspace with
--defaults <json> Workspace defaults object
--metadata <json> Sugar for defaults.metadata (flat string map)
--rate-limits <json> Rate-limit policies — a JSON ARRAY of policy objects
--usage-limits <json> Usage-limit policies — a JSON ARRAY of policy objects
-h, --help Print help
Examples:
$ airs gateway workspaces create --name truffles --description "Online recipe generation application"
$ airs gateway workspaces create --name Production --scope-name ws_production_bx7qw0
$ airs gateway workspaces create --name Staging --scope-name ws_staging_q1x8mz --existing-scope
$ airs gateway workspaces create --name Production --metadata '{"env":"production"}' --rate-limits '[{"type":"requests","unit":"rpm","value":100}]'
airs gateway workspaces get
Get one workspace by UUID or slug (includes settings blocks)
Usage: airs gateway workspaces get [OPTIONS] <ref>
Arguments:
<ref>
Options:
--output <format> Output format: pretty, table, json
--plane <plane> Plane to read from: data (scoped) or admin (whole tenant)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway workspaces get ws-main-a-349e0e
$ airs gateway workspaces get 16f7e90d-382a-4e78-b577-1b01eb5f8297 --plane admin --output json
airs gateway workspaces list
List workspaces (default: active workspaces you are scoped to)
Usage: airs gateway workspaces list [OPTIONS]
Options:
--all Merge active + archived admin-plane reads (whole tenant, both states)
--output <format> Output format: pretty, table, json
--plane <plane> Plane to read from: data (scoped) or admin (whole tenant)
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--status <status> Filter by lifecycle state: active or archived
--tenant <name> Use this registered tenant for one invocation without changing the selection
-h, --help Print help
Examples:
$ airs gateway workspaces list
$ airs gateway workspaces list --plane admin
$ airs gateway workspaces list --plane admin --status archived
$ airs gateway workspaces list --all --output json
airs gateway workspaces update
Update a workspace (admin plane, partial patch)
Usage: airs gateway workspaces update [OPTIONS] <ref>
Arguments:
<ref>
Options:
--description <text> New description
--output <format> Output format: pretty, table, json
--force Skip the confirmation prompt
--quiet Suppress status and decorative output (data and errors still print)
--debug Write redacted API diagnostics to a private JSONL file
--icon <icon> New icon
--name <name> New display name
--tenant <name> Use this registered tenant for one invocation without changing the selection
--defaults <json> Workspace defaults object
--metadata <json> Sugar for defaults.metadata (flat string map)
--rate-limits <json> Rate-limit policies — a JSON ARRAY of policy objects
--usage-limits <json> Usage-limit policies — a JSON ARRAY of policy objects
-h, --help Print help
Examples:
$ airs gateway workspaces update ws-produc-985697 --description 'Production workloads, us-east'