CLI

Install, global flags, exit codes, and every command the axhub CLI offers

axhub is the official CLI for working with axhub from the terminal, CI, and agents. This page collects the rules that apply to every command — installation, global options, the JSON output envelope, and exit codes. After that, every command is listed, grouped by purpose. Installing the CLI for the first time and shipping your first app? Follow the Quickstart first.

Every command and flag is also available via axhub --json-schema. This reference is generated from that output (currently v0.30.0). For the last-mile details, axhub <command> --help is always current.

Install

macOS / Linux

curl -fsSL https://cli.axhub.ai/install.sh | bash
axhub --version

Windows PowerShell

irm https://cli.axhub.ai/install.ps1 | iex
axhub --version

Global options

These work on any command; most can also be set via environment variables.

Option	Description
`--profile <name>`	Profile to use (`AXHUB_PROFILE`)
`--tenant <tenant>`	Target tenant (`AXHUB_TENANT`)
`--json`	JSON output (`AXHUB_JSON`)
`--field-expr <expr>`	Extract values from the JSON output with a jq-compatible expression
`--field-expr-json <expr>`	Same, but print compact JSON
`-y, --yes`	Auto-approve non-destructive confirmation prompts (`AXHUB_YES`)
`--no-input`	Disable interactive input — for agents/CI (`AXHUB_NO_INPUT`)
`--non-interactive`	Fully non-interactive mode (`AXHUB_NON_INTERACTIVE`)
`--no-keychain`	Use file-backed credentials instead of the OS keychain (`AXHUB_NO_KEYCHAIN`)
`--token-file <path>`	OAuth token file path (`AXHUB_TOKEN_FILE`)
`--api-key-file <path>`	PAT (API key) file path (`AXHUB_API_KEY_FILE`)
`--config <path>`	CLI config file path (`AXHUB_CONFIG`)
`--endpoint <URL>`	API endpoint (`AXHUB_ENDPOINT`)
`--insecure-endpoint`	Allow a non-HTTPS endpoint — development/testing only (`AXHUB_INSECURE_ENDPOINT`)
`--timeout <duration>`	Request timeout, e.g. `30s` (`AXHUB_TIMEOUT`)
`--idempotency-key <UUID>`	Idempotency key for agent-safe mutation retries (`AXHUB_IDEMPOTENCY_KEY`)
`--agent-error-guide`	Emit an agent-friendly error guide to stderr
`--otlp-endpoint <URL>`	OTLP collector endpoint for opt-in agent telemetry (`AXHUB_OTLP_ENDPOINT`)
`--completions <shell>`	Print shell completions (same as the `completion` subcommand)
`--json-schema`	Export the full CLI surface as a JSON schema — for agents and CI drift checks
`--no-color`	Disable colored output (`AXHUB_NO_COLOR`)
`--trace`	Print request traces
`-v, --debug`	Debug logs (`AXHUB_DEBUG`)
`--version`	Print the version

Environment variables without a flag pair

Variable	Description
`AXHUB_OUTPUT=json`	Same as `--json`
`AXHUB_API_KEY`	Inject the PAT value directly (instead of a file)
`AXHUB_DISABLE_AUTOUPDATE=1`	Disable the CLI auto-update check
`AXHUB_ALLOW_UNSIGNED=1` · `AXHUB_REQUIRE_COSIGN=1`	Relax/enforce update signature verification (both set → exit `64`)
`AXHUB_USE_KEYCHAIN=1`	Force the OS keychain even under `--no-input`
`AXHUB_INSTALL_DIR`	Installer target directory
`AXHUB_LOG`	Tracing log filter

An AXHUB_TOKEN variable is never read. Inject tokens via --token-file (AXHUB_TOKEN_FILE) or a PAT (AXHUB_API_KEY).

Output format

With --json, every result uses the same envelope. status is one of ok · error · dry_run — previews report dry_run, not success.

{ "schema_version": "1", "status": "ok", "data": { /* ... */ } }
{ "schema_version": "1", "status": "error", "error": { "code": "...", "subcode": "...", "fields": [], "resource": "...", "doc_url": "..." } }

Agents should branch on error.code / error.subcode and the exit codes below, not on human-readable messages.

Exit codes

Code	Meaning	What to do
`0`	Success	—
`1`	Generic failure	Local I/O, etc.
`2`	Internal init failure (rare)	Retry/diagnose — bad flags or commands exit with `64`, not `2`
`4`	Unauthenticated	`axhub auth login`
`5`	Resource not found	Check the target id/slug
`6`	Rate-limited	Retry later
`7`	API error	Check the message and request_id
`8`	Tenant scope failure	Check the active tenant
`9`	Conflict	Already exists/settled — branch on `error.subcode`
`10`	Timeout	Retry
`11`	Dry-run blocked	Add `--execute`
`12`	Domain blocked	Invitation email domain policy violation
`13`	Invitation expired	Send a new invitation
`14`	Update digest mismatch	Tamper signal — abort install, reinstall
`15`	Binary swap failed	Final step of `update apply` failed — retry or diagnose
`64`	CLI-side usage/validation failure	Fix inputs and retry
`66`	Update policy blocked	Branch on `error.subcode` (downgrade vs cosign)

Every command

Everything available as of v0.30.0, grouped by purpose. Each row is a command you can actually type. Flags live in axhub <command> --help or in the group detail below.

Mutating commands preview by default. Any command whose description mentions "dry-run" shows you what would change and stops. Add --execute to actually apply it.

Command	What it does
`axhub auth login`	Sign in via the OAuth device flow
`axhub auth logout`	Sign out and clear stored credentials
`axhub auth status`	Show current authentication status
`axhub auth whoami`	Show the currently authenticated user
`axhub auth refresh`	Refresh the stored OAuth access token
`axhub auth pat issue`	Issue a personal access token (PAT)
`axhub auth pat list`	List your PATs
`axhub auth pat revoke`	Revoke a PAT
`axhub auth pat rotate`	Rotate a PAT — revoke and reissue
`axhub auth pat use`	Save a PAT as the active local credential
`axhub auth pat unset`	Clear the stored active PAT
`axhub auth pat whoami`	Show who this PAT authenticates as
`axhub auth oauth revoke`	Revoke an OAuth token
`axhub auth oauth client`	Manage OAuth clients
`axhub auth oauth consent`	Manage OAuth consent grants
`axhub auth idp list`	List the company's identity providers (SSO config)
`axhub auth idp create`	Create an IdP configuration
`axhub auth idp update`	Update an IdP's mutable fields
`axhub auth idp enable` · `disable`	Enable or disable an IdP
`axhub auth idp delete`	Delete a disabled IdP
`axhub auth idp providers`	List supported IdP types
`axhub auth idp test`	Test an IdP configuration
`axhub profile add` · `list` · `current` · `use` · `remove`	Manage local CLI profiles
`axhub config explain`	Explain the resolved config and where each value came from
`axhub doctor`	Diagnose config, auth, and backend reachability locally

Company & people

Command	What it does
`axhub tenants whoami`	Your membership and role in the active company
`axhub tenants list` · `get`	Companies you belong to · one company's details
`axhub tenants create` · `update` · `delete` · `restore`	Create, update, delete, restore a company
`axhub tenants groups list` · `create` · `rename` · `delete`	Manage company groups (teams)
`axhub tenants scim connection`	Show SCIM connection status
`axhub tenants scim issue-token` · `revoke-token`	Issue or revoke a SCIM token
`axhub tenants google-directory`	Manage the Google Workspace directory connection
`axhub tenants directory-sync`	Sync the connected directory now
`axhub tenants invite-links`	Create, list, and revoke invite links
`axhub tenants icon set` · `clear` · `sign`	Set, clear, or get an upload URL for the company icon
`axhub tenants billing summary` · `entitlements`	Estimated billing summary · limits
`axhub tenants billing subscription` · `seats` · `payment-method` · `payments`	Plan, seats, payment method, payment history
`axhub tenants billing credits`	Inspect and top up pay-as-you-go credits
`axhub tenants agents hermes`	Manage the company's hermes entitlement
`axhub members list` · `me` · `resolve`	Member list · your membership · look up by email
`axhub members set-role`	Change a member's role
`axhub members deactivate` · `reactivate`	Deactivate or reactivate a member
`axhub members move-group` · `restore-scim`	Change team placement · return to directory sync
`axhub members assign-seat` · `unassign-seat`	Assign or release a paid seat
`axhub members directory` · `org-directory`	Roster with team placement · org chart (read-only)
`axhub invitations send` · `bulk`	Send one invitation · invite many at once
`axhub invitations list` · `cancel` · `resend` · `accept`	List, cancel, resend, accept invitations

Apps

Command	What it does
`axhub apps list` · `mine` · `owned` · `received` · `workspace`	App lists — accessible, yours, received, workspace
`axhub apps get` · `search` · `discover`	App details · search · browse public apps
`axhub apps create` · `fork` · `update`	Create, fork, update app metadata
`axhub apps check-availability`	Check whether an app slug is free
`axhub apps bootstrap` · `bootstrap-status`	Bootstrap from a template or repo · check progress
`axhub apps templates list`	List available bootstrap templates
`axhub apps detect`	Detect build settings in a GitHub repo (read-only)
`axhub apps suspend` · `resume`	Suspend or resume an app
`axhub apps archive` · `reactivate`	Archive or un-archive an app
`axhub apps delete` · `purge`	Delete · permanently purge an app
`axhub apps members`	List an app's members
`axhub apps co-owners`	Manage co-owners (list, add, remove)
`axhub apps ownership transfer`	Hand over representative ownership — irreversible
`axhub apps git connect` · `status` · `update` · `disconnect`	Connect a GitHub repo, check it, change branch, disconnect
`axhub apps domains list` · `add` · `remove` · `verify`	Custom domains — list, register, detach, re-check DNS
`axhub apps storage status` · `enable`	Storage status · provision it
`axhub apps storage ls` · `get-url` · `rm`	List objects · issue a download URL · delete
`axhub apps raw-db`	Manage the app's own Postgres database
`axhub apps static site` · `releases` · `deploy` · `auth`	Static hosting — site config, releases, deploy, protected auth
`axhub apps resource-presets`	Backend resource preset catalog
`axhub apps inspection-consent`	Show or set code-inspection (LLM review) consent
`axhub apps sign-icon-upload`	Get a signed URL to upload an app icon
`axhub init`	Scaffold `axhub.yaml` in the current folder
`axhub manifest`	Parse and validate `axhub.yaml`
`axhub open`	Open an app or resource in the browser
`axhub categories list` · `get` · `create` · `update` · `delete`	Manage app categories
`axhub publish`	Submit a request to publish an app
`axhub review list` · `get` · `approve` · `reject` · `history`	Review publish requests — list, detail, approve, reject, history
`axhub github accounts list`	GitHub accounts and orgs visible to AxHub
`axhub github installations repos`	Repositories for a GitHub App installation
`axhub github repo create`	Create a repository with your linked GitHub account
`axhub github link`	Link GitHub via the browserless device flow
`axhub github complete`	Complete the GitHub App installation callback

Deploy

Command	What it does
`axhub deploy create`	Trigger a deployment
`axhub deploy status`	Latest deployment status
`axhub deploy verify`	Verify a specific deployment actually succeeded
`axhub deploy watch`	Watch a deployment until it finishes
`axhub deploy list` · `releases`	Deployment history · release history
`axhub deploy logs`	View deployment logs
`axhub deploy cancel`	Cancel an in-progress deployment
`axhub deploy rollback`	Roll back to the deployment given by `--from-deployment`
`axhub deploy fleet`	Deploy several apps in parallel
`axhub deploy staging enable` · `disable`	Turn the staging environment on or off
`axhub deploy promote-preflight`	Preview what promotion to production would change
`axhub deploy promote` · `promote retry`	Promote to production · retry a failed promotion
`axhub deploy scan`	Security scan report for a deployment
`axhub deploy scan report-false-positive`	Report one scan finding as a false positive
`axhub deploy diagnose`	Diagnose live rollout health
`axhub deploy doctor`	Diagnose deployment readiness
`axhub deploy git configure` · `connect` · `disconnect` · `status`	Configure, connect, disconnect, inspect the deploy git link
`axhub deploy codes`	List deployment status codes and their meanings
`axhub deploy explain`	Explain how config, auth, and the target app were resolved

Database & environment variables

Command	What it does
`axhub tables list` · `get`	List dynamic tables · show one
`axhub tables create` · `drop`	Create or drop a table
`axhub tables check-availability` · `column-types`	Check a table name · list supported column types
`axhub tables columns add` · `remove`	Add or remove a column
`axhub tables rows insert` · `update` · `delete`	Insert, update, delete a row
`axhub tables grants list` · `issue` · `revoke`	Table access grants — list, issue, revoke
`axhub tables db-list` · `db-rows`	Raw tables and rows in the app's own DB (OAuth required)
`axhub data list` · `count` · `get`	Read rows, count, fetch one via the `/data` API
`axhub data insert` · `update` · `delete`	Insert (`--batch` for JSONL), update, delete a row
`axhub env list` · `get`	List environment variables · read one value
`axhub env set` · `update` · `delete`	Create, update, delete an environment variable
`axhub env set-staging-value`	Set a staging-only value

Connectors, gateway & permissions

Command	What it does
`axhub connectors list` · `show` · `mine`	Connector list (admin) · details · what you can use
`axhub connectors create` · `update` · `delete`	Register, update, delete a connector
`axhub connectors test-connection`	Probe the external system with stored credentials
`axhub connectors discover` · `resources`	Trigger discovery · show the discovered resource tree
`axhub connectors app-db`	Expose an app's own DB as a connector
`axhub connectors google start` · `finalize`	Start and finish Google Drive OAuth
`axhub gateway session start` · `end`	Start or end a gateway session (8h)
`axhub gateway query`	Run guarded SQL through a session
`axhub gateway invoke` · `document-invoke` · `file-invoke`	Call REST, document-store, and file-storage endpoints
`axhub authz subjects list` · `show` · `create`	Manage authorization subjects (groups, org units)
`axhub authz presets list` · `show` · `create` · `update` · `delete`	Manage privilege presets
`axhub authz policies list` · `show` · `create` · `update` · `delete`	Manage access policies (row filter, column allow/mask)
`axhub authz grants list` · `show` · `create` · `revoke` · `mine`	Grant and revoke data access · list your own
`axhub authz grants set-policies`	Replace the policy set attached to a grant
`axhub access`	App access — grant, revoke, list, invite collaborators
`axhub sites create` · `list` · `show`	Register, list, inspect private-network sites
`axhub sites rotate-token` · `delete`	Rotate a site token · delete a site

AI, notifications & webhooks

Command	What it does
`axhub axrouter status`	Availability per company and your consent state
`axhub axrouter monitor`	Turn Claude Code prompt logging on (`--off` to turn off)
`axhub axrouter consent` · `revoke-consent`	Give or withdraw body-collection consent
`axhub axrouter revoke`	Release enrollment and stop logging
`axhub axrouter keys issue` · `list` · `revoke`	Issue, list, revoke AXRouter virtual API keys
`axhub sdk search`	Semantic search over SDK knowledge
`axhub sdk recipe`	Render an SDK recipe, substituted for your app
`axhub sdk validate`	Statically validate SDK usage in one file
`axhub notifications list` · `read`	Read the inbox · mark notifications read
`axhub notifications prefs list` · `set`	Show or change the kind×channel matrix
`axhub relay list` · `create` · `delete`	List, create, close inbound webhook endpoints
`axhub relay rotate-key` · `deliveries` · `replay`	Rotate the key · delivery history · replay
`axhub agents hermes status` · `up` · `down`	Your hermes instance — status, start, delete

Tools & diagnostics

Command	What it does
`axhub infra usage` · `usage-series`	Company infrastructure usage · per-app usage series
`axhub update check` · `apply`	Check for a new release · install it
`axhub whatsnew`	Release notes
`axhub completion bash` · `zsh` · `fish` · `powershell`	Print shell completion scripts
`axhub cache clear`	Clear the local schema cache
`axhub dev`	Local development helpers
`axhub feedback -m "<message>"`	Report a CLI failure with diagnostics (`--dry-run` to preview)
`axhub support diagnose`	Collect a redacted diagnostics bundle for support
`axhub tui`	Interactive terminal dashboard

axhub axrouter keys requires an OAuth login (axhub auth login). Since v0.28.0 it obtains a 10-minute workspace-pinned console token via RFC 8693 token exchange, so a PAT (AXHUB_API_KEY) alone won't work. When both exist, the stored OAuth token is used automatically.

Group detail

When you need flags, arguments, and responses, use these. They aren't in the sidebar — only these links reach them.

Auth & Account

auth · profile · tenants · config · doctor · update

Apps

apps (incl. static · storage · domains · co-owners · raw-db) · init · github · open · categories · review · publish

Deploy

deploy — status, logs, rollback, staging, promote, verify, scan

Database & env vars

tables db-list · db-rows · env

Gateway & Connectors

connectors (incl. app-db) · gateway sessions · guarded queries

Governance & Access

access · members · invitations · authz (incl. access policies)

The detail pages are pinned at v0.28.0 — for flag-level changes, axhub <command> --help is always current.

Migrating from older versions

Removed commands — axhub resources, catalog, status, and engines no longer exist as of v0.24 (rejected with exit 64). Use connectors resources / gateway for catalog & resource browsing, and deploy status for deployment state.
Commands not listed above — a few platform-admin and internal commands (admin, audit, cost, email-domains) are hidden even from help. They still work but are not covered in the public reference.