Gateway & Connectors
External data connector and guarded gateway session/query commands
This page is for safely reaching the external data registered to your company (DBs, REST APIs, Google Drive) through the gateway. The flow is always the same — check which connectors your grants reach with connectors mine, open a session with gateway session start, then call query · invoke · document-invoke · file-invoke. Every call passes through the guards of the presets and access policies bound to your grant. The full picture of connector setup and its safeguards is covered in the Connect company data with a connector.
axhub connectors
Browse accessible gateway connectors and their discovered resources.
axhub connectors discover
Trigger immediate connector resource discovery (admin).
| Flag | Type | Description | Default |
|---|---|---|---|
<connector_id> | string (positional) | — | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub connectors app-db
Expose an axhub app's dedicated database as a connector (spec 130).
axhub connectors app-db eligible
List apps whose DB can be exposed as a connector (read-only).
| Flag | Type | Description | Default |
|---|---|---|---|
--tenant | string | Tenant id/slug/name override. Defaults to the active tenant membership | — |
--limit | integer | Backend page size for this request | — |
--cursor | string | Cursor from a previous page's next_cursor | — |
axhub connectors app-db create
Expose one app's database as a connector.
| Flag | Type | Description | Default |
|---|---|---|---|
--app | string | App id or slug to expose | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
axhub connectors google
Google Drive OAuth helper routes for connector setup.
axhub connectors google finalize
Finalize Google Drive OAuth and create the connector.
| Flag | Type | Description | Default |
|---|---|---|---|
--description | string | Human-readable description for the resource. | — |
--drive-id | string | — | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
--name | string | Resource display name. | — |
--state | string | — | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub connectors google start
Start Google Drive OAuth and print the authorization URL.
| Flag | Type | Description | Default |
|---|---|---|---|
--return-to | string | — | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub connectors mine
List connectors the caller can access through an active grant.
| Flag | Type | Description | Default |
|---|---|---|---|
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub connectors resources
Show the discovered resource tree for an accessible connector.
| Flag | Type | Description | Default |
|---|---|---|---|
<connector_id> | string (positional) | — | — |
--admin | boolean | — | — |
--limit | integer | Pagination control for list output. | — |
--offset | integer | Pagination control for list output. | — |
--q | string | Search query string. | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub gateway
Gateway access: sessions, guarded SQL query, and REST invoke (DAC spec 013).
axhub gateway document-invoke
Invoke a document-store op through the gateway (free-form passthrough; requires an active session).
| Flag | Type | Description | Default |
|---|---|---|---|
--body-json | string | Full op body as one JSON object. Optional — the body can be built from the typed flags below alone. Individual flags override matching keys. The CLI always injects session_id and op last | — |
--collection | string | Target collection name | — |
--database | string | Target database name | — |
--document | string | Single document as a JSON value | — |
--documents | string | Multiple documents as a JSON array | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
--field | string | Target field name | — |
--filter | string | Query filter as a JSON value | — |
--limit | integer | Result limit | — |
--op | string | Document-store op. Free-form: the backend SDK is the source of truth and validates supported ops, so new ops work without a CLI change | — |
--pipeline | string | Aggregation pipeline as a JSON array | — |
--projection | string | Projection as a JSON value | — |
--session-id | string | Active gateway session id (from axhub gateway session start) | — |
--skip | string | Result skip/offset | — |
--sort | string | Sort spec as a JSON value | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
--update | string | Update spec as a JSON value | — |
axhub gateway file-invoke
Invoke Google Drive/file-storage actions through the gateway.
| Flag | Type | Description | Default |
|---|---|---|---|
--action | string | — | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
--file-id | string | — | — |
--parent-folder-id | string | — | — |
--q | string | Search query string. | — |
--session-id | string | — | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub gateway invoke
Invoke a REST connector endpoint through the gateway (requires an active session).
| Flag | Type | Description | Default |
|---|---|---|---|
--body | string | Raw request body. The CLI base64-encodes it per the gateway wire contract | — |
--body-file | string | Read the raw request body from a file | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
--header | string | Repeatable request header in Name: Value form | — |
--method | string | — | — |
--path | string | Connector-relative request path (e.g. /api/v1/users) | — |
--session-id | string | Active gateway session id (from axhub gateway session start) | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub gateway query
Run SQL through the guarded gateway pipeline (requires an active session).
| Flag | Type | Description | Default |
|---|---|---|---|
--action | string | Override the inferred SQL action (db preset vocabulary, e.g. SELECT or INSERT) | — |
--allow-non-select | boolean | Allow statements other than SELECT/WITH (the preset must still allow the action) | — |
--dry-run | boolean | Preview the operation without applying state changes. | true |
--execute | boolean | Apply the state-changing operation instead of previewing it. | — |
--params-json | string | JSON array of positional query parameters | — |
--session-id | string | Active gateway session id (from axhub gateway session start) | — |
--sql | string | — | — |
--sql-file | string | — | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
The DB preset action vocabulary also includes EXPLAIN, classified as read-only (spec 168) — "SQL is SELECT/WITH only" is no longer an accurate statement. Since an EXPLAIN statement isn't SELECT/WITH, run it with --allow-non-select while the preset allows EXPLAIN.
When a grant has a scope (scope_resource_paths) set, free-form SQL (gateway query) is rejected (spec 172) — 403 scope_requires_target, and access to resources outside the scope fails with 403 scope_out_of_range.
axhub gateway session
Manage gateway access sessions (8h TTL, snapshots the active grant).
axhub gateway session end
End an active session.
| Flag | Type | Description | Default |
|---|---|---|---|
<session_id> | string (positional) | — | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |
axhub gateway session start
Start a session against an accessible connector.
| Flag | Type | Description | Default |
|---|---|---|---|
--connector-id | string | — | — |
--mfa-verified | boolean | Mark the session as MFA-verified | — |
--tenant | string | Tenant slug or ID used to scope the command. | — |