​

api

orc api sends authenticated HTTP requests to the Orchestor API from your terminal. It uses the same credentials as other CLI commands. Discover methods and paths in the public API contract, then make calls with queries or JSON bodies.

Use it to explore operations without dedicated commands, debug responses, or integrate calls into scripts. Before running it, sign in with orc auth login or configure the authentication used by the CLI. Requests go to the configured Orchestor API and use the current principal’s permissions. The list is a public contract catalog, not a determination of your operation permissions.

Inspect public API methods, paths, and descriptions.

Retrieve the current authenticated principal’s profile.

Return HTTP methods, paths, operationId values, and descriptions from the public API contract bundled with the CLI. Authentication is required. The list is not filtered by account permissions; the server checks permissions when a request runs. orc api ls is an alias for orc api list.

Return the API catalog as JSON for scripts.

Specify an HTTP method and an API path beginning with /. Supported methods are GET, POST, PUT, PATCH, and DELETE. The method cannot be omitted and is not inferred from the body. The path must match the public contract shown by api list. Replace path parameters such as {id} with actual resource IDs.

Put queries in a quoted path. Unknown queries and duplicate values supplied in both the path and flags cause errors. For create and update operations with JSON bodies, pass a JSON object through --stdin; it is validated against the API contract’s types and required fields.

Save a JSON object such as { "locale": "ja" } in profile.json. Profile changes require human account authentication and server-side permissions.

Update a profile from saved JSON.

List public contract operations; server authorization still applies

Use saved authentication to return your profile in a JSON envelope.

Retrieve the current principal

Set the X-Workspace-ID sent with the request using --workspace. The server checks access to the specified Workspace.

Retrieve information for a Workspace

Use this for create and update operations with bodies. File redirection and piped JSON are both read as standard input.

Pass a request body from a JSON file

Append a query defined by the target API to the path. Query names, types, and requirements follow the public API contract.

Set the number of list results with a query

For APIs with cursor pagination, output records from every page as one NDJSON record per line. This cannot be combined with --json, --pretty, or --format values such as JSON. Use --output to save a file if needed.

Retrieve every page of a list

Check the deletion target before running the command. --yes skips the CLI confirmation. Server authorization and deletion conditions still apply.

Skip deletion confirmation

--field extracts a response field. It does not add a field to the request body.

Extract a response field

Return the response on stdout and the duration on stderr.

Inspect request duration

The default output is a JSON envelope containing success, data, and metadata. Credential fields are redacted during output. Failure reasons go to stderr; scripts should use exit codes to determine success or failure.

Use orc api list for discovery. The API contract is bundled with the CLI rather than fetched on every execution. External URLs, paths beginning with //, path traversal, and internal or backend-only APIs are rejected. Redirects are not followed.

The following global options can be used with orc api:

For details and examples, see global options.

Check methods and paths with orc api list. Path endings, resource IDs, and methods must also match the contract. Check the CLI version if a new API is missing from the list.

Check authentication and sign in again with orc auth login if needed. If a Workspace is specified, check access to it as well. An operation appearing in the list does not necessarily mean the current account can use it.

Pass a valid JSON object through --stdin and check the target API’s required fields and types. Arrays and individual strings are not accepted as resource definitions. Bodies are used for POST, PUT, and PATCH operations.

DELETE requires confirmation. In scripts, check the target and pass --yes. This does not change operation permissions.