DotID commands¶

fgai manages DotID identity, accounts, and organizations through the same public capability APIs used by the DotID API reference. Each command group maps to one public control-plane surface; per-command authorization is decided by the platform (PLT-0009).

Run fgai <group> --help to list every verb in a group — the list is generated from the installed CLI, so it always matches what your version can do.

Command groups¶

Group	Aliases	What it manages
`account`	`accounts`	Accounts — directory, provisioning, lifecycle (close/suspend/restore), service installations
`org`	`orgs`, `organization`, `organizations`	Organizations — OUs, SCPs, member accounts, invitations, delegations
`identity`	`id`	Identity control plane (resource-nested) — service users, groups, roles, policies, access-key credentials, permission sets, Identity Center, STS, delegations, `authorize`
`quota`		Account & organization quotas — read + request
`audit`		Audit events — your events, account events, event lookup
`developer`	`dev`	Developer service registration, review, credentials, sandbox test users
`service-catalog`	`catalog`	Browse and manage service installations
`passport`		PassPort application launch links & ticket validation

The identity group is resource-nested — fgai identity <resource> <verb>. Run fgai identity --help to list resources (e.g. service-user, group, role, policy, credential, permission-set, sts, authorize).

Examples¶

# Configure a credential, then check it
fgai configure --profile prod-intl --account-id <id> --access-key-id <id> --secret-access-key <secret>
fgai auth status

# Accounts and organizations
fgai account directory --json
fgai org directory --json

# Identity: list an account's service users
fgai identity service-user list --account <account-id> --json

# Evaluate an authorization decision
fgai identity authorize check --body-file decision.json

Every call uses a documented public capability route at api.flexgalaxy.ai, honours the active profile and authentication mode, and prints JSON. The DotID CLI does not call /cli/*, Keycloak Admin APIs, or browser-only console routes; the Account human-user surface is intentionally not exposed (Account owns non-human service users only).