CLI & fgshell command reference¶

Every DotID control-plane operation is available two ways — the fgai CLI and the in-console fgshell — except creating a brand-new root-user account, which stays a browser sign-up flow. Both surfaces call the same control-plane APIs (see CLI authentication); every call is authorization-checked.

For how to authenticate, see CLI authentication.

Command groups (`fgai <group> …`)¶

Group	What it manages
`identity`	Service users, roles, policies, access-key credentials, STS, workload identities, Identity Center workforce users/groups/permission sets/assignments, delegations, authorization checks
`account`	Accounts — provision member accounts, get/update, status (close/reopen/suspend/restore), service installations
`org`	Organizations — OUs, SCPs, member accounts, invitations, service installations, enterprise onboarding (placeholder accounts + lifecycle)
`quota`	Quota scopes, your quotas, and quota requests
`audit`	Your audit events, account events, single event lookup
`developer`	Developer service registration, submission, credentials
`service-catalog`	Browse the catalog and manage installations
`passport`	PassPort application launch links + app-entry routing

Run fgai <group> (or fgai <group> help) to list its subcommands; the identity group is nested one level further: fgai identity <resource> <verb>.

Conventions¶

Path parameters are flags: fgai identity service-user delete --account <id> --user <id>.
Create/update bodies are raw JSON: pass --body '{…}' or --body-file path.json (- reads stdin). Fields follow the API’s snake_case shape.
Output is the API’s JSON response, pretty-printed; an empty (204) response prints ok.

Examples¶

# Identity Center + IAM
fgai identity service-user list --account 3857bedb
fgai identity idc-user list --org 7b39dd74
fgai identity role create --account 3857bedb --body-file role.json
fgai identity credential rotate --account 3857bedb --credential AKIA…
fgai identity sts assume-role --body '{"role_frn":"frn:…:iam:role/Deploy","external_id":"…"}'
fgai identity authorize check --body '{"action":"iam:CreateServiceUser","resource":"frn:…"}'

# Accounts & organizations
fgai account provision --body '{"email":"ops@acme.io","account_name":"acme-prod","ou_id":"Root"}'
fgai org scp-attach --org 7b39dd74 --scp scp-123 --body '{"target_type":"OU","target_id":"ou-1"}'
fgai org invite-create --org 7b39dd74 --body '{"email":"partner@x.io"}'

# Enterprise onboarding — cheap placeholder accounts, materialized on first use
fgai org onboard-accounts --org 7b39dd74 \
  --body '{"ou_node_id":"<ou>","accounts":[{"name":"warehouse-01"},{"name":"warehouse-02"}]}'
fgai org account-lifecycle --org 7b39dd74 --status PLACEHOLDER
fgai org onboard-grant-operator --org 7b39dd74 --account <account>   # -> ACTIVE
fgai org account-lifecycle --org 7b39dd74 --status ACTIVE
fgai org onboard-close --org 7b39dd74 --account <account>            # -> CLOSED
fgai org onboard-purge --org 7b39dd74 --account <account>            # 204 (never-materialized only)

# PassPort — resolve where an app should open for the signed-in principal
fgai passport app-entry-resolve --body '{"appId":"<app>","accountId":"<account>"}'
fgai passport application --app <app>

# Quotas & audit
fgai quota request --body '{"quota_id":"q-1","desired":50}'
fgai audit account-events --account 3857bedb

Enterprise onboarding & account lifecycle¶

fgai org onboard-accounts bulk-creates cheap placeholder accounts under an organization (immediate 202); the expensive per-account setup is deferred until first use — see Provisioning at scale. Each account moves through PLACEHOLDER → MATERIALIZING → ACTIVE, with CLOSED as the terminal teardown state; filter a listing with fgai org account-lifecycle --org <org> --status <STATUS>. The status values and the full row shape are in Account lifecycle status.

Verb	Effect
`onboard-accounts`	Bulk-create placeholder accounts (body `{"ou_node_id":"…","accounts":[{"name":"…"}]}`)
`onboard-grant-operator`	Grant the first operator — moves the account to `ACTIVE`
`onboard-provision-service-user`	Provision the first service user — materializes the account’s realm
`onboard-close`	Transition to terminal `CLOSED` (idempotent)
`onboard-purge`	Hard-delete a never-materialized placeholder (`204`; a materialized account returns `409` — close it instead)

fgshell¶

The same operations are available inside the console shell as dotid <group> [<resource>] <verb> commands, taking the same arguments. fgshell runs each command against the DotID control-plane API using your session identity, so what you can do in fgshell is exactly what your permissions allow — identical to the CLI and console. Mutating commands prompt for confirmation.