CLI & fgshell command reference¶

Every DotID control-plane operation is available two ways — the fgai CLI and the in-console fgshell — except creating a brand-new root-user account, which stays a browser sign-up flow. Both surfaces call the same control-plane APIs (see CLI authentication); every call is authorization-checked.

For how to authenticate, see CLI authentication.

Command groups (`fgai <group> …`)¶

Group	What it manages
`identity`	Service users, roles, policies, access-key credentials, STS, workload identities, Identity Center workforce users/groups/permission sets/assignments, delegations, authorization checks
`account`	Accounts — provision member accounts, get/update, status (close/reopen/suspend/restore), service installations
`org`	Organizations — OUs, SCPs, member accounts, invitations, service installations, enterprise onboarding (placeholder accounts + lifecycle)
`quota`	Quota scopes, your quotas, and quota requests
`audit`	Your audit events, account events, single event lookup
`developer`	Developer service registration, submission, credentials
`service-catalog`	Browse the catalog and manage installations
`passport`	PassPort application launch links + app-entry routing

Run fgai <group> (or fgai <group> help) to list its subcommands; the identity group is nested one level further: fgai identity <resource> <verb>.

Conventions¶

Path parameters are flags: fgai identity service-user delete --account <id> --user <id>.
Create/update bodies are raw JSON: pass --body '{…}' or --body-file path.json (- reads stdin). Fields follow the API’s snake_case shape.
Output is the API’s JSON response, pretty-printed; an empty (204) response prints ok.

Examples¶

# Identity Center + IAM
fgai identity service-user list --account 3857bedb-0a1b-4c2d-8e3f-4a5b6c7d8e9f
fgai identity idc-user list --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b
fgai identity role create --account 3857bedb-0a1b-4c2d-8e3f-4a5b6c7d8e9f --body-file role.json
fgai identity credential rotate --account 3857bedb-0a1b-4c2d-8e3f-4a5b6c7d8e9f --credential AKIA…
fgai identity sts assume-role --body '{"role_frn":"frn:…:iam:role/Deploy","external_id":"…"}'
fgai identity authorize check --body '{"principal":{"account_id":"3857bedb-0a1b-4c2d-8e3f-4a5b6c7d8e9f","user_id":"<user-uuid>","user_type":"iam","ic_session":false},"action":"iam:CreateServiceUser","resource":"frn:3857bedb-0a1b-4c2d-8e3f-4a5b6c7d8e9f:iam:user/*"}'

# Accounts & organizations
fgai account provision --body '{"email":"ops@acme.io","account_name":"acme-prod","ou_id":"Root"}'
fgai org scp-attach --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --scp scp-123 --body '{"target_type":"OU","target_id":"ou-1"}'
fgai org invite-create --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --body '{"email":"partner@x.io"}'

# Enterprise onboarding — cheap placeholder accounts, materialized on first use
fgai org onboard-accounts --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b \
  --body '{"ou_node_id":"<ou>","accounts":[{"name":"warehouse-01"},{"name":"warehouse-02"}]}'
fgai org account-lifecycle --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --status PLACEHOLDER
fgai org onboard-grant-operator --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --account <account>   # -> ACTIVE
fgai org account-lifecycle --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --status ACTIVE
fgai org onboard-close --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --account <account>            # -> CLOSED
fgai org onboard-purge --org 7b39dd74-1f2e-4d3c-9b8a-7c6d5e4f3a2b --account <account>            # 204 (never-materialized only)

# PassPort — resolve where an app should open for the signed-in principal
fgai passport app-entry-resolve --body '{"appId":"<app>","accountId":"<account>"}'
fgai passport application --app <app>

# Quotas & audit
fgai quota request --body '{"quota_id":"q-1","desired":50}'
fgai audit account-events --account 3857bedb-0a1b-4c2d-8e3f-4a5b6c7d8e9f \
  --from 2026-10-01T00:00:00Z --to 2026-10-10T23:59:59Z

Path parameters are account and organization UUIDs — the API rejects shortened ids as malformed, so use the full form everywhere.

Enterprise onboarding & account lifecycle¶

fgai org onboard-accounts bulk-creates cheap placeholder accounts under an organization (immediate 202); the expensive per-account setup is deferred until first use — see Provisioning at scale. Each account moves through PLACEHOLDER → MATERIALIZING → ACTIVE, with CLOSED as the terminal teardown state; filter a listing with fgai org account-lifecycle --org <org> --status <STATUS>. The status values and the full row shape are in Account lifecycle status.

Verb	Effect
`onboard-accounts`	Bulk-create placeholder accounts (body `{"ou_node_id":"…","accounts":[{"name":"…"}]}`)
`onboard-grant-operator`	Grant the first operator — moves the account to `ACTIVE`
`onboard-provision-service-user`	Provision the first service user — materializes the account’s realm
`onboard-close`	Transition to terminal `CLOSED` (idempotent)
`onboard-purge`	Hard-delete a never-materialized placeholder (`204`; a materialized account returns `409` — close it instead)

fgshell¶

The same operations are available inside the console shell as dotid <group> [<resource>] <verb> commands, taking the same arguments. fgshell runs each command against the DotID control-plane API using your session identity, so what you can do in fgshell is exactly what your permissions allow — identical to the CLI and console. Mutating commands prompt for confirmation.