CLI reference¶

The fgai command-line interface is a thin, uniform front end over the same public trustmint capability API you can call directly over HTTPS. Every command maps one-to-one to a /<capability>/v1/... endpoint on api.flexgalaxy.ai — the CLI adds nothing the API does not expose, and exposes nothing the API does not.

The trustmint commands ship inside the single fgai binary alongside the other FlexGalaxy.AI tiers. Download it from the releases channel.

Command shape¶

fgai <group> <verb> [--<id> <value> …] [--body <json> | --body-file <path>]

<group> is a capability domain (below), not a service name.
<verb> is the operation within that domain (fgai <group> --help lists them).
Path identifiers are passed as flags (--repository, --id, --thing, …).
Write operations (POST/PUT/PATCH) take a JSON body via --body or --body-file (- reads stdin).
Responses are printed as pretty JSON; a successful empty response prints ok.

Authentication¶

The CLI resolves credentials from your active fgai profile — configure it once with fgai configure. Two credential kinds are supported, matching the two public auth planes:

Credential	Header	Who uses it
Interactive user	`Authorization: Bearer <token>`	tenant users (SSO login)
Access key / secret key	`Authorization: FGAI-HMAC-SHA256 …`	factory & integrator services

See Registration to mint an AK/SK pair and for the FGAI-HMAC signing scheme.

Capability groups¶

Group	Product	What it drives
`provisioning`	ThingMake	registrars, enrollments, access-requests, factory services, thing provisioning/activation lifecycle, async factory result callbacks, state-change feeds, identity blacklist
`registry`	ThingMake	vendor / device-model / software registry
`access`	ThingHub	repositories, scopes, cross-account access grants
`attributes`	ThingIO	device attribute buckets (server / shared / client)
`telemetry`	ThingIO	device telemetry query
`twins`	ThingIO	device twin read + desired-state set
`rules`	ThingLogic	rule authoring (threshold / windowed / deadman) + sink bindings
`pipelines`	ThingLogic	pipeline DAG authoring, validate, deploy, stop
`alarms`	ThingLogic	operator alarm lifecycle (ack / shelve / resolve) for rules bound to the alarm-lifecycle sink
`sinks`	ThingBand	data-sink registry
`connect`	ThingFeed	ingest connect adapters + data streams
`simulation`	ThingLab	virtual-device templates (including publishing and sharing them), instances, profiles, rigs, runs
`pki`	—	public PKI discovery (JWKS, CA chain) — no credential

Run fgai <group> --help for the full verb list of any group.

Examples¶

# List your repositories, then read one
fgai access repositories-list
fgai access repositories-get --repository repo-123

# Approve a pending registrar
fgai provisioning registrars-approve --id reg-9 --body '{"note":"ok"}'

# Query things by attribute (integrator AK/SK) — the filter is required
fgai attributes things-query --body '{"filter":{"match_all":true}}'

# Fetch the public signing keys — no credential required
fgai pki jwks
fgai pki ca

# Publish a ThingLab template's current content, then share the offering with one account
fgai simulation templates-publications --id tmpl-01
fgai simulation templates-audiences --id tmpl-01 --body '{"audience_kind":"account","audience_id":"acc-partner-01"}'

Note

Platform-administration surfaces split by audience: certificate/CA management and cross-account grant governance are console-only for tenant/integrator users, while the operator CLI (fgai-admin, audience platform-operator) carries the gatewayed governance verbs (governance grants-* — see the capability map’s cli_group: governance).