Skip to content

tlm-cli admin

Admin management commands.

tlm-cli admin [SUBGROUP] [COMMAND] [OPTIONS]

Subgroups: customers, users, iam, trials

customers

Commands for managing customers on the ToloMEO Manager platform.

tlm-cli admin customers [COMMAND] [OPTIONS]

customers list

List customers sorted by code.

tlm-cli admin customers list [OPTIONS]

By default returns the first 25 customers. Use --name to narrow results (up to 100).

Option Type Description
--name TEXT string Filter by customer name (fuzzy match).

Example

# List all customers (first 25)
tlm-cli admin customers list

# Filter by name
tlm-cli admin customers list --name "Acme"

customers show

Show details for a customer including its teams and users.

tlm-cli admin customers show CUSTOMER_CODE
Argument Description
CUSTOMER_CODE The customer's unique code.

Example

tlm-cli admin customers show ACME

Output includes:

  • Detail panel: Code, Name
  • Teams table (ID, Name)
  • Users table (ID, Email, First Name, Last Name)

customers create

Create a new customer.

tlm-cli admin customers create --name TEXT --code TEXT [OPTIONS]
Option Type Required Description
--name TEXT string yes Customer name.
--code TEXT string yes Customer code (short identifier).
--dry-run flag no Print the request payload without sending it.

Example

# Create a customer
tlm-cli admin customers create --name "Acme Corporation" --code ACME

# Preview the request
tlm-cli admin customers create --name "Acme Corporation" --code ACME --dry-run

customers update

Update an existing customer's name and code.

tlm-cli admin customers update CUSTOMER_CODE --name TEXT --code TEXT [OPTIONS]
Argument / Option Type Required Description
CUSTOMER_CODE string yes Current customer code to look up.
--name TEXT string yes New customer name.
--code TEXT string yes New customer code.
--dry-run flag no Print the request payload without sending it.

Example

tlm-cli admin customers update ACME --name "Acme Corp" --code ACME2

# Preview the change
tlm-cli admin customers update ACME --name "Acme Corp" --code ACME2 --dry-run

customers delete

Delete a customer and all associated ToloMEO resources.

tlm-cli admin customers delete CUSTOMER_CODE [OPTIONS]

Shows a preview of the customer record, its devices (up to 20), and its users before prompting for confirmation.

Argument / Option Type Required Description
CUSTOMER_CODE string yes Customer code to delete.
--yes / -y flag no Skip the confirmation prompt.
--dry-run flag no Print the resolved customer details without deleting.

Note: For trial tenants, prefer tlm-cli admin trials delete — it also tears down IAM, devices, parts, and firmware in the correct order.

Example

tlm-cli admin customers delete ACME

# Skip confirmation
tlm-cli admin customers delete ACME --yes

# Preview what would be deleted
tlm-cli admin customers delete ACME --dry-run

users

Commands for moving and removing users across customers.

tlm-cli admin users [COMMAND] [OPTIONS]

users move

Move a user to a customer team by email address.

tlm-cli admin users move --email TEXT --to-customer TEXT [OPTIONS]

Resolves the user's platform identity by email (via Ory Kratos), finds the correct team by role within the destination customer, and adds the user to that team.

Option Type Required Description
--email TEXT string yes Email address of the user to move.
--to-customer TEXT string yes Destination customer code.
--role TEXT string no Target team role: admin or end-user (default: end-user).
--dry-run flag no Show resolved IDs without making changes.

Example

# Move a user as end-user (default)
tlm-cli admin users move --email user@acme.com --to-customer ACME

# Move as admin
tlm-cli admin users move --email user@acme.com --to-customer ACME --role admin

# Preview
tlm-cli admin users move --email user@acme.com --to-customer ACME --dry-run

users remove

Remove a user from a customer.

tlm-cli admin users remove CUSTOMER_CODE --email TEXT [OPTIONS]

Resolves the user by email within the customer and removes them.

Argument / Option Type Required Description
CUSTOMER_CODE string yes Customer code.
--email TEXT string yes Email address of the user to remove.
--yes / -y flag no Skip the confirmation prompt.
--dry-run flag no Show resolved IDs without making changes.

Example

tlm-cli admin users remove ACME --email user@acme.com

# Skip confirmation
tlm-cli admin users remove ACME --email user@acme.com --yes

iam

IAM role and policy management for customer tenants.

tlm-cli admin iam [SUBGROUP] [COMMAND] [OPTIONS]

Subgroups: roles, policies

Each customer tenant has one IAM role and one IAM policy per team (e.g. admin, end-user). Roles define what actions team members can perform; policies define which resources they can access.

iam roles

iam roles show

Show IAM roles for a customer tenant.

tlm-cli admin iam roles show CUSTOMER_CODE [OPTIONS]
Argument / Option Type Description
CUSTOMER_CODE string Customer code.
--team TEXT string Filter by team name (e.g. admin, end-user).

Example

# Show all roles for ACME
tlm-cli admin iam roles show ACME

# Show only the end-user role
tlm-cli admin iam roles show ACME --team end-user

Output: one detail panel per role (ID, Name, Customer) followed by an Actions table.

iam roles add-action

Add an action to a customer team's IAM role.

tlm-cli admin iam roles add-action CUSTOMER_CODE TEAM ACTION [OPTIONS]

Fetches the current action list and appends the new action. PUT is a full replacement so all existing actions are preserved.

Argument / Option Type Description
CUSTOMER_CODE string Customer code.
TEAM string Team name (e.g. admin, end-user).
ACTION string Action string to add, e.g. manufacturing:devices:list.
--dry-run flag Print resolved IDs and action count without updating.

Example

tlm-cli admin iam roles add-action ACME admin manufacturing:devices:list
tlm-cli admin iam roles add-action ACME end-user tolomeo:cves:get

iam roles remove-action

Remove an action from a customer team's IAM role.

tlm-cli admin iam roles remove-action CUSTOMER_CODE TEAM ACTION [OPTIONS]
Argument / Option Type Description
CUSTOMER_CODE string Customer code.
TEAM string Team name.
ACTION string Action string to remove.
--dry-run flag Print resolved IDs and remaining action count without updating.

Example

tlm-cli admin iam roles remove-action ACME admin manufacturing:devices:delete

iam policies

iam policies show

Show IAM policies for a customer tenant.

tlm-cli admin iam policies show CUSTOMER_CODE [OPTIONS]
Argument / Option Type Description
CUSTOMER_CODE string Customer code.
--team TEXT string Filter by team name (e.g. admin, end-user).

Example

# Show all policies for ACME
tlm-cli admin iam policies show ACME

# Show only the admin policy
tlm-cli admin iam policies show ACME --team admin

Output: one detail panel per policy (ID, Name, Customer, Members count) followed by a Resources table per statement.

iam policies add-resource

Add a resource to all ALLOW statements in a customer team's IAM policy.

tlm-cli admin iam policies add-resource CUSTOMER_CODE TEAM RESOURCE [OPTIONS]
Argument / Option Type Description
CUSTOMER_CODE string Customer code.
TEAM string Team name.
RESOURCE string Resource string to add, e.g. manufacturing:devices.
--dry-run flag Print resolved IDs without updating.

Example

tlm-cli admin iam policies add-resource ACME admin manufacturing:devices
tlm-cli admin iam policies add-resource ACME end-user tolomeo:cves

iam policies remove-resource

Remove a resource from all statements in a customer team's IAM policy.

tlm-cli admin iam policies remove-resource CUSTOMER_CODE TEAM RESOURCE [OPTIONS]
Argument / Option Type Description
CUSTOMER_CODE string Customer code.
TEAM string Team name.
RESOURCE string Resource string to remove.
--dry-run flag Print resolved IDs without updating.

Example

tlm-cli admin iam policies remove-resource ACME admin manufacturing:devices:delete

trials

Trial tenant management — create and delete fully-configured trial tenants from a TOML manifest.

tlm-cli admin trials [COMMAND] [OPTIONS]

A trial manifest is a TOML file that describes the complete state of a trial tenant: the customer identity, IoT model, firmware, parts, devices, events, cybersecurity projects, users, and IAM configuration. Use trial-manifest.sample.toml in the repository root as a starting point — it documents every section and field inline.

trials create

Create a trial tenant from a TOML manifest.

tlm-cli admin trials create MANIFEST_PATH [OPTIONS]
Argument / Option Type Description
MANIFEST_PATH path Path to the trial manifest TOML file.
--dry-run flag Show what would be done without making any changes.

Creation order:

  1. Customer (ToloMEO) — reuses existing if the code is already taken (with confirmation)
  2. IAM role actions + policy resources per team
  3. IoT model
  4. Firmware (linked to model)
  5. Parts and sub-parts (PMS JSON:API) + model assigned per part
  6. Device provisioning + model assigned per device
  7. Events (public or internal, PMS JSON:API)
  8. Fleet Manager claim for each device
  9. Users moved to the new customer
  10. Cybersecurity project clones — each entry in cybersec_projects is cloned to the specified version and moved under the root project named after the model (created if missing)

Each step is idempotent where possible: already-existing resources are skipped with a warning rather than causing an error.

Example

# Dry run first
tlm-cli admin trials create acme-trial.toml --dry-run

# Create the trial
tlm-cli admin trials create acme-trial.toml

trials delete

Delete a trial tenant and all resources defined in its manifest.

tlm-cli admin trials delete MANIFEST_PATH [OPTIONS]

Always shows a preview of what will be deleted and prompts for confirmation before proceeding.

Argument / Option Type Description
MANIFEST_PATH path Path to the trial manifest TOML file.
--dry-run flag Show what would be deleted without making any changes.

Deletion order (reverse of creation):

  1. Unclaim devices from Fleet Manager
  2. Unprovision devices (removes IoT things + PMS device records)
  3. Delete parts (sub-parts first, then parents)
  4. Delete firmware, then IoT model
  5. Delete customer (ToloMEO cascade removes IAM tenant, teams, and users)

Example

# Preview what would be deleted
tlm-cli admin trials delete acme-trial.toml --dry-run

# Delete with confirmation prompt
tlm-cli admin trials delete acme-trial.toml