# opal

Opal allows you to centrally manage access to all of your sensitive systems.

[![oclif](https://img.shields.io/badge/cli-oclif-brightgreen.svg)](https://oclif.io)
[![Version](https://img.shields.io/npm/v/opal.svg)](https://npmjs.org/package/opal-security)
[![CircleCI](https://circleci.com/gh/cli/opal/tree/master.svg?style=shield)](https://circleci.com/gh/cli/opal/tree/master)
[![Downloads/week](https://img.shields.io/npm/dw/opal.svg)](https://npmjs.org/package/opal-security)
[![License](https://img.shields.io/npm/l/opal.svg)](https://github.com/cli/opal/blob/master/package.json)

<!-- toc -->
* [opal](#opal)
* [Usage](#usage)
* [Commands](#commands)
<!-- tocstop -->

# Usage

<!-- usage -->
```sh-session
$ npm install -g opal-security
$ opal COMMAND
running command...
$ opal (--version)
opal-security/5.1.2 darwin-arm64 node-v18.20.4
$ opal --help [COMMAND]
USAGE
  $ opal COMMAND
...
```
<!-- usagestop -->

# Commands

<!-- commands -->
* [`opal autocomplete [SHELL]`](#opal-autocomplete-shell)
* [`opal aws identity`](#opal-aws-identity)
* [`opal clear-auth-config`](#opal-clear-auth-config)
* [`opal curl-example`](#opal-curl-example)
* [`opal groups get`](#opal-groups-get)
* [`opal help [COMMANDS]`](#opal-help-commands)
* [`opal iam-roles start`](#opal-iam-roles-start)
* [`opal kube-roles start`](#opal-kube-roles-start)
* [`opal login`](#opal-login)
* [`opal logout`](#opal-logout)
* [`opal postgres-instances start`](#opal-postgres-instances-start)
* [`opal request create`](#opal-request-create)
* [`opal request get`](#opal-request-get)
* [`opal request list`](#opal-request-list)
* [`opal request ls`](#opal-request-ls)
* [`opal resources get`](#opal-resources-get)
* [`opal set-auth-config`](#opal-set-auth-config)
* [`opal set-custom-header`](#opal-set-custom-header)
* [`opal set-token`](#opal-set-token)
* [`opal set-url [URL]`](#opal-set-url-url)
* [`opal ssh copyFrom`](#opal-ssh-copyfrom)
* [`opal ssh copyTo`](#opal-ssh-copyto)
* [`opal ssh start`](#opal-ssh-start)
* [`opal version`](#opal-version)
* [`opal whoami`](#opal-whoami)

## `opal autocomplete [SHELL]`

display autocomplete installation instructions

```
USAGE
  $ opal autocomplete [SHELL] [-r]

ARGUMENTS
  SHELL  shell type

FLAGS
  -r, --refresh-cache  Refresh cache (ignores displaying instructions)

DESCRIPTION
  display autocomplete installation instructions

EXAMPLES
  $ opal autocomplete

  $ opal autocomplete bash

  $ opal autocomplete zsh

  $ opal autocomplete --refresh-cache
```

_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v1.4.6/src/commands/autocomplete/index.ts)_

## `opal aws identity`

Gets the current caller identity for the "opal" AWS profile.

```
USAGE
  $ opal aws identity [-h]

FLAGS
  -h, --help  Show CLI help.

DESCRIPTION
  Gets the current caller identity for the "opal" AWS profile.

EXAMPLES
  $ opal aws:identity
```

_See code: [src/commands/aws/identity.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/aws/identity.ts)_

## `opal clear-auth-config`

Clear all authentication configuration values

```
USAGE
  $ opal clear-auth-config

DESCRIPTION
  Clear all authentication configuration values

EXAMPLES
  $ opal clear-auth-config
```

_See code: [src/commands/clear-auth-config.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/clear-auth-config.ts)_

## `opal curl-example`

Prints out an example cURL command containing the parameters the CLI uses to query the Opal server.

```
USAGE
  $ opal curl-example [-h]

FLAGS
  -h, --help  Show CLI help.

DESCRIPTION
  Prints out an example cURL command containing the parameters the CLI uses to query the Opal server.
```

_See code: [src/commands/curl-example.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/curl-example.ts)_

## `opal groups get`

Get group info for a particular group.

```
USAGE
  $ opal groups get [-h] [-i <value>]

FLAGS
  -h, --help        Show CLI help.
  -i, --id=<value>  The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]

DESCRIPTION
  Get group info for a particular group.

EXAMPLES
  $ opal groups:get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4
```

_See code: [src/commands/groups/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/groups/get.ts)_

## `opal help [COMMANDS]`

Display help for opal.

```
USAGE
  $ opal help [COMMANDS...] [-n]

ARGUMENTS
  COMMANDS...  Command to show help for.

FLAGS
  -n, --nested-commands  Include all nested commands in the output.

DESCRIPTION
  Display help for opal.
```

_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/v5.2.20/src/commands/help.ts)_

## `opal iam-roles start`

Starts a session to assume an IAM role.

```
USAGE
  $ opal iam-roles start [-h] [-i <value>] [--openBrowser] [--profileName <value>]

FLAGS
  -h, --help                 Show CLI help.
  -i, --id=<value>           The Opal ID of the asset. You can find this from the URL, e.g.
                             https://opal.dev/resources/[ID]
      --openBrowser          Automatically open the browser without prompting for confirmation.
      --profileName=<value>  Uses a custom AWS profile name for the IAM role. Default value is the role's name.

DESCRIPTION
  Starts a session to assume an IAM role.

EXAMPLES
  $ opal iam-roles:start

  $ opal iam-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398

  $ opal iam-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --profileName "custom-profile"
```

_See code: [src/commands/iam-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/iam-roles/start.ts)_

## `opal kube-roles start`

Starts a session to assume a Kubernetes cluster IAM role.

```
USAGE
  $ opal kube-roles start [-h] [-i <value>] [-a <value>] [--openBrowser]

FLAGS
  -a, --accessLevelRemoteId=<value>  The remote ID of the access level with which to access the resource.
  -h, --help                         Show CLI help.
  -i, --id=<value>                   The Opal ID of the asset. You can find this from the URL, e.g.
                                     https://opal.dev/resources/[ID]
      --openBrowser                  Automatically open the browser without prompting for confirmation.

DESCRIPTION
  Starts a session to assume a Kubernetes cluster IAM role.

EXAMPLES
  $ opal kube-roles:start

  $ opal kube-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398

  $ opal kube-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --accessLevelRemoteId "arn:aws:iam::712234975475:role/acme-eks-cluster-admin-role"
```

_See code: [src/commands/kube-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/kube-roles/start.ts)_

## `opal login`

Authenticates you with the Opal server.

```
USAGE
  $ opal login [-h] [--email <value>] [--openBrowser]

FLAGS
  -h, --help           Show CLI help.
      --email=<value>  Email address to login with.
      --openBrowser    Automatically open the browser without prompting for confirmation.

DESCRIPTION
  Authenticates you with the Opal server.

EXAMPLES
  $ opal login
```

_See code: [src/commands/login.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/login.ts)_

## `opal logout`

Clears locally stored Opal server authentication credentials.

```
USAGE
  $ opal logout [-h]

FLAGS
  -h, --help  Show CLI help.

DESCRIPTION
  Clears locally stored Opal server authentication credentials.

EXAMPLES
  $ opal logout
```

_See code: [src/commands/logout.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/logout.ts)_

## `opal postgres-instances start`

Starts a session to connect to a Postgres database.

```
USAGE
  $ opal postgres-instances start [-h] [-i <value>] [-a <value>] [--openBrowser] [--action open|psql|view]

FLAGS
  -a, --accessLevelRemoteId=<value>  The remote ID of the access level with which to access the resource.
  -h, --help                         Show CLI help.
  -i, --id=<value>                   The Opal ID of the asset. You can find this from the URL, e.g.
                                     https://opal.dev/resources/[ID]
      --action=<option>              Method of connecting to the database.
                                     - open: Open external database app
                                     - psql: Start psql session in shell
                                     - view: View connection configuration details
                                     <options: open|psql|view>
      --openBrowser                  Automatically open the browser without prompting for confirmation.

DESCRIPTION
  Starts a session to connect to a Postgres database.

EXAMPLES
  $ opal postgres-instances:start

  $ opal postgres-instances:start --id 51f7176b-0464-4a6f-8369-e951e187b398

  $ opal postgres-instances:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --accessLevelRemoteId fullaccess

  $ opal postgres-instances:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --accessLevelRemoteId fullaccess --action view
```

_See code: [src/commands/postgres-instances/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/postgres-instances/start.ts)_

## `opal request create`

Creates an Opal access request via an interactive form

```
USAGE
  $ opal request create [-h] [-a <value>...] [-r <value>] [-d <value>] [-t <value>] [-b <value>]

FLAGS
  -a, --assets=<value>...  The ids of the assets (resource, group) to request access to. Append a role name using a
                           colon if needed, e.g. `--assets 123:456`.
                           If not provided, an interactive selection flow will be available to select assets to request.
  -b, --bundle=<value>     A bundle ID to create a new request based on the assets in the bundle.
  -d, --duration=<value>   The duration of access for the request in minutes. Pass in a 0 value for permanent access. If
                           not provided, you will be prompted.
  -h, --help               Show CLI help.
  -r, --reason=<value>     The reason for the request, contained in quotes. If not provided, you will be prompted.
  -t, --template=<value>   A request ID of a previously finished request (cancelled/denied/approved) to create a new
                           request based on the completed request.

DESCRIPTION
  Creates an Opal access request via an interactive form
```

_See code: [src/commands/request/create.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/request/create.ts)_

## `opal request get`

Fetch details of an access request by request ID

```
USAGE
  $ opal request get [-h] [-i <value>] [-v]

FLAGS
  -h, --help        Show CLI help.
  -i, --id=<value>  The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]
  -v, --verbose     Enable verbose output, prints full response in JSON format. Defaults to false.

DESCRIPTION
  Fetch details of an access request by request ID

EXAMPLES
  $ opal request get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4

  $ opal request get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4 --verbose
```

_See code: [src/commands/request/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/request/get.ts)_

## `opal request list`

Lists your n recent outgoing access requests

```
USAGE
  $ opal request list [-h] [-n <value>] [-p] [-v]

FLAGS
  -h, --help       Show CLI help.
  -n, --n=<value>  [default: 10] Defines number of requests to be returned. 1 <= n <= 100.
  -p, --pending    Show only pending requests. Defaults to false.
  -v, --verbose    Enable verbose output, prints full response in JSON format. Defaults to false.

DESCRIPTION
  Lists your n recent outgoing access requests

ALIASES
  $ opal request ls

EXAMPLES
  $ opal request list --n 5

  $ opal request list --n 5 --pending

  $ opal request list --n 5 --verbose

  $ opal request list --n 5 --pending --verbose
```

_See code: [src/commands/request/list.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/request/list.ts)_

## `opal request ls`

Lists your n recent outgoing access requests

```
USAGE
  $ opal request ls [-h] [-n <value>] [-p] [-v]

FLAGS
  -h, --help       Show CLI help.
  -n, --n=<value>  [default: 10] Defines number of requests to be returned. 1 <= n <= 100.
  -p, --pending    Show only pending requests. Defaults to false.
  -v, --verbose    Enable verbose output, prints full response in JSON format. Defaults to false.

DESCRIPTION
  Lists your n recent outgoing access requests

ALIASES
  $ opal request ls

EXAMPLES
  $ opal request list --n 5

  $ opal request list --n 5 --pending

  $ opal request list --n 5 --verbose

  $ opal request list --n 5 --pending --verbose
```

## `opal resources get`

Get resource info for a particular resource.

```
USAGE
  $ opal resources get [-h] [-i <value>]

FLAGS
  -h, --help        Show CLI help.
  -i, --id=<value>  The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]

DESCRIPTION
  Get resource info for a particular resource.

EXAMPLES
  $ opal resources:get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4
```

_See code: [src/commands/resources/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/resources/get.ts)_

## `opal set-auth-config`

Set authentication configuration values

```
USAGE
  $ opal set-auth-config [--organizationID <value>] [--clientID <value>] [--issuerUrl <value>]

FLAGS
  --clientID=<value>        OIDC client ID for authentication
  --issuerUrl=<value>       OIDC issuer URL for authentication
  --organizationID=<value>  Organization ID for authentication

DESCRIPTION
  Set authentication configuration values

EXAMPLES
  $ opal set-auth-config --clientID=abc123

  $ opal set-auth-config --organizationID=org-456

  $ opal set-auth-config --issuerUrl=https://auth.example.com

  $ opal set-auth-config --clientID=abc123 --issuerUrl=https://auth.example.com

  $ opal set-auth-config --organizationID=org-456 --clientID=abc123 --issuerUrl=https://auth.example.com
```

_See code: [src/commands/set-auth-config.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/set-auth-config.ts)_

## `opal set-custom-header`

Sets a custom HTTP header to connect to the Opal server.

```
USAGE
  $ opal set-custom-header [-h] [--header <value>]

FLAGS
  -h, --help            Show CLI help.
  --header=<value>

DESCRIPTION
  Sets a custom HTTP header to connect to the Opal server.

EXAMPLES
  $ opal set-custom-header --header 'cf-access-token: $TOKEN'
```

_See code: [src/commands/set-custom-header.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/set-custom-header.ts)_

## `opal set-token`

Sets an API token to authenticate with the Opal server - alternative auth flow for headless environments.

```
USAGE
  $ opal set-token [-h]

FLAGS
  -h, --help  Show CLI help.

DESCRIPTION
  Sets an API token to authenticate with the Opal server - alternative auth flow for headless environments.

EXAMPLES
  $ opal set-token
```

_See code: [src/commands/set-token.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/set-token.ts)_

## `opal set-url [URL]`

Sets the url of the Opal server. Defaults to https://app.opal.dev.

```
USAGE
  $ opal set-url [URL] [-h] [--allowSelfSignedCerts]

ARGUMENTS
  URL  URL of the Opal server to use. If unspecified, defaults to https://app.opal.dev

FLAGS
  -h, --help                  Show CLI help.
  --allowSelfSignedCerts

DESCRIPTION
  Sets the url of the Opal server. Defaults to https://app.opal.dev.

EXAMPLES
  $ opal set-url
```

_See code: [src/commands/set-url.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/set-url.ts)_

## `opal ssh copyFrom`

Use SCP to copy files from a compute instance.

```
USAGE
  $ opal ssh copyFrom --src <value> [-h] [--dest <value>] [--user <value>] [-i <value>] [--openBrowser]

FLAGS
  -h, --help          Show CLI help.
  -i, --id=<value>    The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]
      --dest=<value>  [default: .] The directory you want your files to be copied to.
      --openBrowser   Automatically open the browser without prompting for confirmation.
      --src=<value>   (required) The directory or file you would like to copy over SCP. Note we only support one file or
                      directory at a time.
      --user=<value>  [default: ssm-user] The user you want to run SCP over. Keep in mind not all users will have access
                      to each other's home directory.

DESCRIPTION
  Use SCP to copy files from a compute instance.

EXAMPLES
  $ opal ssh:copyFrom --src instance/dir --dest my/dir

  $ opal ssh:copyFrom --src instance/dir --dest my/dir --id 51f7176b-0464-4a6f-8369-e951e187b398
```

_See code: [src/commands/ssh/copyFrom.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/ssh/copyFrom.ts)_

## `opal ssh copyTo`

Use SCP to copy files to a compute instance.

```
USAGE
  $ opal ssh copyTo --src <value> [-h] [--dest <value>] [--user <value>] [-i <value>] [--openBrowser]

FLAGS
  -h, --help          Show CLI help.
  -i, --id=<value>    The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]
      --dest=<value>  [default: .] The directory you want your files to be copied to.
      --openBrowser   Automatically open the browser without prompting for confirmation.
      --src=<value>   (required) The directory or file you would like to copy over SCP. Note we only support one file or
                      directory at a time.
      --user=<value>  [default: ssm-user] The user you want to run SCP over. Keep in mind not all users will have access
                      to each other's home directory.

DESCRIPTION
  Use SCP to copy files to a compute instance.

EXAMPLES
  $ opal ssh:copyTo --src my/dir --dest instance/dir

  $ opal ssh:copyTo --src my/dir --dest instance/dir --id 51f7176b-0464-4a6f-8369-e951e187b398
```

_See code: [src/commands/ssh/copyTo.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/ssh/copyTo.ts)_

## `opal ssh start`

Starts an SSH session to access a compute instance.

```
USAGE
  $ opal ssh start [-h] [-i <value>] [--openBrowser]

FLAGS
  -h, --help         Show CLI help.
  -i, --id=<value>   The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]
      --openBrowser  Automatically open the browser without prompting for confirmation.

DESCRIPTION
  Starts an SSH session to access a compute instance.

EXAMPLES
  $ opal ssh:start

  $ opal ssh:start --id 51f7176b-0464-4a6f-8369-e951e187b398
```

_See code: [src/commands/ssh/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/ssh/start.ts)_

## `opal version`

```
USAGE
  $ opal version [--json] [--verbose]

FLAGS
  --verbose  Show additional information about the CLI.

GLOBAL FLAGS
  --json  Format output as json.

FLAG DESCRIPTIONS
  --verbose  Show additional information about the CLI.

    Additionally shows the architecture, node version, operating system, and versions of plugins that the CLI is using.
```

_See code: [@oclif/plugin-version](https://github.com/oclif/plugin-version/blob/v2.2.27/src/commands/version.ts)_

## `opal whoami`

Describes current url set, organization name, and logged in user if applicable.

```
USAGE
  $ opal whoami [-h]

FLAGS
  -h, --help  Show CLI help.

DESCRIPTION
  Describes current url set, organization name, and logged in user if applicable.
```

_See code: [src/commands/whoami.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.2/src/commands/whoami.ts)_
<!-- commandsstop -->