CLI reference

helm7 whoami [options]

Show the organisation, member, scopes and budget this key speaks with.

Returns the organisation, the member this key speaks as, its scopes, its capability flags, and, for an agent key, its budget and expiry. Call this first: a key resolves to a member and cannot exceed what that member can do, so this tells you your real ceiling before you plan anything.

scopes: product:read

helm7 init <name> [options]

Create a Product, the unit everything else belongs to.

A Product is the unit everything else hangs from: environments, services, databases, auth, storage, domains, secrets and context. Creating one provisions nothing billable on its own: it is the empty graph. Pass external_ref to make this idempotent against your own identifiers.

<name>required

Human-readable Product name.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 deploy [options]

Build the current commit and swap traffic to it once it is healthy.

Builds the current commit and swaps traffic to it once health checks pass. The previous deployment is kept and can be restored with deployment_rollback. Returns immediately with a deployment id; poll deployment_get for progress. Through MCP a build from a repository is built on your own machine by default, so it never waits in Helm7's build queue: nothing builds until you run the `local_build.command` in the response (the CLI builds, uploads and starts it) in a shell with Docker and the repository. If you have no shell or Docker, call deploy again with `build: "remote"`, which replaces it and builds on Helm7 (use build_queue_get to see how long the queue is).

Also takes --dry-run, --confirm and --idempotency-key.

scopes: deployment:write

helm7 queue [options]

Where your builds are in the build queue, and how many are ahead of them.

Your workspace's builds that are running or waiting for a build slot, in the order they will run, with each one's place in the whole queue and how many builds start before it. Builds from other workspaces are counted but never named. Higher plans start ahead of lower ones, by a head start that is reported as head_start_minutes. typical_build_seconds is the median of your recent builds, or null until you have some. A deploy that builds on your own machine never appears here.

scopes: deployment:read

helm7 queue first <deploymentId> [options]

Run one of your waiting builds before your others. It cannot pass another workspace.

Puts your own waiting builds in a new order. The ids you list run first, in that order; your other waiting builds follow in the order they already had. It only rearranges the places your workspace already holds in the queue, so it can never put a build ahead of another workspace's, and your earliest place stays your earliest place. A build that has started cannot be moved: it is reported as not waiting. Returns the queue as it stands afterwards.

<deploymentId>required

A waiting deployment, from `helm7 queue`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: deployment:write

helm7 queue order [options]

Put your waiting builds in an exact order. Builds you leave out follow, as they were.

Puts your own waiting builds in a new order. The ids you list run first, in that order; your other waiting builds follow in the order they already had. It only rearranges the places your workspace already holds in the queue, so it can never put a build ahead of another workspace's, and your earliest place stays your earliest place. A build that has started cannot be moved: it is reported as not waiting. Returns the queue as it stands afterwards.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: deployment:write

helm7 settings [options]

Workspace settings: plan, spend cap, where deploys build, and what happens to helm7.app addresses.

The workspace this key belongs to: its name, plan, spend cap, whether it is a trial and when it expires, and what it is committed to spend this month across every Product. Call this before planning anything large.

scopes: billing:read

helm7 settings set [options]

Rename the workspace, set its spend cap, change where deploys build by default, or whether services keep their helm7.app address.

Changes the workspace name, its monthly spend cap, where deploys build by default, or whether services keep their helm7.app address. The spend cap is checked against every cost-impacting change, whoever or whatever makes it; set budget_usd to null to remove it. default_build_mode is where a deploy builds when the caller does not say: local on the machine running the CLI, remote in the platform's build queue. A deploy from somewhere that cannot build (the dashboard, a push to GitHub, the hosted MCP server) always builds remotely. keep_app_domain decides whether a service keeps answering on its helm7.app address once a custom domain is serving it; off by default, so the custom domain replaces it. Turn it on to keep helm7.app as a staging address.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: billing:manage

helm7 db create [options]

Provision Postgres and set DATABASE_URL on the environment.

Creates a Postgres database, at the major version the region runs, with pgvector available, and sets DATABASE_URL on the environment. Connections are pooled; use the pooled URL for serverless-style workloads and the direct URL for migrations.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: database:write

helm7 auth enable [options]

Turn on managed auth. Supabase-compatible, so an existing app moves by changing its URL and key.

Starts a GoTrue auth service (the engine behind Supabase Auth) against the Product database, on its own hostname, and sets AUTH_URL, AUTH_ANON_KEY, AUTH_SERVICE_ROLE_KEY, AUTH_JWT_SECRET and AUTH_SITE_URL on the environment. supabase-js and @supabase/ssr work against it unchanged: pass AUTH_URL (an origin, no path) and AUTH_ANON_KEY. Sign-in email goes out through Helm7, so nothing needs configuring for it. Calling it again on an environment whose auth is recorded but not running starts the missing container and keeps every key already in use; it never rotates a key. The record only reads available once the container passes its health check.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 auth status [options]

Show managed auth: health, URL, settings and how many users it holds.

The state of the auth service for one environment: whether its container is healthy right now, the URL apps use, its non-secret configuration, and how many users and identities it holds. The counts are how a migration proves every user arrived. No secret, key or password hash is ever returned; secret_list shows which variables exist.

scopes: product:read

helm7 auth update [options]

Change how auth behaves: redirect URLs, sign-up, providers, password length, token lifetimes.

Changes how the auth service behaves: the site URL and the allow-list of redirect URLs, whether email needs confirming, whether new sign-ups are closed, whether anonymous sign-ins are allowed, which OAuth providers are on (Google and GitHub, with their client id and secret, stored as secrets and never returned), the minimum password length, how long access tokens last and how refresh tokens rotate. Only the fields you send change. The service restarts on the new settings with the old one serving until the new one is healthy. Signed-in users are not signed out. A field this operation does not have is refused by name, not ignored.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 auth import [options]

Import users, with their password hashes, from a JSON file. Idempotent on user id.

Upserts a batch of users, with their provider identities, into the auth schema of the Product database, keeping each id, email, password hash, confirmation time, timestamps and metadata, so nobody has to reset a password. Hashes must be bcrypt ($2a$, $2b$, $2y$) or argon2 ($argon2i$, $argon2id$); scrypt and anything else is refused, naming the row. Idempotent on id: running a batch twice changes nothing the second time. Up to 200 users per call. Hashes are never logged and never returned; the response carries counts only. Compare them with auth_get to verify a migration.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: database:write

helm7 domain add <hostname> [options]

Attach a custom domain and issue its certificate.

Binds a domain to a web service and issues a certificate. Returns the DNS record to create; the certificate is issued once that record resolves, usually within a minute. Until then the domain is listed as pending, which is not an error. A name under a domain (app.example.com, www.example.com) takes a CNAME. A bare domain (example.com) takes an A record to a fixed address and, by default, redirects to www.example.com, which is attached with it if it is not already; this works at any DNS provider. Pass serve: true to answer on the bare domain itself instead of redirecting, for a site whose address people know without the www, or a webhook or API that calls it (a redirect drops the body of a POST for clients that do not follow it).

<hostname>required

Fully qualified, e.g. app.example.com. A bare domain (example.com) gets an A record and redirects to www unless --serve is given.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: domain:write

helm7 logs [options]

Recent stdout and stderr for a service. Redaction is best effort, not a guarantee.

Recent stdout and stderr for a service. Secrets are redacted on a best-effort basis before the logs leave the platform; treat redaction as a safety net, not a guarantee.

scopes: deployment:read

helm7 rollback <deploymentId> [options]

Move traffic back to an earlier deployment. Does NOT revert database migrations.

Moves traffic back to an earlier deployment. The image already exists, so this is a traffic swap and takes seconds. It does not revert database migrations. If the newer deployment migrated the schema, roll that back yourself first.

<deploymentId>required

Deployment to roll back to.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: deployment:write

helm7 env set <KEY=VALUE> [options]

Set an environment variable. Values are never readable again, by design.

Sets or replaces a variable for an environment. Values are encrypted at rest and are never returned by any read endpoint, including this one. Only names and a fingerprint come back. Services pick up the change on their next deployment.

<KEY=VALUE>required

The variable and its value.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: secret:write

helm7 product inspect <productId> [options]

The whole resource graph for one Product.

The whole resource graph for one Product: environments, services, databases, domains, secrets (names only, never values), context linkage and current health. This is the single call to make before reasoning about a Product.

<productId>required

Product to inspect.

scopes: product:read

helm7 usage [options]

Spend to date, the month-end projection, and the budget remaining.

This month's spend, measured hourly from what actually ran, broken down by Product and resource; the projection to month end at what is running now; what the workspace as it stands would cost over a whole month; and the budget remaining if one is set. Read this before creating anything expensive.

scopes: billing:read

helm7 product list [options]

Every Product in the workspace.

Every Product in the organisation this key belongs to, newest first. Returns a summary per Product (id, name, region, environments and health), not the full graph; call product_get for that. A key confined to a single Product sees only that one.

scopes: product:read

helm7 product rename <productId> <name> [options]

Rename a Product. Its addresses and ids stay the same.

Changes the name a Product is shown under: the dashboard, the sender name on its auth emails and the activity trail. Addresses do not change. Its helm7.app hostnames, image names and ids stay exactly as they were, so nothing already deployed or pointed at it moves. A Contextely product created by context_enable keeps the name it was given then.

<productId>required

Product to rename.

<name>required

The new name, up to 64 characters.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 product delete <productId> [options]

Delete a Product and everything in it: services, databases, storage and domains. It cannot be undone.

Destroys every environment, service, database, bucket and domain binding under the Product. Databases are backed up first and the backup is retained for 7 days, but the running resources are gone. Requires confirm: true; without it you get the plan and nothing happens.

<productId>required

Product to delete.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:delete

helm7 product connect [options]

Deploy a Product from a repository on every push to its production branch.

Connects a repository the GitHub App can see to a Product. Every push to the production branch then builds and deploys, recorded as triggered by the push. Private repositories are cloned with a short-lived token that is never stored.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 repos [options]

Repositories the Helm7 GitHub App can see, or the link to install it when it is not installed yet.

Repositories the workspace has given the Helm7 GitHub App access to, most recently pushed first, with their default branch and whether they are private. When the app is not installed yet, says so and returns the link a person follows to install it.

scopes: product:read

helm7 environment list [options]

The environments a Product has: production, and any preview or development.

Environments in a Product, each with a summary of the services, databases and domains bound to it. Every Product has production; preview and development exist only if created. Use this to find an environment name before calling anything scoped to one.

scopes: product:read

helm7 environment create <name> [options]

Add a preview or development environment. It starts empty and does not copy production data.

Adds preview or development alongside production. A new environment starts empty; it does not copy production data. Use database_branch for that, when you want a copy.

<name>required

preview or development.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 environment delete <name> [options]

Delete a preview or development environment and everything in it. Production cannot be deleted.

Stops every service in a preview or development environment and removes its databases, buckets, domains and variables. Production cannot be deleted this way; delete the Product instead. Requires confirm: true.

<name>required

preview or development.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:delete

helm7 service list [options]

The services in a Product: web, worker and cron.

Every service in a Product with its kind, instance size, whether it sleeps, its status, the deployment it is running and the address it answers on. Filter by environment. Use this to find a service id before reading its logs or changing it.

scopes: product:read

helm7 service create <name> [options]

Add a web, worker or cron service, built from a repository or run from an image.

Adds a web, worker or cron service. Helm7 detects the framework from the repo and picks a build; you only need to override when detection is wrong. A service has no execution time limit, so long jobs do not need splitting.

<name>required

Service name.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write, deployment:write

helm7 service update <serviceId> [options]

Change a service: size, source, schedule, published ports, or pause and resume it.

Changes the instance size, the branch or directory it builds from, whether pushes that miss that directory skip the build, the image, the schedule of a cron service, or pauses it. Size and pause take effect at once on a running service; source changes take effect on the next deploy. Returns a costed plan, because a bigger instance costs more.

<serviceId>required

Service to change, from `helm7 service list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write, deployment:write

helm7 service delete <serviceId> [options]

Delete a service and its deployments. It cannot be undone.

Stops the service and removes it with its deployment history. Domains pointing at it are detached. Databases and variables in the environment are not touched. Requires confirm: true.

<serviceId>required

Service to delete.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:delete

helm7 deployment list [options]

Deployments for a Product, newest first.

Deployment history for a Product, newest first, with status, commit and timing for each. History is immutable and nothing is pruned, so this is the reliable way to find the last deployment that was healthy before rolling back to it.

scopes: deployment:read

helm7 deployment inspect <deploymentId> [options]

One deployment: its state, commit, build mode and the health checks it passed.

Status, timing, commit, build logs and, when a deployment failed, the specific reason, extracted rather than left for you to find in the log tail.

<deploymentId>required

Deployment to read.

scopes: deployment:read

helm7 db inspect <databaseId> [options]

A database: size, extensions, connections and backup state.

Size, extensions, connection counts and backup state. Connection strings are returned only to a key carrying database:read, and the password is shown only on creation.

<databaseId>required

Database to read, from `helm7 product inspect`.

scopes: database:read

helm7 db backup <databaseId> [options]

Take a backup now, on top of the daily ones. Kept for 7 days.

Takes a backup now, on top of the daily ones paid plans get. Kept 7 days. Returns a backup id usable with database_restore.

<databaseId>required

Database to back up.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: database:write

helm7 db restore <databaseId> [options]

Restore from a backup or to a point in time. This replaces the current contents unless --into-new-database is given.

Restores from a backup id or to a timestamp. This REPLACES the current database contents: everything written after the restore point is lost. Requires confirm: true. Restore into a fresh database first if you are not certain.

<databaseId>required

Database to restore.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: database:write

helm7 db query <databaseId> [sql] [options]

Run one read-only SQL statement and print the rows. SQL is an argument, "-" for standard input, or --file.

Runs one read-only SQL statement (SELECT, WITH, VALUES or TABLE) against a Product's database and returns the rows as JSON. It runs as the Product's own database role inside a READ ONLY transaction with a 15 second timeout, so it cannot change anything and cannot see another Product's data. At most `limit` rows come back (default 100, maximum 1000); `truncated` says whether there were more. Use it to inspect schema (information_schema.columns) and data before deciding on a change, then database_execute to change it. Reads are not audited.

<databaseId>required

Database to query.

<sql>

One SELECT, WITH, VALUES or TABLE statement, or "-" to read it from standard input.

scopes: database:read

helm7 db execute <databaseId> [sql] [options]

Run a SQL script that changes data or schema, in one transaction. --dry-run runs it and rolls it back.

Runs a SQL script (INSERT, UPDATE, DELETE, DDL, several statements) against a Product's database as the Product's own database role, in one transaction: if any statement fails nothing is kept. `dry_run: true` really runs the script and then rolls it back, so you learn whether it would succeed and, through a final SELECT or a RETURNING clause, what it would produce, without changing anything. Applying requires `confirm: true` because a bad UPDATE cannot be undone: take a database_backup first when the change is large. Row counts are not reported; end with a RETURNING clause or a SELECT count(*) when you need one. Transaction control (BEGIN, COMMIT, ROLLBACK, SAVEPOINT) is refused because the script already is one transaction. The first 500 characters of the SQL are kept in the audit trail, so keep secrets out of it; use secret_set for those.

<databaseId>required

Database to change.

<sql>

One or more statements, or "-" to read them from standard input.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: database:write

helm7 bucket list [options]

Storage buckets in a Product.

Buckets in a Product, each with its environment, whether it is public, its size and the S3-compatible name to address it by. Objects themselves are listed through the S3 API, not here.

scopes: product:read

helm7 bucket create <name> [options]

Create an S3-compatible storage bucket.

S3-compatible object storage with no egress charge. The API is Supabase Storage compatible, so supabase-js storage calls work unchanged.

<name>required

Bucket name.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:write

helm7 bucket delete <bucketId> [options]

Delete a storage bucket and every object in it. It cannot be undone.

Removes the bucket and everything stored in it. There is no recycle bin. Requires confirm: true.

<bucketId>required

Bucket to delete, from `helm7 bucket list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: product:delete

helm7 domain list [options]

Domains attached to a Product, and whether their certificates are issued.

Domains bound to a Product, with certificate status and the DNS record each one expects.

scopes: domain:read

helm7 domain remove <domainId> [options]

Detach a domain. The service stops answering on it.

Unbinds the domain and revokes its certificate. Traffic to it stops immediately. Requires confirm: true.

<domainId>required

Domain to remove, from `helm7 domain list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: domain:write

helm7 env list [options]

Environment variable names and fingerprints. Values are never returned.

Names, environments and fingerprints. Values are never returned. There is no endpoint that returns them, by design, so a leaked read key cannot exfiltrate credentials.

scopes: secret:read

helm7 env unset <KEY> [options]

Remove an environment variable. Services lose it on their next deployment.

Removes a variable from one environment. Running services keep the value until their next deploy. The value cannot be recovered, which is why this requires confirm: true.

<KEY>required

Variable name.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: secret:write

helm7 test-accounts create [options]

Create a test account an automated tester can sign in with. Passwords are write-only.

Makes a sign-in a tester can use to drive the product's real interface, kept per environment. mode `provision` creates the user in the environment's managed auth: Helm7 generates a strong password, stores only a hash in auth and an encrypted copy of its own, confirms the address, and tags the user (app_metadata.is_test = true, email <label>+helm7test@<domain>) so analytics and revenue views can leave it out. Needs managed auth enabled, so run auth_enable first. mode `external` does the same in the Product's own auth service instead, with auth_provider (today: supabase): Helm7 reads the project URL and admin key from the environment's stored variables (NEXT_PUBLIC_SUPABASE_URL or SUPABASE_URL, and SUPABASE_SERVICE_ROLE_KEY), uses them for that one call and never returns them, so a Product whose auth lives elsewhere needs no key handed to the caller. The user is confirmed and tagged app_metadata.is_test; rotate and delete only ever touch a tagged user. mode `register` records an account somebody created elsewhere (a product hosted outside Helm7): send its email and password, and optionally a TOTP seed. Nothing here is ever returned: the password and seed are write-only, and list and get show a fingerprint and whether a seed exists. The one way to read them is test_account_checkout. Pass expires_in (for example 24h or 7d) or expires_at to make the account temporary: once it passes, the account is disabled, its stored secrets are wiped and, for provision, its auth user is removed, within about five minutes. Leave both out for a long-lived account. Test accounts must never pay for anything real; a flow that reaches a live paywall should stop there.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: test_account:write

helm7 test-accounts list [options]

Test accounts: label, email, fingerprint, expiry and last use. Never a password.

The test accounts of an environment: label, role, email, mode, a fingerprint of the password, whether a TOTP seed is stored, status (active, expired), when it expires, when it was last checked out and by which run, and when it was last rotated. Never a password, a seed or a code.

scopes: test_account:read

helm7 test-accounts get <accountId> [options]

One test account, without its secrets.

One test account with the same fields as the list: label, role, email, mode, fingerprint, whether it has a TOTP seed, status, expiry, last use and last rotation. Never a password, a seed or a code. Use test_account_checkout to sign in as it.

<accountId>required

From `helm7 test-accounts list`.

scopes: test_account:read

helm7 test-accounts rotate <accountId> [options]

Replace a test account password (and end its sessions). Registered accounts need --password.

Replaces the password. provision: Helm7 generates a new one and changes it in managed auth too, which also signs out every session the account has. register: send the new password you have set in the product, because Helm7 cannot reach it. The stored TOTP seed is left alone unless totp_secret is sent. Nothing secret is returned; the new fingerprint is. An expired account cannot be rotated.

<accountId>required

From `helm7 test-accounts list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: test_account:write

helm7 test-accounts delete <accountId> [options]

Delete a test account and, if Helm7 made it, its auth user.

Removes the record and its stored secrets and, for a provision account, deletes the user from managed auth along with its sessions. Only a user tagged is_test can be removed this way, so a real customer is never at risk from a wrong id. Requires confirm: true.

<accountId>required

From `helm7 test-accounts list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: test_account:write

helm7 test-accounts checkout <accountId> [options]

Print a test account sign-in (email, password, TOTP code, session). Needs test_account:use; logged with --run-ref.

The one operation that returns a test account's secrets: email, password, the current TOTP code if it has a seed and, for a provision account, a real session so the caller need not sign in at all. Meant for whatever signs in to the product, an agent included. Type the values into the sign-in and do not repeat them in your reply or write them to a file. Prefer a short-lived account (expires_in on create) and a short lease. run_ref is required and is written to the activity log with who asked, so every use is traceable to a run. The result is never kept for replay. The checkout is a lease of ttl_seconds (default 900, from 60 to 3600): when it ends, the sessions Helm7 minted for the account are revoked, so a credential that leaks from a finished run stops working quickly. Refused for an expired account.

<accountId>required

From `helm7 test-accounts list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: test_account:use

helm7 test-accounts totp <accountId> [options]

Print the current two-factor code for a test account. Needs test_account:use.

The current six-digit code for a test account that has a TOTP seed, with the seconds it stays valid. The seed never leaves Helm7, so a caller that needs a fresh code mid-flow asks again rather than holding the seed. Every call stamps the account’s last-used time, and run_ref if given, but is not written to the activity log on its own, because a flow may ask every few seconds; the checkout it follows is. Returns a code and nothing else.

<accountId>required

From `helm7 test-accounts list`.

scopes: test_account:use

helm7 context enable [options]

Give the Product memory: its own Contextely product, with credentials set on the environment.

Creates a Contextely product scoped to this Helm7 Product and sets its credentials on the environment, so agents operating the application can read and write its context. Memory and sources are private to this Product unless you say otherwise.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: context:write

helm7 cost estimate [options]

Price a shape per month without building it. Resources are a JSON array, inline or from a file.

What a given set of resources would cost per month, without creating anything. Use this to choose between shapes before you build one. Free and side-effect-free.

scopes: billing:read

helm7 billing checkout [options]

Start a subscription. Prints a checkout link for a person to open.

A hosted Stripe Checkout URL for upgrading the organisation to a paid plan. For an organisation that has never paid, nothing changes yet: the plan updates when Stripe confirms the subscription. For one that already pays, the existing subscription changes plan in place straight away, with no Checkout page.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: billing:manage

helm7 billing portal [options]

A link to manage the subscription, invoices and payment method.

A Stripe-hosted page where a person changes plan, updates the card, downloads invoices or cancels. Only for an organisation that has paid before; one that has not starts with billing_checkout_create.

scopes: billing:manage

helm7 key create <name> [options]

Mint a key for one agent, with its own scopes, spend cap and expiry. The secret is shown once.

Creates a key for one agent, with its own scopes, an optional spend cap and an optional expiry. The key can never exceed the scopes of the member minting it, and a key holding may_administer cannot mint another key holding may_administer, which is what makes revoking one mean something. The secret is shown once and never again.

<name>required

What this agent is for. Shown in the audit trail.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: agent:manage

helm7 key list [options]

Agent keys: name, scopes, spend against the cap, expiry and last use. Never the secret.

Every key in the organisation: its name, the first characters of the secret, its scopes and capabilities, the Product it is confined to, its spend against its cap, its expiry and when it was last used. Never the secret. Revoked keys are included, marked as revoked, because the audit trail still names them.

scopes: agent:manage

helm7 key revoke <keyId> [options]

Stop a key at once. In-flight requests using it fail, and it cannot be undone.

Stops the key immediately. In-flight requests using it fail. Revocation cannot be undone; mint a new key instead.

<keyId>required

Key to revoke, from `helm7 key list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: agent:manage

helm7 activity [options]

The audit trail: what was done, by whom, and whether it was applied, refused or failed.

The audit trail: every change, whether it was applied, refused or failed, who made it (a person or a named key) and the plan it carried. Refusals are included, so an agent that was stopped is on the record. Newest first.

scopes: product:read

helm7 member list [options]

People in the workspace, with their role, and invitations not yet accepted.

People with access to the workspace, with their role, and invitations that have not been accepted yet. There is no charge per person, so this is about who can do what, not what it costs.

scopes: product:read

helm7 member invite [options]

Make an invitation link, shown once, valid for 7 days. Nothing is emailed.

Returns a link that adds whoever opens it and signs in to the workspace, with the role given. The link is shown once, works once and expires after 7 days. Nothing is emailed; send it however you like.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: member:manage

helm7 member remove <memberId> [options]

Remove a person from the workspace. Their keys stop working.

Removes a person, revoking every key they minted, or cancels an invitation that has not been used. The last owner cannot be removed. Requires confirm: true.

<memberId>required

Member to remove, from `helm7 member list`.

Also takes --dry-run, --confirm and --idempotency-key.

scopes: member:manage

helm7 cloud init [options]

Start an ephemeral workspace with no account, no card and no human step.

Creates a temporary organisation and a scoped key with no email, no card and no human step, so an agent can try Helm7 end to end. One Product, a small quota, and it expires. This is for experimentation, not for running anything real. Call cloud_claim to keep what you built.

scopes: none

helm7 cloud claim [options]

Keep an ephemeral workspace by attaching it to a real account.

Returns a single-use link a person opens to attach this ephemeral workspace to their account. The workspace keeps running while they do. Claiming keeps it; choosing Builder or Pro is what lifts the 72-hour expiry and the trial quota.

scopes: none