# CLI command reference

> Generated reference for every supported Constal CLI command, argument, option, and corresponding public Platform API operation.

This reference is generated directly from the command registry used by `constal --help`. A documented command that is absent from the executable, or an executable command missing here, fails the documentation build. Commands use only public `/v1` Platform API endpoints.

Global overrides are available on every command. `CONSTAL_API_KEY`, `CONSTAL_PLATFORM_URL`, `CONSTAL_NAMESPACE`, and `CONSTAL_TENANT` override stored configuration. Prefer `--output json` or `jsonl` for automation and preserve caller-stable event identifiers when retrying an uncertain mutation.

## Command index {#command-index}

| Group | Commands |
| --- | --- |
| auth | [`auth login`](#auth-login), [`auth logout`](#auth-logout), [`auth status`](#auth-status) |
| context | [`context show`](#context-show), [`context use`](#context-use) |
| deployments | [`deployments create`](#deployments-create), [`deployments get`](#deployments-get) |
| agents | [`agents list`](#agents-list), [`agents get`](#agents-get) |
| runs | [`runs start`](#runs-start), [`runs session`](#runs-session), [`runs events`](#runs-events), [`runs workflow`](#runs-workflow), [`runs get`](#runs-get), [`runs detail`](#runs-detail), [`runs journal`](#runs-journal), [`runs journal-window`](#runs-journal-window), [`runs waits`](#runs-waits), [`runs resolve`](#runs-resolve), [`runs steer`](#runs-steer), [`runs stream`](#runs-stream), [`runs delete-session`](#runs-delete-session), [`runs deletion`](#runs-deletion), [`runs pause`](#runs-pause), [`runs resume`](#runs-resume), [`runs cancel`](#runs-cancel), [`runs interrupt`](#runs-interrupt), [`runs policy`](#runs-policy), [`runs rebind`](#runs-rebind), [`runs truncate`](#runs-truncate), [`runs branch`](#runs-branch) |
| resources | [`resources list`](#resources-list), [`resources create`](#resources-create), [`resources get`](#resources-get), [`resources delete`](#resources-delete), [`resources control`](#resources-control), [`resources enable`](#resources-enable), [`resources disable`](#resources-disable) |
| bindings | [`bindings list`](#bindings-list), [`bindings create`](#bindings-create), [`bindings get`](#bindings-get), [`bindings delete`](#bindings-delete), [`bindings promote`](#bindings-promote), [`bindings enable`](#bindings-enable), [`bindings disable`](#bindings-disable), [`bindings revoke`](#bindings-revoke) |
| credentials | [`credentials providers catalog`](#credentials-providers-catalog), [`credentials providers list`](#credentials-providers-list), [`credentials providers get`](#credentials-providers-get), [`credentials providers install`](#credentials-providers-install), [`credentials list`](#credentials-list), [`credentials get`](#credentials-get), [`credentials create`](#credentials-create), [`credentials version`](#credentials-version), [`credentials activate`](#credentials-activate), [`credentials rotate`](#credentials-rotate), [`credentials authorize`](#credentials-authorize), [`credentials revoke`](#credentials-revoke), [`credentials consumers`](#credentials-consumers), [`credentials uses`](#credentials-uses), [`credentials events`](#credentials-events) |
| channels | [`channels list`](#channels-list), [`channels get`](#channels-get), [`channels send`](#channels-send), [`channels message`](#channels-message), [`channels events`](#channels-events), [`channels alarm`](#channels-alarm), [`channels alarm-get`](#channels-alarm-get), [`channels alarm-cancel`](#channels-alarm-cancel) |
| policies | [`policies evaluate`](#policies-evaluate) |
| analytics | [`analytics summary`](#analytics-summary), [`analytics live`](#analytics-live), [`analytics dashboard`](#analytics-dashboard), [`analytics query`](#analytics-query), [`analytics export`](#analytics-export), [`analytics export-get`](#analytics-export-get) |
| memory | [`memory stores list`](#memory-stores-list), [`memory stores create`](#memory-stores-create), [`memory stores get`](#memory-stores-get), [`memory stores delete`](#memory-stores-delete), [`memory list`](#memory-list), [`memory create`](#memory-create), [`memory get`](#memory-get), [`memory delete`](#memory-delete) |
| customers | [`customers list`](#customers-list), [`customers get`](#customers-get), [`customers put`](#customers-put), [`customers enable`](#customers-enable), [`customers disable`](#customers-disable), [`customers map`](#customers-map), [`customers unmap`](#customers-unmap), [`customers bind-policy`](#customers-bind-policy), [`customers unbind-policy`](#customers-unbind-policy) |
| artifacts | [`artifacts get`](#artifacts-get) |
| exports | [`exports get`](#exports-get) |
| anchors | [`anchors get`](#anchors-get) |
| stages | [`stages get`](#stages-get), [`stages recover`](#stages-recover) |
| tables | [`tables get`](#tables-get), [`tables export-get`](#tables-export-get) |

## Auth {#auth}

### `auth login` {#auth-login}

Save a Constal API key using a hidden prompt, stdin, or a file.

```text
constal auth login
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--token-stdin` | Read the API key from stdin. |
| `--token-file <FILE>` | Read the API key from a file. |

```sh
printf '%s' "$CONSTAL_API_KEY" | constal auth login --token-stdin
```


### `auth logout` {#auth-logout}

Remove the locally stored Constal API key.

```text
constal auth logout
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `auth status` {#auth-status}

Check whether the current credentials can read the selected namespace.

```text
constal auth status
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


## Context {#context}

### `context show` {#context-show}

Show the effective origin, tenant restriction, namespace, and credential source.

```text
constal context show
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `context use` {#context-use}

Persist the default origin, tenant restriction, or namespace.

```text
constal context use
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Set the Platform API origin. |
| `--namespace <NAME>` | Set the default namespace. |
| `--tenant <NAME>` | Set the tenant restriction. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--clear-tenant` | Remove the tenant restriction. |

```sh
constal context use --namespace production
```

```sh
constal context use --tenant acme
```


## Deployments {#deployments}

### `deployments create` {#deployments-create}

Upload an immutable executable ZIP or tar.gz package.

```text
constal deployments create <archive>
```
| Argument | Meaning |
| --- | --- |
| `archive` | Path to the ZIP or tar.gz package. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--idempotency-key <KEY>` | Override the content-derived deployment key. |

```sh
constal deployments create support-agent.zip
```


### `deployments get` {#deployments-get}

Read deployment build and publication state.

```text
constal deployments get <deployment>
```
| Argument | Meaning |
| --- | --- |
| `deployment` | Deployment UUID. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


## Agents {#agents}

### `agents list` {#agents-list}

List deployed Agents in the namespace.

```text
constal agents list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `agents get` {#agents-get}

Read one deployed Agent.

```text
constal agents get <agent>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


## Runs {#runs}

### `runs start` {#runs-start}

Start an Agent Run in a stable session.

```text
constal runs start <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Stable session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--data <JSON or @FILE or @->` | Agent input JSON. |
| `--deliver <MODE>` | Queue work or drive it live. Values: `queue`, `live`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |

```sh
constal runs start support customer-42 --data @request.json --deliver live
```


### `runs session` {#runs-session}

Read bounded authoritative session state.

```text
constal runs session <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--limit <COUNT>` | Bound the number of returned records. |


### `runs events` {#runs-events}

Page accepted session events and ledger history.

```text
constal runs events <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--after <CURSOR>` | Continue after a returned cursor. |
| `--limit <COUNT>` | Bound the number of returned records. |


### `runs workflow` {#runs-workflow}

Read the authoritative current workflow view.

```text
constal runs workflow <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `runs get` {#runs-get}

Read one authoritative Run.

```text
constal runs get <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `runs detail` {#runs-detail}

Read bounded Run, fact, wait, steer, and journal detail.

```text
constal runs detail <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--limit <COUNT>` | Bound the number of returned records. |


### `runs journal` {#runs-journal}

Read the cryptographically rooted Run journal.

```text
constal runs journal <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--after <CURSOR>` | Continue after a returned cursor. |
| `--limit <COUNT>` | Bound the number of returned records. |


### `runs journal-window` {#runs-journal-window}

Page an operator-oriented Run journal window.

```text
constal runs journal-window <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--after <CURSOR>` | Continue after a returned cursor. |
| `--before <CURSOR>` | Read before a returned cursor. |
| `--limit <COUNT>` | Bound the number of returned records. |


### `runs waits` {#runs-waits}

List open durable waits for a session.

```text
constal runs waits <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `runs resolve` {#runs-resolve}

Resolve one durable wait with a schema-checked value.

```text
constal runs resolve <agent> <session> <promise>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `promise` | Wait promise id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--value <JSON or @FILE or @->` | Resolution value. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs steer` {#runs-steer}

Append authenticated guidance to a session.

```text
constal runs steer <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--text <TEXT>` | Guidance text. Required. |
| `--data <JSON or @FILE or @->` | Optional structured guidance. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs stream` {#runs-stream}

Stream committed Run frames over Server-Sent Events.

```text
constal runs stream <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--run <RUN>` | Run id to stream. Required. |


### `runs delete-session` {#runs-delete-session}

Delete a session asynchronously and preserve a bounded tombstone.

```text
constal runs delete-session <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs deletion` {#runs-deletion}

Read asynchronous session-deletion progress.

```text
constal runs deletion <agent> <session>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `runs pause` {#runs-pause}

Pause one exact Run.

```text
constal runs pause <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs resume` {#runs-resume}

Resume one exact Run.

```text
constal runs resume <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs cancel` {#runs-cancel}

Cancel one exact Run.

```text
constal runs cancel <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs interrupt` {#runs-interrupt}

Interrupt a Run at a safe point or abort active work.

```text
constal runs interrupt <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--mode <MODE>` | Use safe-point or abort. Required. Values: `safe-point`, `abort`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs policy` {#runs-policy}

Apply an idempotent policy control to one Run.

```text
constal runs policy <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs rebind` {#runs-rebind}

Apply an idempotent rebind control to one Run.

```text
constal runs rebind <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs truncate` {#runs-truncate}

Apply an idempotent truncate control to one Run.

```text
constal runs truncate <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `runs branch` {#runs-branch}

Apply an idempotent branch control to one Run.

```text
constal runs branch <agent> <session> <run>
```
| Argument | Meaning |
| --- | --- |
| `agent` | Agent id. |
| `session` | Session id. |
| `run` | Run id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


## Resources {#resources}

### `resources list` {#resources-list}

List configured Resources, optionally by kind.

```text
constal resources list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--kind <KIND>` | Filter by Resource kind. |


### `resources create` {#resources-create}

Create a configured Resource from a JSON definition.

```text
constal resources create
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `resources get` {#resources-get}

Read one tenant-managed Resource.

```text
constal resources get <kind> <id>
```
| Argument | Meaning |
| --- | --- |
| `kind` | Resource kind. |
| `id` | Resource id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `resources delete` {#resources-delete}

Delete one tenant-managed Resource.

```text
constal resources delete <kind> <id>
```
| Argument | Meaning |
| --- | --- |
| `kind` | Resource kind. |
| `id` | Resource id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `resources control` {#resources-control}

Read one Resource control head.

```text
constal resources control <kind> <id>
```
| Argument | Meaning |
| --- | --- |
| `kind` | Resource kind. |
| `id` | Resource id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `resources enable` {#resources-enable}

Enable a tenant-managed Resource.

```text
constal resources enable <kind> <id>
```
| Argument | Meaning |
| --- | --- |
| `kind` | Resource kind. |
| `id` | Resource id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


### `resources disable` {#resources-disable}

Disable a tenant-managed Resource.

```text
constal resources disable <kind> <id>
```
| Argument | Meaning |
| --- | --- |
| `kind` | Resource kind. |
| `id` | Resource id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


## Bindings {#bindings}

### `bindings list` {#bindings-list}

List scoped Resource and Credential assignments.

```text
constal bindings list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `bindings create` {#bindings-create}

Create a scoped assignment from a JSON definition.

```text
constal bindings create
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `bindings get` {#bindings-get}

Read one scoped assignment.

```text
constal bindings get <binding>
```
| Argument | Meaning |
| --- | --- |
| `binding` | Binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `bindings delete` {#bindings-delete}

Delete one scoped assignment idempotently.

```text
constal bindings delete <binding>
```
| Argument | Meaning |
| --- | --- |
| `binding` | Binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `bindings promote` {#bindings-promote}

Promote a binding when its current revision still matches.

```text
constal bindings promote <binding>
```
| Argument | Meaning |
| --- | --- |
| `binding` | Binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `bindings enable` {#bindings-enable}

Enable one scoped assignment.

```text
constal bindings enable <binding>
```
| Argument | Meaning |
| --- | --- |
| `binding` | Binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


### `bindings disable` {#bindings-disable}

Disable one scoped assignment.

```text
constal bindings disable <binding>
```
| Argument | Meaning |
| --- | --- |
| `binding` | Binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


### `bindings revoke` {#bindings-revoke}

Revoke one scoped assignment.

```text
constal bindings revoke <binding>
```
| Argument | Meaning |
| --- | --- |
| `binding` | Binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


## Credentials {#credentials}

### `credentials providers catalog` {#credentials-providers-catalog}

List Credential Provider packages visible to the tenant.

```text
constal credentials providers catalog
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `credentials providers list` {#credentials-providers-list}

List installed Credential Providers.

```text
constal credentials providers list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `credentials providers get` {#credentials-providers-get}

Read one installed Credential Provider.

```text
constal credentials providers get <provider>
```
| Argument | Meaning |
| --- | --- |
| `provider` | Provider id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `credentials providers install` {#credentials-providers-install}

Install a catalog Credential Provider package.

```text
constal credentials providers install
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <SOURCE>` | Read protected setup JSON from @FILE or @-. |

```sh
constal credentials providers install --body @provider-setup.json
```


### `credentials list` {#credentials-list}

List Credentials without returning material.

```text
constal credentials list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `credentials get` {#credentials-get}

Read authoritative Credential metadata.

```text
constal credentials get <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `credentials create` {#credentials-create}

Create, mint, or begin authorization for a Credential.

```text
constal credentials create <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | New Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--provider <CRN>` | Installed Credential Provider CRN. Required. |
| `--configuration <JSON or @FILE>` | Provider-defined non-secret configuration. |
| `--material-file <FILE>` | Read imported secret material from a file. |
| `--material-stdin` | Read imported secret material from stdin. |
| `--policies <JSON or @FILE>` | Optional Policy CRN array. |


### `credentials version` {#credentials-version}

Add imported material as a scheduled Credential version.

```text
constal credentials version <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--material-file <FILE>` | Read secret material from a file. |
| `--material-stdin` | Read secret material from stdin. |


### `credentials activate` {#credentials-activate}

Activate a Credential lifecycle operation.

```text
constal credentials activate <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `credentials rotate` {#credentials-rotate}

Rotate a Credential lifecycle operation.

```text
constal credentials rotate <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `credentials authorize` {#credentials-authorize}

Authorize a Credential lifecycle operation.

```text
constal credentials authorize <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `credentials revoke` {#credentials-revoke}

Revoke a Credential lifecycle operation.

```text
constal credentials revoke <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `credentials consumers` {#credentials-consumers}

List bounded Credential consumers.

```text
constal credentials consumers <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `credentials uses` {#credentials-uses}

List bounded Credential uses.

```text
constal credentials uses <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--after <CURSOR>` | Continue after a returned cursor. |


### `credentials events` {#credentials-events}

List bounded Credential events.

```text
constal credentials events <credential>
```
| Argument | Meaning |
| --- | --- |
| `credential` | Credential id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--after <CURSOR>` | Continue after a returned cursor. |


## Channels {#channels}

### `channels list` {#channels-list}

List deployed Channels.

```text
constal channels list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `channels get` {#channels-get}

Read one deployed Channel.

```text
constal channels get <channel>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `channels send` {#channels-send}

Send one outbound Channel message.

```text
constal channels send <channel>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `channels message` {#channels-message}

Read one outbound delivery receipt.

```text
constal channels message <channel> <message>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |
| `message` | Message id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `channels events` {#channels-events}

Read bounded Channel events.

```text
constal channels events <channel>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--after <CURSOR>` | Continue after a returned cursor. |
| `--limit <COUNT>` | Bound the number of returned records. |


### `channels alarm` {#channels-alarm}

Schedule a Channel alarm.

```text
constal channels alarm <channel>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `channels alarm-get` {#channels-alarm-get}

Read one Channel alarm.

```text
constal channels alarm-get <channel> <alarm>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |
| `alarm` | Alarm id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `channels alarm-cancel` {#channels-alarm-cancel}

Cancel one Channel alarm.

```text
constal channels alarm-cancel <channel> <alarm>
```
| Argument | Meaning |
| --- | --- |
| `channel` | Channel id. |
| `alarm` | Alarm id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


## Policies {#policies}

### `policies evaluate` {#policies-evaluate}

Evaluate a deployed Policy against a normalized test input.

```text
constal policies evaluate <policy>
```
| Argument | Meaning |
| --- | --- |
| `policy` | Policy id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


## Analytics {#analytics}

### `analytics summary` {#analytics-summary}

Read a bounded recent analytics summary.

```text
constal analytics summary
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `analytics live` {#analytics-live}

Query live analytics data.

```text
constal analytics live
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `analytics dashboard` {#analytics-dashboard}

Query dashboard analytics data.

```text
constal analytics dashboard
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `analytics query` {#analytics-query}

Query query analytics data.

```text
constal analytics query
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `analytics export` {#analytics-export}

Create export analytics data.

```text
constal analytics export
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `analytics export-get` {#analytics-export-get}

Download one namespace-owned analytics export.

```text
constal analytics export-get <ref>
```
| Argument | Meaning |
| --- | --- |
| `ref` | Export artifact hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--out <FILE>` | Write the binary response to a file instead of stdout. |
| `--quiet` | Suppress the file-write status message. |


## Memory {#memory}

### `memory stores list` {#memory-stores-list}

List configured Memory Stores.

```text
constal memory stores list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `memory stores create` {#memory-stores-create}

Create a Memory Store Resource.

```text
constal memory stores create
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `memory stores get` {#memory-stores-get}

Read one Memory Store.

```text
constal memory stores get <id>
```
| Argument | Meaning |
| --- | --- |
| `id` | Memory Store id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `memory stores delete` {#memory-stores-delete}

Delete one Memory Store.

```text
constal memory stores delete <id>
```
| Argument | Meaning |
| --- | --- |
| `id` | Memory Store id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `memory list` {#memory-list}

List configured Memory Resources.

```text
constal memory list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `memory create` {#memory-create}

Create a Memory Resource.

```text
constal memory create
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


### `memory get` {#memory-get}

Read one Memory Resource.

```text
constal memory get <id>
```
| Argument | Meaning |
| --- | --- |
| `id` | Memory id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `memory delete` {#memory-delete}

Delete one Memory Resource.

```text
constal memory delete <id>
```
| Argument | Meaning |
| --- | --- |
| `id` | Memory id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


## Customers {#customers}

### `customers list` {#customers-list}

List downstream customers.

```text
constal customers list
```
| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `customers get` {#customers-get}

Read one downstream customer.

```text
constal customers get <customer>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `customers put` {#customers-put}

Create or update a downstream customer.

```text
constal customers put <customer>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `customers enable` {#customers-enable}

Enable a downstream customer.

```text
constal customers enable <customer>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


### `customers disable` {#customers-disable}

Disable a downstream customer.

```text
constal customers disable <customer>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |
| `--reason <TEXT>` | Record an optional operator reason. |


### `customers map` {#customers-map}

map for a downstream customer.

```text
constal customers map <customer> <binding>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |
| `binding` | Mapping or binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `customers unmap` {#customers-unmap}

unmap for a downstream customer.

```text
constal customers unmap <customer> <binding>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |
| `binding` | Mapping or binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `customers bind-policy` {#customers-bind-policy}

bind policy for a downstream customer.

```text
constal customers bind-policy <customer> <binding>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |
| `binding` | Mapping or binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


### `customers unbind-policy` {#customers-unbind-policy}

unbind policy for a downstream customer.

```text
constal customers unbind-policy <customer> <binding>
```
| Argument | Meaning |
| --- | --- |
| `customer` | Customer id. |
| `binding` | Mapping or binding id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |
| `--event-id <ID>` | Use a caller-stable idempotency event identifier. |


## Artifacts {#artifacts}

### `artifacts get` {#artifacts-get}

Download an authorized content-addressed artifact.

```text
constal artifacts get <ref>
```
| Argument | Meaning |
| --- | --- |
| `ref` | Artifact hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--out <FILE>` | Write the binary response to a file instead of stdout. |
| `--quiet` | Suppress the file-write status message. |


## Exports {#exports}

### `exports get` {#exports-get}

Download a redacted durable export.

```text
constal exports get <ref>
```
| Argument | Meaning |
| --- | --- |
| `ref` | Export hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--out <FILE>` | Write the binary response to a file instead of stdout. |
| `--quiet` | Suppress the file-write status message. |


## Anchors {#anchors}

### `anchors get` {#anchors-get}

Download an authorized customer audit anchor.

```text
constal anchors get <ref>
```
| Argument | Meaning |
| --- | --- |
| `ref` | Anchor hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--out <FILE>` | Write the binary response to a file instead of stdout. |
| `--quiet` | Suppress the file-write status message. |


## Stages {#stages}

### `stages get` {#stages-get}

Inspect one map/reduce stage.

```text
constal stages get <stage>
```
| Argument | Meaning |
| --- | --- |
| `stage` | Stage hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |


### `stages recover` {#stages-recover}

Request authorized stage recovery.

```text
constal stages recover <stage>
```
| Argument | Meaning |
| --- | --- |
| `stage` | Stage hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--body <JSON or @FILE or @->` | Read the JSON request body inline, from a file, or from stdin. |


## Tables {#tables}

### `tables get` {#tables-get}

Read a table branch head and state.

```text
constal tables get <table>
```
| Argument | Meaning |
| --- | --- |
| `table` | Table id. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--branch <NAME>` | Table branch; defaults to main. |


### `tables export-get` {#tables-export-get}

Read an exact table catalog commit, export, or intent.

```text
constal tables export-get <table> <branch> <sequence> <hash>
```
| Argument | Meaning |
| --- | --- |
| `table` | Table id. |
| `branch` | Branch name. |
| `sequence` | Commit sequence. |
| `hash` | Commit hash. |

| Option | Meaning |
| --- | --- |
| `--help` | Show command help. |
| `--version` | Show the CLI version. |
| `--origin <URL>` | Override the configured Platform API origin. |
| `--namespace <NAME>` | Override the configured namespace. |
| `--tenant <NAME>` | Restrict authentication to this tenant. |
| `--output <FORMAT>` | Render table, json, or jsonl output. Values: `table`, `json`, `jsonl`. |
| `--out <FILE>` | Write the binary response to a file instead of stdout. |
| `--quiet` | Suppress the file-write status message. |