This release is a pre-release and may not be stable for production use.
VGS CLI
Command Line Tool for programmatic configurations on VGS.
Table of Contents
Requirements
Python 3.11 or newer with OpenSSL 1.1.1 or newer, or Docker.
Installation
PyPI
Install from PyPI:
python3 -m pip install vgs-cli
Run
Verify the installation:
vgs --version
Running in Docker
Check our official documentation.
AI agent skill
Install the agent skill:
npx skills add verygoodsecurity/vgs-cli --skill vgs-cli-guide
The guide covers Dashboard-assisted onboarding, the complete built-in command surface, controlled route and Collect Form changes, service-account automation, Docker, certificates, logs, and troubleshooting. Installation uses the Skills CLI.
Update the agent skill:
npx skills update vgs-cli-guide
Commands
Full command reference:
- https://docs.verygoodsecurity.com/vault/developer-tools/vgs-cli/commands
- Routes YAML format (
routes.yaml): https://docs.verygoodsecurity.com/vault/developer-tools/vgs-cli/commands#routes.yaml
Tenant terminology
Use tenant and --tenant/-T in new commands. Legacy vault commands and
--vault/-V options still work, but print a deprecation warning.
Authentication
| Command | Purpose |
|---|---|
vgs --help |
List available commands. |
vgs login |
Start an interactive session. |
vgs logout |
End the current session. |
Organizations and tenants
| Command | Purpose |
|---|---|
vgs get organizations |
List accessible organizations. |
vgs get tenants |
List all tenants visible to the authenticated identity. |
vgs generate tenant > tenant.yaml |
Generate a tenant template. |
vgs apply tenant -f tenant.yaml |
Create a tenant from a reviewed template. |
vgs apply tenant -O <ORGANIZATION_ID> -f tenant.yaml |
Create a tenant when organizationId is omitted from the template. |
vgs apply tenant-resources -T <TENANT_ID> -f resources.yaml --dry-run true |
Validate tenant resources without applying them. |
vgs apply tenant-resources -T <TENANT_ID> -f resources.yaml |
Apply reviewed resources to a tenant. |
vgs get tenants does not take an organization option. vgs apply tenant
requires the organization ID either in tenant.yaml as data.organizationId
or through -O/--organization; if both are present, they must match.
Organization notifications
| Command | Purpose |
|---|---|
vgs get notification-providers |
List supported notification providers. |
vgs get notifications -O <ORGANIZATION_ID> |
List notification integrations. |
vgs get notification-events -O <ORGANIZATION_ID> <INTEGRATION_ID> |
List configured events for a notification integration. |
vgs apply notification -O <ORGANIZATION_ID> -f notification.yaml |
Create or update a notification integration from a file. |
vgs apply notification -O <ORGANIZATION_ID> --enable <INTEGRATION_ID> |
Enable a notification integration. |
vgs apply notification -O <ORGANIZATION_ID> --disable <INTEGRATION_ID> |
Disable a notification integration. |
vgs delete notification -O <ORGANIZATION_ID> <INTEGRATION_ID> |
Delete a notification integration. |
Notification management requires an active organization, organization-admin access. The CLI masks generated webhook secrets in its output.
Routes
| Command | Purpose |
|---|---|
vgs get routes -T <TENANT_ID> |
List tenant routes. |
vgs apply routes -T <TENANT_ID> -f <FILE> |
Apply tenant routes. |
vgs delete routes -T <TENANT_ID> <ROUTE_ID> |
Delete one tenant route. |
Collect Forms
| Command | Purpose |
|---|---|
vgs get forms -T <TENANT_ID> |
List Collect Forms. |
vgs get form -T <TENANT_ID> <FORM_ID> |
Get one Collect Form. |
vgs apply form -T <TENANT_ID> -f <FILE> |
Apply a Collect Form from a file. |
vgs apply form -T <TENANT_ID> --json '<JSON>' |
Apply inline Collect Form JSON. |
vgs delete form -T <TENANT_ID> <FORM_ID> |
Delete one Collect Form. |
Access credentials and logs
| Command | Purpose |
|---|---|
vgs get access-credentials -T <TENANT_ID> |
List tenant access credentials. |
vgs generate access-credentials -T <TENANT_ID> |
Generate tenant access credentials. |
vgs logs access -T <TENANT_ID> |
View tenant access logs. |
vgs logs operations -T <TENANT_ID> -R <REQUEST_ID> |
View request operation logs. |
Certificates
| Command | Purpose |
|---|---|
vgs certificate --help |
Show certificate commands. |
Automation with VGS CLI
If you want to use the VGS CLI for automation, create a service account.
5 maintainers
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distributions
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file vgs_cli-1.34.0.dev1-py3-none-any.whl.
File metadata
- Download URL: vgs_cli-1.34.0.dev1-py3-none-any.whl
- Upload date:
- Size: 74.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
5a75b3f6bf36cb4c205547d2fd7a50b07934e030e7d7a3670ce2b6c782945c1a
|
|
| MD5 |
98a12f2444b1149a42727d121e074a88
|
|
| BLAKE2b-256 |
584b3684b8c74c5de52430fd0165de2e11190e4be6c6905138424cb438fccb34
|
Provenance
The following attestation bundles were made for vgs_cli-1.34.0.dev1-py3-none-any.whl:
Publisher:
build-publish.yaml on verygoodsecurity/vgs-cli
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
vgs_cli-1.34.0.dev1-py3-none-any.whl -
Subject digest:
5a75b3f6bf36cb4c205547d2fd7a50b07934e030e7d7a3670ce2b6c782945c1a - Sigstore transparency entry: 2603029691
- Sigstore integration time:
-
Permalink:
verygoodsecurity/vgs-cli@16ba7d12fb46a4b6fa8a42480af9b347a5342a35 -
Branch / Tag:
refs/tags/1.34.0.dev1 - Owner: https://github.com/verygoodsecurity
-
Access:
internal
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
build-publish.yaml@16ba7d12fb46a4b6fa8a42480af9b347a5342a35 -
Trigger Event:
push
-
Statement type:
