/usr/local/bin/tctl

Usage: tctl [<flags>] <command> [<args> ...]

Admin tool for the Teleport Infrastructure Identity Platform

Flags:
  -d, --[no-]debug         Enable verbose logging to stderr
  -c, --config=CONFIG      Path to a configuration file [/etc/teleport.yaml] for an Auth Service
                           instance. Can also be set via the TELEPORT_CONFIG_FILE environment
                           variable. Ignored if the auth_service is disabled.
      --auth-server=AUTH-SERVER ...
                           Attempts to connect to specific auth/proxy address(es) instead of local
                           auth [127.0.0.1:3025] ($TELEPORT_AUTH_SERVER)
  -i, --identity=IDENTITY  Path to an identity file. Must be provided to make remote connections
                           to auth. An identity file can be exported with 'tctl auth sign'
                           ($TELEPORT_IDENTITY_FILE)
      --[no-]insecure      When specifying a proxy address in --auth-server, do not verify its TLS
                           certificate. Danger: any data you send can be intercepted or modified by
                           an attacker.
      --mfa-mode=auto      Preferred mode for MFA assertions. ($TELEPORT_MFA_MODE) (one of: auto,
                           cross-platform, platform, sso, browser)

Commands:
  help                                              Show help.
  version                                           Print the version of your tctl binary.
  users add                                         Generate a user invitation token [Teleport local users only].
  users update                                      Update user account.
  users ls                                          Lists all user accounts.
  users rm                                          Deletes user accounts.
  users reset                                       Reset user password and generate a new token [Teleport local users only].
  nodes add                                         Generate a node invitation token.
  nodes ls                                          List all active SSH nodes within the cluster.
  tokens add                                        Create a invitation token.
  tokens rm                                         Delete/revoke an invitation token.
  tokens ls                                         List node and user invitation tokens.
  tokens configure-kube                             Creates a token allowing workload from the Kubernetes cluster to join the Teleport cluster.
  auth export                                       Export public cluster CA certificates to stdout.
  auth sign                                         Create an identity file(s) for a given user.
  auth rotate                                       Rotate certificate authorities in the cluster. Starts in interactive mode by default, provide --type to manually send rotation requests.
  auth ls                                           List connected auth servers.
  auth crl                                          Export empty certificate revocation list (CRL) for Teleport certificate authorities.
  auth create-override-csr                          Create a CSR in preparation for CA certificate override
  auth create-override                              Add a single certificate override to a CA override resource
  auth update-override                              Update a single certificate override in a CA override resource
  auth delete-override                              Delete a single certificate override from a CA override resource
  auth pub-key-hash                                 Extract and print the public key hash of a PEM certificate
  status                                            Report cluster status.
  top                                               Report diagnostic information.
  requests ls                                       Show active Access Requests.
  requests get                                      Show Access Request by ID.
  requests approve                                  Approve pending Access Request.
  requests deny                                     Deny pending Access Request.
  requests create                                   Create pending Access Request.
  requests rm                                       Delete an Access Request.
  requests review                                   Review an Access Request.
  apps ls                                           List all applications registered with the cluster.
  db ls                                             List all databases registered with the cluster.
  kube ls                                           List all Kubernetes clusters registered with the cluster.
  desktop ls                                        List all desktops registered with the cluster.
  desktop bootstrap                                 Generate a PowerShell script to bootstrap Active Directory.
  lock                                              Create a new lock.
  bots ls                                           List all certificate renewal bots registered with the cluster.
  bots add                                          Add a new certificate renewal bot to the cluster.
  bots rm                                           Permanently remove a certificate renewal bot from the cluster.
  bots update                                       Update an existing bot.
  bots instances show                               Shows information about a specific bot instance.
  bots instances list                               List bot instances.
  bots instances add                                Join a new instance onto an existing bot.
  workload-identity ls                              List workload identity configurations.
  workload-identity rm                              Delete a workload identity configuration.
  workload-identity revocations add                 Create a new revocation.
  workload-identity revocations rm                  Delete a revocation.
  workload-identity revocations ls                  List revocations.
  workload-identity revocations crl                 Fetch the signed CRL for existing revocations.
  workload-identity x509-issuer-overrides sign-csrs Sign CSRs with the SPIFFE X.509 CA keys.
  workload-identity x509-issuer-overrides create    Create an issuer override from the given certificate chains.
  inventory status                                  Show inventory status summary.
  inventory list                                    List Teleport instance inventory.
  inventory ping                                    Ping locally connected instance.
  discovery nodes                                   Report discovered server instances and their enrollment status using Teleport audit log and cluster state.
  discovery status                                  Show auto-discovery status and enrollment progress.
  recordings ls                                     List recorded sessions.
  recordings search                                 Search session recordings using semantic and keyword queries.
  recordings encryption rotate                      Rotate encryption keys used for encrypting session recordings.
  recordings encryption status                      Show current rotation status.
  recordings encryption complete-rotation           Completes an in-progress encryption key rotation.
  recordings encryption rollback-rotation           Rolls back an in-progress encryption key rotation.
  recordings download                               Download session recordings.
  recordings summary                                View an AI-generated session summary.
  alerts list                                       List cluster alerts.
  alerts create                                     Create cluster alerts.
  alerts delete                                     Deletes a cluster alert.
  alerts ack                                        Acknowledge cluster alerts.
  alerts ack ls                                     List acknowledged cluster alerts.
  proxy ls                                          Lists proxies connected to the cluster.
  create                                            Create or update a Teleport resource from a YAML file.
  update                                            Update resource fields.
  rm                                                Delete a resource.
  get                                               Print a YAML declaration of various Teleport resources.
  edit                                              Edit a Teleport resource.
  devices add                                       Register managed devices.
  devices ls                                        Lists managed devices.
  devices rm                                        Removes a managed device.
  devices enroll                                    Creates a new device enrollment token.
  devices lock                                      Locks a device.
  saml export                                       Export a SAML signing key in .crt format.
  acl ls                                            List cluster Access Lists.
  acl get                                           Get detailed information for an Access List.
  acl users add                                     Add a user to an Access List.
  acl users rm                                      Remove a user from an Access List.
  acl users ls                                      List users that are members of an Access List.
  acl reviews create                                Submit a new review for a given access list.
  acl reviews ls                                    List past audit history for a given access list.
  acl rm                                            Delete an Access List.
  acl update                                        Update an existing access list. Each flag you pass replaces that field (no
merge or append), so list-valued flags like --members or --logins overwrite
the whole list; anything you omit is left unchanged.

For an access list created with an access type, resource flags (--node-labels, etc.) edit the
supporting roles.
  acl create                                        Create an access list.

Use --access-type to have Teleport create the access list's supporting
roles for you. The --access-type value controls how members are granted
access. Possible values are:

  standing        members receive persistent access to the resources set below.
  access-request  members must request that access; owners approve.

The supporting roles are built from the resource flags you set. The available
resource flags (grouped by target) are:

  SSH servers          --node-labels, --logins
  Databases            --db-labels, --db-users, --db-names
  Kubernetes           --kubernetes-labels, --kubernetes-users, --kubernetes-groups
  Windows desktops     --windows-labels, --windows-logins
  Git servers          --github-orgs
  AWS Identity Center  --aws-ic-assignments
  Web applications     --app-labels, --aws-role-arns, --azure-identities
                       --gcp-service-accounts, --mcp-tools

If --access-type is omitted, a plain access list is created with whatever
grants you set directly (--member-grant-roles, etc.) — there are no
auto-generated supporting roles.
  login_rule test                                   Test the parsing and evaluation of login rules.
  idp saml test-attribute-mapping                   Test expression evaluation of attribute mapping.
  audit query get                                   Get audit query.
  audit query rm                                    Remove audit query.
  audit query ls                                    List audit queries.
  audit query exec                                  Execute audit query.
  audit query create                                Create an audit query.
  audit schema                                      Print audit query schema.
  audit report ls                                   List security reports.
  audit report get                                  Get security report.
  audit report run                                  Run the security report.
  audit report state                                Print the state of the security report.
  detections ls                                     List Identity Security detections.
  detections get                                    Get Identity Security detection details.
  investigate                                       Search and explore Identity Security activity logs.
  access-changes ls                                 List access path changes for your crown jewels
  access-changes get                                Get details about an access path change
  access-review                                     Review which identities can access which resources.
  plugins cleanup                                   Cleans up the given plugin type.
  plugins install okta                              Install an Okta integration.
  plugins install scim                              Install a Teleport SCIM plugin.
  plugins install entraid                           Install an Microsoft Entra ID integration.
  plugins install netiq                             Install an Access Graph NetIQ integration.
  plugins install awsic                             Install an AWS IAM Identity Center integration.
  plugins install github                            Install an Access Graph Github integration.
  plugins delete                                    Remove a plugin instance.
  plugins edit awsic                                Edit an AWS IAM Identity Center integration's settings.
  plugins rotate awsic                              Rotate the AWS Identity Center SCIM bearer token.
  notifications create                              Create a cluster notification.
  notifications ls                                  List notifications which were manually created using `tctl notifications create`. By default, this will list notifications capable of targeting multiple users, such as role-based ones. To list notifications directed only at a specific user, use the --user flag. To include notifications generated by Teleport, use --all.
  notifications rm                                  Remove a cluster notification.
  sso configure github                              Configure GitHub auth connector.
  sso configure saml                                Configure SAML auth connector, optionally using a preset. Available presets: [okta onelogin ad adfs].
  sso configure oidc                                Configure OIDC auth connector, optionally using a preset. Available presets: [google gitlab okta].
  sso test                                          Perform end-to-end test of SSO flow using provided auth connector definition.
  terraform env                                     Obtain certificates and load them into environment variables. This creates a temporary MachineID bot.
  autoupdate client-tools status                    Prints if the client tools updates are enabled/disabled, and the target version in specified format.
  autoupdate client-tools enable                    Enables client tools auto updates. Clients will be told to update to the target version.
  autoupdate client-tools disable                   Disables client tools auto updates. Clients will not be told to update to the target version.
  autoupdate client-tools target                    Sets the client tools target version. This command is not supported on Teleport Cloud.
  autoupdate agents status                          Prints agents auto update status.
  autoupdate agents report                          Aggregates the agent autoupdate reports and displays agent count per version and per update group.
  autoupdate agents start-update                    Starts updating one or many groups.
  autoupdate agents mark-done                       Marks one or many groups as done updating.
  autoupdate agents rollback                        Rolls back one or many groups.
  stable-unix-users ls                              List the stable UNIX users currently persisted in the cluster.
  bound-keypair request-rotation                    Request a keypair rotation on the next join attempt.
  scoped status                                     Show the status of scoped resources.
  scoped tokens add                                 Create a scoped invitation token.
  scoped tokens rm                                  Delete/revoke a scoped invitation token.
  scoped tokens ls                                  List invitation tokens.
  scoped assignments list                           List scoped role assignments
  integrations test                                 Verify an integration.
  integrations awsic accounts ls                    List AWS Identity Center accounts and their permission sets.

Try 'tctl help [command]' to get help for a given command.