/usr/local/bin/tctl

Usage: tctl [<flags>] <command> [<args> ...]

Admin tool for the Teleport Infrastructure Identity Platform

Flags:
  -d, --[no-]debug         Enable verbose logging to stderr
  -c, --config=CONFIG      Path to a configuration file [/etc/teleport.yaml] for an Auth Service
                           instance. Can also be set via the TELEPORT_CONFIG_FILE environment
                           variable. Ignored if the auth_service is disabled.
      --auth-server=AUTH-SERVER ...
                           Attempts to connect to specific auth/proxy address(es) instead of local
                           auth [127.0.0.1:3025] ($TELEPORT_AUTH_SERVER)
  -i, --identity=IDENTITY  Path to an identity file. Must be provided to make remote connections
                           to auth. An identity file can be exported with 'tctl auth sign'
                           ($TELEPORT_IDENTITY_FILE)
      --[no-]insecure      When specifying a proxy address in --auth-server, do not verify its TLS
                           certificate. Danger: any data you send can be intercepted or modified by
                           an attacker.

Commands:
  help                                              Show help.
  version                                           Print the version of your tctl binary.
  users add                                         Generate a user invitation token [Teleport local users only].
  users update                                      Update user account.
  users ls                                          Lists all user accounts.
  users rm                                          Deletes user accounts.
  users reset                                       Reset user password and generate a new token [Teleport local users only].
  nodes add                                         Generate a node invitation token.
  nodes ls                                          List all active SSH nodes within the cluster.
  tokens add                                        Create a invitation token.
  tokens rm                                         Delete/revoke an invitation token.
  tokens ls                                         List node and user invitation tokens.
  tokens configure-kube                             Creates a token allowing workload from the Kubernetes cluster to join the Teleport cluster.
  auth export                                       Export public cluster CA certificates to stdout.
  auth sign                                         Create an identity file(s) for a given user.
  auth rotate                                       Rotate certificate authorities in the cluster. Starts in interactive mode by default, provide --type to manually send rotation requests.
  auth ls                                           List connected auth servers.
  auth crl                                          Export empty certificate revocation list (CRL) for Teleport certificate authorities.
  status                                            Report cluster status.
  top                                               Report diagnostic information.
  requests ls                                       Show active Access Requests.
  requests get                                      Show Access Request by ID.
  requests approve                                  Approve pending Access Request.
  requests deny                                     Deny pending Access Request.
  requests create                                   Create pending Access Request.
  requests rm                                       Delete an Access Request.
  requests review                                   Review an Access Request.
  apps ls                                           List all applications registered with the cluster.
  db ls                                             List all databases registered with the cluster.
  kube ls                                           List all Kubernetes clusters registered with the cluster.
  desktop ls                                        List all desktops registered with the cluster.
  desktop bootstrap                                 Generate a PowerShell script to bootstrap Active Directory.
  lock                                              Create a new lock.
  bots ls                                           List all certificate renewal bots registered with the cluster.
  bots add                                          Add a new certificate renewal bot to the cluster.
  bots rm                                           Permanently remove a certificate renewal bot from the cluster.
  bots update                                       Update an existing bot.
  bots instances show                               Shows information about a specific bot instance.
  bots instances list                               List bot instances.
  bots instances add                                Join a new instance onto an existing bot.
  workload-identity ls                              List workload identity configurations.
  workload-identity rm                              Delete a workload identity configuration.
  workload-identity revocations add                 Create a new revocation.
  workload-identity revocations rm                  Delete a revocation.
  workload-identity revocations ls                  List revocations.
  workload-identity revocations crl                 Fetch the signed CRL for existing revocations.
  workload-identity x509-issuer-overrides sign-csrs Sign CSRs with the SPIFFE X.509 CA keys.
  workload-identity x509-issuer-overrides create    Create an issuer override from the given certificate chains.
  inventory status                                  Show inventory status summary.
  inventory list                                    List Teleport instance inventory.
  inventory ping                                    Ping locally connected instance.
  recordings ls                                     List recorded sessions.
  recordings encryption rotate                      Rotate encryption keys used for encrypting session recordings.
  recordings encryption status                      Show current rotation status.
  recordings encryption complete-rotation           Completes an in-progress encryption key rotation.
  recordings encryption rollback-rotation           Rolls back an in-progress encryption key rotation.
  alerts list                                       List cluster alerts.
  alerts create                                     Create cluster alerts.
  alerts delete                                     Deletes a cluster alert.
  alerts ack                                        Acknowledge cluster alerts.
  alerts ack ls                                     List acknowledged cluster alerts.
  proxy ls                                          Lists proxies connected to the cluster.
  create                                            Create or update a Teleport resource from a YAML file.
  update                                            Update resource fields.
  rm                                                Delete a resource.
  get                                               Print a YAML declaration of various Teleport resources.
  edit                                              Edit a Teleport resource.
  devices add                                       Register managed devices.
  devices ls                                        Lists managed devices.
  devices rm                                        Removes a managed device.
  devices enroll                                    Creates a new device enrollment token.
  devices lock                                      Locks a device.
  saml export                                       Export a SAML signing key in .crt format.
  acl ls                                            List cluster Access Lists.
  acl get                                           Get detailed information for an Access List.
  acl users add                                     Add a user to an Access List.
  acl users rm                                      Remove a user from an Access List.
  acl users ls                                      List users that are members of an Access List.
  login_rule test                                   Test the parsing and evaluation of login rules.
  idp saml test-attribute-mapping                   Test expression evaluation of attribute mapping.
  audit query get                                   Get audit query.
  audit query rm                                    Remove audit query.
  audit query ls                                    List audit queries.
  audit query exec                                  Execute audit query.
  audit query create                                Create an audit query.
  audit schema                                      Print audit query schema.
  audit report ls                                   List security reports.
  audit report get                                  Get security report.
  audit report run                                  Run the security report.
  audit report state                                Print the state of the security report.
  plugins cleanup                                   Cleans up the given plugin type.
  plugins install okta                              Install an Okta integration.
  plugins install scim                              Install a Teleport SCIM plugin.
  plugins install entraid                           Install an Microsoft Entra ID integration.
  plugins install netiq                             Install an Access Graph NetIQ integration.
  plugins install awsic                             Install an AWS IAM Identity Center integration.
  plugins install github                            Install an Access Graph Github integration.
  plugins delete                                    Remove a plugin instance.
  plugins edit awsic                                Edit an AWS IAM Identity Center integration's settings.
  plugins rotate awsic                              Rotate the AWS Identity Center SCIM bearer token.
  notifications create                              Create a cluster notification.
  notifications ls                                  List notifications which were manually created using `tctl notifications create`. By default, this will list notifications capable of targeting multiple users, such as role-based ones. To list notifications directed only at a specific user, use the --user flag. To include notifications generated by Teleport, use --all.
  notifications rm                                  Remove a cluster notification.
  sso configure github                              Configure GitHub auth connector.
  sso configure saml                                Configure SAML auth connector, optionally using a preset. Available presets: [okta onelogin ad adfs].
  sso configure oidc                                Configure OIDC auth connector, optionally using a preset. Available presets: [google gitlab okta].
  sso test                                          Perform end-to-end test of SSO flow using provided auth connector definition.
  terraform env                                     Obtain certificates and load them into environments variables. This creates a temporary MachineID bot.
  autoupdate client-tools status                    Prints if the client tools updates are enabled/disabled, and the target version in specified format.
  autoupdate client-tools enable                    Enables client tools auto updates. Clients will be told to update to the target version.
  autoupdate client-tools disable                   Disables client tools auto updates. Clients will not be told to update to the target version.
  autoupdate client-tools target                    Sets the client tools target version. This command is not supported on Teleport Cloud.
  autoupdate agents status                          Prints agents auto update status.
  autoupdate agents report                          Aggregates the agent autoupdate reports and displays agent count per version and per update group.
  autoupdate agents start-update                    Starts updating one or many groups.
  autoupdate agents mark-done                       Marks one or many groups as done updating.
  autoupdate agents rollback                        Rolls back one or many groups.
  stable-unix-users ls                              List the stable UNIX users currently persisted in the cluster.
  bound-keypair request-rotation                    Request a keypair rotation on the next join attempt.
  scoped tokens add                                 Create a scoped invitation token.
  scoped tokens rm                                  Delete/revoke a scoped invitation token.
  scoped tokens ls                                  List invitation tokens.
  scoped status                                     Show the status of scoped resources

Try 'tctl help [command]' to get help for a given command.