Usage: tctl [] [ ...] Admin tool for the Teleport Infrastructure Identity Platform Flags: -d, --[no-]debug Enable verbose logging to stderr -c, --config=CONFIG Path to a configuration file [/etc/teleport.yaml] for an Auth Service instance. Can also be set via the TELEPORT_CONFIG_FILE environment variable. Ignored if the auth_service is disabled. --auth-server=AUTH-SERVER ... Attempts to connect to specific auth/proxy address(es) instead of local auth [127.0.0.1:3025] ($TELEPORT_AUTH_SERVER) -i, --identity=IDENTITY Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign' ($TELEPORT_IDENTITY_FILE) --[no-]insecure When specifying a proxy address in --auth-server, do not verify its TLS certificate. Danger: any data you send can be intercepted or modified by an attacker. Commands: help Show help. version Print the version of your tctl binary. users add Generate a user invitation token [Teleport local users only]. users update Update user account. users ls Lists all user accounts. users rm Deletes user accounts. users reset Reset user password and generate a new token [Teleport local users only]. nodes add Generate a node invitation token. nodes ls List all active SSH nodes within the cluster. tokens add Create a invitation token. tokens rm Delete/revoke an invitation token. tokens ls List node and user invitation tokens. tokens configure-kube Creates a token allowing workload from the Kubernetes cluster to join the Teleport cluster. auth export Export public cluster CA certificates to stdout. auth sign Create an identity file(s) for a given user. auth rotate Rotate certificate authorities in the cluster. Starts in interactive mode by default, provide --type to manually send rotation requests. auth ls List connected auth servers. auth crl Export empty certificate revocation list (CRL) for Teleport certificate authorities. status Report cluster status. top Report diagnostic information. requests ls Show active Access Requests. requests get Show Access Request by ID. requests approve Approve pending Access Request. requests deny Deny pending Access Request. requests create Create pending Access Request. requests rm Delete an Access Request. requests review Review an Access Request. apps ls List all applications registered with the cluster. db ls List all databases registered with the cluster. kube ls List all Kubernetes clusters registered with the cluster. desktop ls List all desktops registered with the cluster. desktop bootstrap Generate a PowerShell script to bootstrap Active Directory. lock Create a new lock. bots ls List all certificate renewal bots registered with the cluster. bots add Add a new certificate renewal bot to the cluster. bots rm Permanently remove a certificate renewal bot from the cluster. bots update Update an existing bot. bots instances show Shows information about a specific bot instance. bots instances list List bot instances. bots instances add Join a new instance onto an existing bot. workload-identity ls List workload identity configurations. workload-identity rm Delete a workload identity configuration. workload-identity revocations add Create a new revocation. workload-identity revocations rm Delete a revocation. workload-identity revocations ls List revocations. workload-identity revocations crl Fetch the signed CRL for existing revocations. workload-identity x509-issuer-overrides sign-csrs Sign CSRs with the SPIFFE X.509 CA keys. workload-identity x509-issuer-overrides create Create an issuer override from the given certificate chains. inventory status Show inventory status summary. inventory list List Teleport instance inventory. inventory ping Ping locally connected instance. recordings ls List recorded sessions. recordings encryption rotate Rotate encryption keys used for encrypting session recordings. recordings encryption status Show current rotation status. recordings encryption complete-rotation Completes an in-progress encryption key rotation. recordings encryption rollback-rotation Rolls back an in-progress encryption key rotation. alerts list List cluster alerts. alerts create Create cluster alerts. alerts delete Deletes a cluster alert. alerts ack Acknowledge cluster alerts. alerts ack ls List acknowledged cluster alerts. proxy ls Lists proxies connected to the cluster. create Create or update a Teleport resource from a YAML file. update Update resource fields. rm Delete a resource. get Print a YAML declaration of various Teleport resources. edit Edit a Teleport resource. devices add Register managed devices. devices ls Lists managed devices. devices rm Removes a managed device. devices enroll Creates a new device enrollment token. devices lock Locks a device. saml export Export a SAML signing key in .crt format. acl ls List cluster Access Lists. acl get Get detailed information for an Access List. acl users add Add a user to an Access List. acl users rm Remove a user from an Access List. acl users ls List users that are members of an Access List. login_rule test Test the parsing and evaluation of login rules. idp saml test-attribute-mapping Test expression evaluation of attribute mapping. audit query get Get audit query. audit query rm Remove audit query. audit query ls List audit queries. audit query exec Execute audit query. audit query create Create an audit query. audit schema Print audit query schema. audit report ls List security reports. audit report get Get security report. audit report run Run the security report. audit report state Print the state of the security report. plugins cleanup Cleans up the given plugin type. plugins install okta Install an Okta integration. plugins install scim Install a Teleport SCIM plugin. plugins install entraid Install an Microsoft Entra ID integration. plugins install netiq Install an Access Graph NetIQ integration. plugins install awsic Install an AWS IAM Identity Center integration. plugins install github Install an Access Graph Github integration. plugins delete Remove a plugin instance. plugins edit awsic Edit an AWS IAM Identity Center integration's settings. plugins rotate awsic Rotate the AWS Identity Center SCIM bearer token. notifications create Create a cluster notification. notifications ls List notifications which were manually created using `tctl notifications create`. By default, this will list notifications capable of targeting multiple users, such as role-based ones. To list notifications directed only at a specific user, use the --user flag. To include notifications generated by Teleport, use --all. notifications rm Remove a cluster notification. sso configure github Configure GitHub auth connector. sso configure saml Configure SAML auth connector, optionally using a preset. Available presets: [okta onelogin ad adfs]. sso configure oidc Configure OIDC auth connector, optionally using a preset. Available presets: [google gitlab okta]. sso test Perform end-to-end test of SSO flow using provided auth connector definition. terraform env Obtain certificates and load them into environments variables. This creates a temporary MachineID bot. autoupdate client-tools status Prints if the client tools updates are enabled/disabled, and the target version in specified format. autoupdate client-tools enable Enables client tools auto updates. Clients will be told to update to the target version. autoupdate client-tools disable Disables client tools auto updates. Clients will not be told to update to the target version. autoupdate client-tools target Sets the client tools target version. This command is not supported on Teleport Cloud. autoupdate agents status Prints agents auto update status. autoupdate agents report Aggregates the agent autoupdate reports and displays agent count per version and per update group. autoupdate agents start-update Starts updating one or many groups. autoupdate agents mark-done Marks one or many groups as done updating. autoupdate agents rollback Rolls back one or many groups. stable-unix-users ls List the stable UNIX users currently persisted in the cluster. bound-keypair request-rotation Request a keypair rotation on the next join attempt. scoped tokens add Create a scoped invitation token. scoped tokens rm Delete/revoke a scoped invitation token. scoped tokens ls List invitation tokens. scoped status Show the status of scoped resources Try 'tctl help [command]' to get help for a given command.