ReferenceCLI reference
noodle platform-auth
Run the super-admin WorkOS platform-auth migration, rollout, and account-reset workflow.
Run the super-admin WorkOS platform-auth migration, rollout, and account-reset workflow.
Usage
noodle platform-auth migration|account-resetSubcommands
migration inventory— Build or inspect a bounded identity inventory generation.--generation <n>— Reuse the same generation until inventory reaches a terminal state. (default 0; minimum 0)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration preview— Preview one migration operation without changing state.--operation start_import|reconcile|recover_outbox|activate|rollback|finalize— Migration operation to preview. (required)--batch-size <1-100>— Maximum identities advanced by one bounded operation. (default 100; range 1-100)--percentage <1-100>— Percentage of platform authentication traffic assigned to WorkOS. (range 1-100)--cohort-mode preserve|replace— Whether activation preserves or replaces the current client cohorts.--canary-client-id <id>— Canary client included when replacing activation cohorts. (repeatable)--recovery-client-id <id>— Recovery client included when replacing activation cohorts. (repeatable)--acceleration-approval <path>— Optional mode-0600 typed approval for the exact accelerated WorkOS stage transition; activate only.--rollback-rehearsal-checksum <checksum>— Checksum of the approved rollback rehearsal evidence. (64 characters)--staging-workos-only-smoke-checksum <checksum>— Checksum of the approved staging WorkOS-only smoke evidence. (64 characters)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration status— Inspect the current migration and rollout state.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration start-import— Start the approved WorkOS identity import.--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Confirm an approved mutation non-interactively.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration reconcile— Advance one approved reconciliation batch.--batch-size <1-100>— Maximum identities advanced by one bounded operation. (required; range 1-100)--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Confirm an approved mutation non-interactively.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration recover-outbox— Advance one approved outbox-recovery batch.--batch-size <1-100>— Maximum identities advanced by one bounded operation. (required; range 1-100)--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Confirm an approved mutation non-interactively.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration activate— Activate the approved WorkOS traffic cohort.--percentage <1-100>— Percentage of platform authentication traffic assigned to WorkOS. (required; range 1-100)--cohort-mode preserve|replace— Whether activation preserves or replaces the current client cohorts. (required)--canary-client-id <id>— Canary client included when replacing activation cohorts. (repeatable)--recovery-client-id <id>— Recovery client included when replacing activation cohorts. (repeatable)--acceleration-approval <path>— Optional mode-0600 typed approval for the exact accelerated WorkOS stage transition; activate only.--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Confirm an approved mutation non-interactively.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration rollback— Roll back the approved WorkOS activation.--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Confirm an approved mutation non-interactively.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
migration finalize— Finalize the approved WorkOS federation migration.--rollback-rehearsal-checksum <checksum>— Checksum of the approved rollback rehearsal evidence. (required; 64 characters)--staging-workos-only-smoke-checksum <checksum>— Checksum of the approved staging WorkOS-only smoke evidence. (required; 64 characters)--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Confirm an approved mutation non-interactively.--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
account-reset preview— Preview one account-reset operation without changing state; flags are conditional.--operation quarantine|rollback|finalize— Account-reset operation to preview. (required)--target-file <path>— For quarantine previews this flag is required; it is forbidden for rollback/finalize previews. Secure 0600 JSON file containing exactly three principal IDs.--operation-id <reset-operation-id>— For rollback/finalize previews this identifier is required; it is forbidden for quarantine previews, status and mutations require it. (8-256 characters)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
account-reset status— Inspect one account-reset operation using its opaque identifier.--operation-id <reset-operation-id>— For rollback/finalize previews this identifier is required; it is forbidden for quarantine previews, status and mutations require it. (required; 8-256 characters)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
account-reset quarantine— Quarantine the three approved account-reset targets.--operation-id <reset-operation-id>— For rollback/finalize previews this identifier is required; it is forbidden for quarantine previews, status and mutations require it. (required; 8-256 characters)--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Required confirmation for an approved account-reset mutation. (required)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
account-reset rollback— Restore the three quarantined account-reset targets.--operation-id <reset-operation-id>— For rollback/finalize previews this identifier is required; it is forbidden for quarantine previews, status and mutations require it. (required; 8-256 characters)--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Required confirmation for an approved account-reset mutation. (required)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
account-reset finalize— Finalize cleanup for the three approved account-reset targets.--operation-id <reset-operation-id>— For rollback/finalize previews this identifier is required; it is forbidden for quarantine previews, status and mutations require it. (required; 8-256 characters)--expected-generation <n>— Inventory generation the mutation is approved against. (required; minimum 0)--release-sha <sha>— Exact lowercase release commit approved for the mutation. (required; 40 characters)--preview-checksum <checksum>— Checksum of the approved operation preview. (required; 64 characters)--idempotency-key <key>— Private replay key for an approved mutation. (required; 8-256 characters)--reason <text>— Operator reason recorded with the mutation. (required; 1-256 characters)--yes— Required confirmation for an approved account-reset mutation. (required)--service <url>— Control-plane service URL.--auth-token <token>— Control-plane authentication token.--json— Emit one JSON result envelope.
Run noodle platform-auth --help for the latest options and details.