Skip to content

Command reference

Run truto <command> --help for flags and filters on any command.

Authentication and profiles

Command Description
truto login Authenticate interactively or with --token
truto logout Remove stored credentials
truto whoami Show the profile, API URL and team
truto profiles List, switch, get, and set profile values
truto profiles current Show the active profile, API URL and team (same as whoami)
truto use <profile> Shortcut for profiles use
truto profiles set-key Store Anthropic/Fireworks/Firecrawl keys for builds

Integrations

Command Description
truto integrations CRUD integration definitions
truto integrations init Scaffold a starter integration
truto integrations validate Validate config against OpenAPI schema
truto integrations tools List tools/methods for an integration
truto integrations unified-apis List unified APIs for an integration
truto integrations build AI-powered build → local JSON file
truto integrations apply Reconcile, check, apply and verify eligible IntegrationFile work
truto integrations lint Static audit of integration config
truto integrations verify <file> --spec <path-or-url> Check an IntegrationFile against the vendor's OpenAPI/Swagger document — coverage, verbs, schemas, auth, pagination, and more. Read-only (see note below)
truto integrations audit <file-or-slug> -a <account-id> Exercise each method against a real connected account and report a per-method verdict. Read-only by default (see note below)
truto integrations add-method Add one method to a resource
truto categories List integration categories

verify checks operation coverage, verbs, body format, schemas, response path, base URL, auth, and pagination against the vendor's OpenAPI 3.x / Swagger 2.0 document. --out <report.json> saves the full report; --top <n> sets how many findings the summary lists (default 20).

audit's behavior:

  • Default --capability read-only sends a method only when it's provably a read; unified methods are always skipped.
  • Within 30 minutes of a write to the integration or its environment row, it first refreshes the config cache (POST /integrated-account/refresh-mapping-cache) and waits about 7 minutes — sending nothing if that refresh fails.
  • --capability full runs real writes, and only works on a sandbox account.
  • Other flags: --surface proxy,unified, --resource, --concurrency (default 4), --timeout <ms> (default 20000), --max-methods (default 50), --fixtures <file>, --skip-static.

Unified mappings

Command Description
truto unified-mappings build AI-powered build of unified mapping rows → local JSON file
truto unified-mappings validate Audit a MappingFile (deterministic, no writes)
truto unified-mappings apply Reconcile mapping cells with base/env rows and verify eligible reads

Admin resources

Command Description
truto accounts Integrated accounts (connections)
truto accounts identify Quick summary of one connected account
truto accounts validate <id> Run the integration's validation steps against one connected account and report what they found
truto accounts refresh-mapping-cache Make a config, mapping, or unified model edit take effect now, instead of waiting for the cache to expire (see note below)
truto tenants Manage tenants (external identities that own integrated accounts)
truto tenants create-bulk Create or upsert up to 1000 tenants (--mode insert|upsert)
truto environments Environments (list, get, update)
truto environment-integrations Per-environment integration installs
truto environment-integrations override-auth <id> Set the authorization override (--format (bearer, header, basic) with --config <json>, or the full block with -b/--stdin). Patches only that block; --clear removes it
truto environment-integrations override-pagination <id> Set the pagination override (--format (page, cursor, link_header, offset, range, dynamic) with --config <json>, or -b/--stdin); --clear removes it
truto environment-integrations override-rate-limit <id> Set the rate-limit override with JSONata: --is-rate-limited, --retry-after-header, --rate-limit-header (or -b/--stdin); --clear removes it
truto environment-integrations override-webhook <id> Set the webhook override: --signature-verification <json>, --handle-verification <expr>, --payload-transform <expr> (or -b/--stdin); --clear removes it
truto environment-integrations show-override <id> Print the current override for an environment integration
truto api-tokens API tokens (list, get)
truto sync-jobs Sync job definitions
truto sync-job-runs Sync job execution records
truto sync-job-triggers Cron triggers for sync jobs
truto sync-job-templates Reusable sync templates
truto sync-job-run-states Key-value state for sync runs
truto workflows Event-triggered automations
truto workflow-runs Workflow execution records
truto webhooks Outbound webhooks
truto notification-destinations Slack/email alert targets
truto observability-destinations Log forwarding destinations: Datadog, Splunk HEC, Microsoft Sentinel, OTLP, Elasticsearch, S3 (list, get, create, update, delete)
truto observability-destinations test <id> Send a test log to a destination
truto analytics dashboard Everything the Dashboard shows in one call — headline numbers, integrations, status codes, errors, and the most active accounts. Cached for up to 6 hours (see note below)
truto mcp-tokens MCP tokens (per account)
truto unified-models Unified model definitions
truto unified-model-mappings Base unified model mapping rows
truto env-unified-models Environment unified model installs
truto env-unified-model-mappings Per-environment mapping overrides
truto datastores S3, GCS, Azure Blob, Postgres, BigQuery, Snowflake, Pinecone, Qdrant connections
truto daemons Background worker identities (Daemons)
truto daemon-jobs Daemon job definitions
truto daemon-job-runs Daemon job runs
truto daemon-job-triggers Daemon cron triggers
truto users Team members (list, get)
truto team Team settings
truto gates Static IP egress proxies
truto docs Integration/model documentation rows
truto link-tokens Truto Link connect tokens (create)
truto session-tokens create --tenant-id <id> Mint a session token for one tenant in one environment (see note below for flags)
truto session-tokens revoke --tenant-id <id> Revoke every live session token for one tenant in one environment
truto session-tokens inspect [token] Describe a session token, or the profile's own credential when no token is given
truto logs Query platform logs
truto schema Download OpenAPI schema
truto files Upload files to Truto-hosted URLs

refresh-mapping-cache: -e <environment-id> picks the environment (default: the token's); -i <integration-id> limits the refresh to one integration.

analytics dashboard: --range (mtd, last_month, 7d, 30d, 90d; default mtd) or --from/--to YYYY-MM-DD; filter with --integration, --category.

session-tokens create flags: --expires-in (60–3600 s, default 900), --max-lifetime (60–86400 s, default 43200), --no-refreshable, --allowed-origins, --create-tenant-if-missing.

Team access

These manage sign-in for your Truto team. Listing works with any credential that can see the team; creating, changing, or deleting needs a team admin, and API tokens are refused. See SSO and SCIM.

Command Description
truto sso-connections SAML and OIDC identity provider connections (list, get, create, update, delete)
truto sso-connections domains <id> List the email domains attached to a connection
truto sso-connections add-domain <id> --domain <domain> Attach an email domain to a connection
truto sso-connections remove-domain <id> <domain> Remove an email domain from a connection
truto sso-connections verify-domain <id> <domain> Check the domain's DNS TXT record and mark it verified if it passes
truto scim-tokens Bearer tokens your identity provider uses for SCIM provisioning (list, get, create, delete)
truto scim-groups Groups your identity provider has pushed through SCIM (list only)
truto group-mappings Map a SCIM group to a role (admin or member) and environment access (list, create, update, delete)

Data plane

Command Description
truto unified Normalized unified API calls
truto unified test-mapping Evaluate response mappings locally (no third-party call)
truto proxy Raw proxy API calls
truto custom Custom API paths
truto batch Batch multiple operations
truto capabilities Discover methods for integration or account

Power features

Command Description
truto export Bulk export with pagination
truto diff Compare two records
truto jsonata Evaluate JSONata locally
truto open Open dashboard in browser
truto upgrade Upgrade CLI binary
truto interactive Launch interactive wizard
truto context LLM-oriented command reference

Gotchas

  • accounts vs integrated-accounts: CLI uses accounts; API path is integrated-account.
  • gates vs static-gates: CLI uses gates; API path is static-gate.
  • export / diff paths: Slash → unified (crm/contacts); no slash → proxy (tickets). Not for admin resources.
  • MCP tokens: Account ID is the first positional argument, not -a.
  • Optimistic locking: integrations update and unified-models update require the record's current version from a prior get — pass it as --lock-version <n> or as "version" in -b.
  • Schema output: truto schema returns YAML; use truto schema --out file.yml.
  • Environment scope: Your token scopes all commands to one environment automatically.
  • Mapping command names: CLI uses unified-model-mappings and env-unified-model-mappings; API paths use unified-model-resource-method and environment-unified-model-resource-method.