Command Reference

This page lists laser commands. Use laser <command> --help for flags. The setup commands auth, context, version, update, and tui work without an active context. Other commands require one.

Auth

laser auth login [--context NAME] [--api-key KEY] [--tenant-id ID]
laser auth logout [--context NAME] [--all]
laser auth purge        # destructive: drops every context and keyring entry

Without --api-key, login prompts for a masked secret. It authenticates the key with the platform and saves it in the OS keyring, the operating system's secret store.

Context

laser context create NAME [--api-key KEY] [--tenant-id ID] [--division-id ID] [--environment-id ID] [--deployment-id ID] [--activate]
laser context list
laser context current
laser context show [NAME]
laser context switch NAME           # alias: laser ctx use NAME
laser context delete NAME
laser context rename FROM TO
laser context set FIELD VALUE       # tenant_id | division_id | environment_id | deployment_id

ctx is an alias for context. A context stores the tenant and credential reference used by commands.

Tenant

tn is the tenant alias. Commands use the active context's tenant unless you supply --tenant-id.

laser tenant get
laser tenant structure       # full tree: divisions -> environments -> deployments
laser tenant summary         # aggregate counts
laser tenant update [--name NAME] [--description TEXT] [--email EMAIL] [--protected true|false]

Workspace Config

laser tenant config get
laser tenant config update [--join-policy invite_only|open|request_to_join] [--block-external-invitations true|false] [--enforce-domain-only-invitations true|false]

This displays the join policy, invitation restrictions, and claimed email domain when present. The join policy controls sign-ups that match the tenant's domain. Invitation restrictions apply only when email_domain is set.

API Keys

laser tenant key list [--name SUBSTRING] [--page N] [--results N]
laser tenant key get --api-key-id ID
laser tenant key create [--name NAME] [--role-id ID] [--division-id ID] [--expires-in-days N] [--validate-ip true|false] [--allowed-ip IP ...]
laser tenant key context
laser tenant key update-security --api-key-id ID [--validate-ip true|false] [--allowed-ip IP ...]
laser tenant key delete --api-key-id ID

tenant key get returns a key's details and resolved permissions. It requires api_key:read. tenant key context returns the same structure for the calling key, without another permission.

Repeat --allowed-ip for multiple addresses. On an interactive terminal, omitted --name, --role-id, and --expires-in-days values prompt for input. Save a new key's secret when it appears. It is displayed only once.

Cloud Accounts

laser tenant cloud-account list [--page N] [--results N]
laser tenant cloud-account get --cloud-account-id ID
laser tenant cloud-account create [--cloud aws|gcp] [--name NAME] [--account-id ID] [--region REGION] [--remarks TEXT]
laser tenant cloud-account update --cloud-account-id ID [--name NAME] [--account-id ID] [--region REGION] [--remarks TEXT] [--status active|inactive]
laser tenant cloud-account delete --cloud-account-id ID

update changes only the flags you pass.

Members and Invitations

laser tenant member list                                          # active only
laser tenant member all                                           # include inactive
laser tenant member permissions                                   # list available permissions
laser tenant member update --member-id ID [--active true|false] [--role-id ID ...]
laser tenant member delete --member-id ID

laser tenant invitation list                                      # alias: inv
laser tenant invitation create [--email EMAIL] [--message TEXT] [--role-id ID ...]
laser tenant invitation cancel --invitation-id ID

Repeat --role-id to assign multiple roles in one call.

Roles

laser tenant role list [--page N] [--results N]
laser tenant role get --role-id ID
laser tenant role create --name NAME [--description TEXT] \
                                     [--tenant-permission KEY ...] \
                                     [--division-permission KEY ...] \
                                     [--environment-permission KEY ...]
laser tenant role update --role-id ID [--name NAME] [--description TEXT] \
                                      [--tenant-permission KEY ...] \
                                      [--division-permission KEY ...] \
                                      [--environment-permission KEY ...]
laser tenant role delete --role-id ID
laser tenant role members --role-id ID
laser tenant role assign --role-id ID --member-id ID
laser tenant role revoke --role-id ID --member-id ID

Each --*-permission flag is repeatable and maps to an API scope:

--tenant-permission sets permissions.tenant.
--division-permission sets permissions.division for every division.
--environment-permission sets permissions.environment for every environment in every division.

The CLI does not expose nested overrides in permissions.divisions. Use the API for those. Run laser tenant member permissions to list valid permission keys.

Billing

laser tenant billing info
laser tenant billing reports [--page N] [--results N]
laser tenant billing report --report-id ID
laser tenant billing invoices [--page N] [--results N]
laser tenant billing invoice --invoice-id ID
laser tenant billing invoice-pdf --invoice-id ID --output FILE.pdf
laser tenant billing update-info [--name NAME] [--company NAME] [--address TEXT] [--city CITY] [--state STATE] \
                                 [--postal-code CODE] [--country CC] [--tax-id ID] [--email EMAIL] [--phone PHONE]
laser tenant billing payment-method
laser tenant billing remove-payment-method [--yes]
laser tenant billing credits
laser tenant billing redeem --code CODE
laser tenant marketplace agreements --cloud aws|gcp

update-info changes only the flags you pass, and needs a name or a company. A redeemed promo code becomes a credit. Credits reduce later invoices, oldest first, and an invoice total never drops below zero. Adding a card, and registering or linking a marketplace purchase, need the console because they run in a browser.

Division

div is the division alias.

laser division list [--page N] [--results N]
laser division get --division-id ID
laser division summary --division-id ID
laser division create [--name NAME] [--description TEXT] [--email EMAIL]
laser division update --division-id ID [--name NAME] [--description TEXT] [--email EMAIL] [--protected true|false]
laser division delete --division-id ID [--code CODE]    # protected divisions need --code

For get, update, and delete, an omitted --division-id uses the context's division_id.

Environment

env is the environment alias.

laser environment list --division-id ID [--page N] [--results N]
laser environment get --environment-id ID
laser environment create --division-id ID [--name NAME] [--description TEXT]
laser environment update --environment-id ID [--name NAME] [--description TEXT] [--protected true|false]
laser environment delete --environment-id ID [--code CODE]

Where applicable, omitted --division-id and --environment-id values use the active context.

Deployment

dep is the deployment alias. Commands cover provisioning, lifecycle, configuration, snapshots, backups, networking, and monitoring.

Subcommands accept --tenant-id, --division-id, --environment-id, and --deployment-id. An omitted flag uses the corresponding context value.

Lifecycle

laser deployment list [--environment-id ID] [--page N] [--results N]
laser deployment get [--deployment-id ID]
laser deployment update [--deployment-id ID] [--description TEXT] [--protected true|false]
laser deployment delete [--deployment-id ID] [--code CODE]
laser deployment extend [--deployment-id ID] --add-nodes N [--add-nodes N ...]
laser deployment upgrade [--deployment-id ID] [--managed-tier TIER] [--tier SIZE] [--storage-type TYPE] [--storage-size-gb N]
laser deployment retention [--deployment-id ID] --telemetry-days N
laser deployment spend-limit [--deployment-id ID] [--spend-limit USD | --clear]
laser deployment watch [--deployment-id ID] [--interval-secs N] [--timeout-mins N]

The CLI accepts extend, but the backend currently rejects node additions with cluster_extension_not_allowed. Use supported compute or storage upgrades instead. watch polls until the deployment is ready or fails. Its default interval is 5 seconds, limited to 2-60 seconds. Its default timeout is 60 minutes.

Provisioning

laser deployment preview \
    [--cloud aws|gcp] [--region REGION] [--managed-tier standard|performance|enterprise] [--tier SIZE] \
    [--storage-type network_balanced|local_ssd] [--storage-size-gb N] [--target-network-tput KBPS] \
    [--network-scope same_region|cross_region_same_cloud|cross_cloud] [--availability-mode single_az|multi_az]

laser deployment create-managed \
    [--name NAME] [--cloud aws|gcp] [--region REGION] \
    [--managed-tier standard|performance|enterprise] [--tier SIZE] [--cluster standalone|cluster] \
    [--storage-type network_balanced|local_ssd] [--storage-size-gb N] [--target-network-tput KBPS] \
    [--network-scope same_region|cross_region_same_cloud|cross_cloud] [--availability-mode single_az|multi_az] \
    [--protected true|false] [--encrypted true|false] [--dedicated true|false] \
    [--public-ip-enabled true|false] [--subdomain-enabled true|false] \
    [--telemetry-days N] [--spend-limit USD]

laser deployment create-byoc \
    [--name NAME] [--cloud aws|gcp] [--region REGION] [--tier SIZE] [--cluster standalone|cluster] \
    [--storage-type network_balanced|local_ssd] [--storage-size-gb N] [--availability-mode single_az|multi_az] \
    [--protected true|false] [--encrypted true|false] \
    [--public-ip-enabled true|false] [--subdomain-enabled true|false] \
    [--telemetry-days N] [--spend-limit USD] \
    [--aws-account-id ID] [--aws-identity-arn ARN] [--aws-external-id ID] [--aws-vpc-id ID] [--aws-vpc-cidr CIDR] \
    [--gcp-project-id ID] [--gcp-service-account-email EMAIL] [--gcp-vpc-name NAME]

laser deployment create-starter \
    [--cloud aws|gcp] [--region REGION] \
    [--environment-id ID | --environment-name NAME] [--deployment-name NAME]

preview evaluates the configuration and returns monthly pricing, estimated transfer, and the total without creating resources. Its technical capacity metadata is not a guaranteed partition limit. Paid create-managed requests require --managed-tier and --cluster cluster.

--tier selects Compute size, such as small or large. --target-network-tput sets the throughput estimate in KB/s. Omitted values use tier defaults. See Tiers & Storage.

On an interactive terminal, missing required flags prompt for input. Use create-starter to create a Free deployment for testing.

Configs

laser deployment config list      [--deployment-id ID] --kind iggy|plane|connectors|warden|connector
laser deployment config primary   [--deployment-id ID] --kind iggy|plane|connectors|warden|connector
laser deployment config schema    [--deployment-id ID] --kind iggy|plane|connectors|warden|connector
laser deployment config versions  [--deployment-id ID] --kind ... [--name NAME]
laser deployment config version   [--deployment-id ID] --kind ... [--name NAME] --version N
laser deployment config get       [--deployment-id ID] --kind ... --config-id ID
laser deployment config activate  [--deployment-id ID] --kind ... [--name NAME] --version N
laser deployment config create    [--deployment-id ID] --kind ... [--name NAME] --file FILE.json [--activate]
laser deployment config delete    [--deployment-id ID] --kind ... --config-id ID

Snapshots

Snapshots contain per-node HTML diagnostics for the system, runtimes, certificates, network, kernel parameters, and recent logs.

laser deployment snapshot list     [--deployment-id ID]
laser deployment snapshot create   [--deployment-id ID] [--redact-secrets true|false] [--include-iggy true|false] [--node-id ID ...]
laser deployment snapshot delete   [--deployment-id ID] --snapshot-id ID
laser deployment snapshot download [--deployment-id ID] --snapshot-id ID

Backups

Backups capture storage volumes at a point in time. They require AWS Network Drive storage and backup access in the account plan.

laser deployment backup list    [--deployment-id ID]
laser deployment backup create  [--deployment-id ID] --name NAME [--node-id ID] [--remarks TEXT] [--expires-in-days N]
laser deployment backup delete  [--deployment-id ID] --backup-id ID
laser deployment backup restore [--deployment-id ID] --backup-id ID

Repeat --node-id on snapshot create to cover only some nodes. backup create backs up every node unless --node-id is set.

Access Rules (Firewall)

rules is the access-rule alias.

laser deployment access-rule list   [--deployment-id ID]
laser deployment access-rule add    [--deployment-id ID] --name NAME \
                                    --cidr CIDR [--cidr CIDR ...] \
                                    [--iggy-tcp] [--iggy-http] [--iggy-websocket] [--iggy-udp] \
                                    [--valid-to RFC3339] [--remarks TEXT]
laser deployment access-rule delete [--deployment-id ID] --rules-id ID

Repeat --cidr for multiple address ranges. Select protocols with --iggy-tcp, --iggy-http, --iggy-websocket, and --iggy-udp. Set --valid-to for automatic expiry.

Networking

Peering and private endpoints follow the deployment's cloud. The CLI picks the AWS or GCP route itself. Peering needs Performance or Enterprise. Private endpoints need Enterprise.

laser deployment peering list         [--deployment-id ID]
laser deployment peering create       [--deployment-id ID] --name NAME --peer-vpc-cidr CIDR \
                                      [--peer-vpc-id ID --peer-owner-id ID [--peer-region REGION]] \
                                      [--peer-vpc-name NAME --peer-project-id ID] [--remarks TEXT]
laser deployment peering instructions [--deployment-id ID] --peering-id ID
laser deployment peering delete       [--deployment-id ID] --peering-id ID

laser deployment private-link list         [--deployment-id ID]
laser deployment private-link create       [--deployment-id ID] --name NAME \
                                           [--acceptance-required true|false] [--allowed-principal ARN ...] \
                                           [--connection-preference accept_manual|accept_automatic] \
                                           [--consumer-accept-list PROJECT ...] [--enable-proxy-protocol true|false] [--remarks TEXT]
laser deployment private-link delete       [--deployment-id ID] --service-id ID
laser deployment private-link instructions [--deployment-id ID] --service-id ID
laser deployment private-link connections  [--deployment-id ID] --service-id ID

AWS peering takes --peer-vpc-id and --peer-owner-id, GCP peering --peer-vpc-name and --peer-project-id. --acceptance-required and --allowed-principal apply to AWS PrivateLink, the other private endpoint flags and the instructions and connections commands to GCP Private Service Connect.

Connectors, Backends, Runtimes, and Tasks

laser deployment connector list     [--deployment-id ID]
laser deployment connector catalog  [--deployment-id ID] [--connector-type source|sink] [--page N] [--results N]
laser deployment connector activate [--deployment-id ID] --connector-key KEY --connector-type source|sink \
                                    [--instance-name NAME] [--instance-key KEY]
laser deployment connector delete   [--deployment-id ID] --instance-id ID

laser deployment backend list               [--deployment-id ID]
laser deployment backend configure-embedded [--deployment-id ID] [--turso-sync-url URL] [--turso-auth-token TOKEN] [--turso-sync-interval-secs N]
laser deployment backend configure-velodb   [--deployment-id ID] --dsn DSN --fe-http-url URL [...]
laser deployment backend enable             [--deployment-id ID] --backend-id ID
laser deployment backend disable            [--deployment-id ID] --backend-id ID

laser deployment runtime start|stop|restart [--deployment-id ID] --runtime iggy|connectors|connector:TYPE:KEY [--node-id ID ...]

laser deployment task list [--deployment-id ID]

Observability

laser deployment logs        [--deployment-id ID] --runtime iggy|connectors|connector:ID|warden|plane|mcp [--page N] [--results N] [--message SUBSTRING] [--level debug|info|warn|error] [--node ID] [--scope-filter NAME] [--from RFC3339] [--to RFC3339]
laser deployment activity    [--deployment-id ID] [--page N] [--results N]
laser deployment metrics     [--deployment-id ID]
laser deployment heartbeats  [--deployment-id ID]
laser deployment readiness   [--deployment-id ID] --node-id ID
laser deployment credentials [--deployment-id ID]
laser deployment network     [--deployment-id ID]

Log commands return pages. Run a command again to refresh the results. For live logs, use the TUI Logs tab.

Stream Data

deployment stream works with a deployment's own data: Iggy streams and messages, and the managed data plane. It connects as the deployment's admin user, or as --username and --password when given. Definitions too rich for flags are read from a JSON file with --file, in the shape laser-sdk sends.

Surface	Commands
Streams	`streams`, `topics`, `partitions`, `messages`, `users`, `user-get`, `clients`, `capabilities`, `whoami`
KV	`kv-namespaces`, `kv-scan`, `kv-get`, `kv-set`, `kv-cas`, `kv-delete`, `kv-delete-many`
Queries	`query`, `query-status`, `query-page`, `query-cancel`
Schemas	`schemas`, `schema-get`, `schema-register`, `schema-drop`, `schema-decode`
Projections	`projections`, `projection-get`, `projection-register`, `projection-drop`, `binding-apply`, `binding-remove`
Graphs	`graphs`, `graph-get`, `graph-register`, `graph-drop`, `graph-query`, `graph`
Forks	`forks`, `fork-create`, `fork-put-row`, `fork-promote`, `fork-delete`
Runs	`runs`, `run-get`, `run-submit`, `run-cancel`
Governance	`roles`, `role-get`, `role-define`, `role-delete`, `user-bind-roles`
Destinations	`destinations`, `destination-get`, `destination-status`, `destination-checkpoint`, `destination-retention-gap`, `destination-prepared-attempt`, `destination-table`, `destination-table-schema`, `destination-current-snapshot`, `destination-snapshots`, `destination-snapshot`, `destination-files`, `destination-metrics`, `destination-create`, `destination-enable`, `destination-disable`, `destination-operation`, `query-routes`
Consumer filters	`filters`, `filter-get`, `filter-revisions`, `filter-bindings`, `filter-binding`, `filter-operation`, `filter-metrics`, `filter-validate`, `filter-test`, `filter-preview`, `filter-register`, `filter-revise`, `filter-describe`, `filter-pause`, `filter-resume`, `filter-bind`, `filter-unbind`, `filter-archive`, `filter-drop`

laser deployment stream kv-set --namespace fleet --key sat-7 --value '{"mode":"safe"}'
laser deployment stream kv-cas --namespace fleet --key sat-7 --value '{"mode":"nominal"}' --expect-version 3
laser deployment stream schema-register --kind avro --file telemetry.avsc --name telemetry --schema-version 1
laser deployment stream filter-test --filter safe-mode.json --payload '{"after":{"mode":"safe"}}'
laser deployment stream filter-preview --filter safe-mode.json --stream fleet --topic changes --max-records 20
laser deployment stream filter-register --name sats-safe-mode --filter safe-mode.json
laser deployment stream filter-bind --stream fleet --topic changes --group ground-station --id 5 --revision 1

Catalog changes to consumer filters print their operation ID while pending. Read the outcome with filter-operation, or rerun the command with the same --operation-id. Destination reads use the local view unless --consistency linearizable is passed. filter-metrics needs an Iggy user with manage_servers. Deletes, drops, pauses, and role changes ask for confirmation unless --yes is passed.

Channel

chan is the alias for tenant notification channels. Channels support Slack, generic webhooks, and email.

laser channel list [--page N] [--results N]
laser channel get --channel-id ID
laser channel create [--kind slack|webhook|email] [--name NAME] [--destination URL_OR_ADDRESS] [--remarks TEXT]
laser channel update --channel-id ID [--name NAME] [--destination URL] [--enabled true|false] [--remarks TEXT]
laser channel delete --channel-id ID
laser channel test --channel-id ID
laser channel notifications --channel-id ID [--page N] [--results N]

--kind determines whether --destination takes a Slack webhook URL, generic webhook URL, or email address. On an interactive terminal, create prompts for omitted required values.

Cloud Catalog

cl is the cloud alias. Discovery reads the active tenant's plan and regional availability.

laser cloud list                                  # clouds available
laser cloud regions --cloud aws|gcp
laser cloud clusters --cloud aws|gcp --region REGION
laser cloud storages --cloud aws|gcp --region REGION
laser cloud tiers    --cloud aws|gcp --region REGION

laser pricing get [--rates]
laser pricing estimate managed --managed-tier TIER --cloud aws|gcp --compute-profile-id SIZE \
                               --storage-profile-id PROFILE --storage-gb-per-node N --throughput-mb-per-second MBPS
laser pricing estimate byoc --vcpus-per-node N

Pricing commands need no login. pricing get lists each managed tier per cloud with its starting price, compute, storage, availability, telemetry retention, and private networking. --rates adds compute and Local NVMe prices per node, the Network Drive price per GB, and the data transfer bands. Use -o json for the catalog as the API returns it.

Use laser cloud tiers for current tier availability, limits, Compute specifications, cluster and storage modes, and plan-dependent rate limits.

Audit

laser audit [--page N] [--results N] [--from RFC3339] [--to RFC3339] [--user USER_ID] [--author USER_ID] [--api-key API_KEY_ID] [--division ID] [--environment ID] [--deployment ID] [--types TYPE,TYPE] [--correlation-id UUID]

The tenant-wide audit log contains immutable records of changes. --user filters the action's subject. --author filters the person who performed it. --api-key filters the key used for an automated call.

System

laser version       # print CLI version
laser update        # in-place upgrade to the latest release
laser tui           # alias: laser ui (launches the dashboard)

Aliases

Long form	Alias
`context`	`ctx`
`tenant`	`tn`
`division`	`div`
`environment`	`env`
`deployment`	`dep`
`channel`	`chan`
`cloud`	`cl`
`tui`	`ui`
`tenant invitation`	`tenant inv`
`deployment access-rule`	`deployment rules`

Shell Completion

laser --generate bash       > /etc/bash_completion.d/laser
laser --generate zsh        > "${fpath[1]}/_laser"
laser --generate fish       > ~/.config/fish/completions/laser.fish
laser --generate powershell > $PROFILE.laser.ps1
laser --generate elvish     > ~/.config/elvish/lib/laser-completions.elv