Reference
Every command an operator runs on the host, and the route families the console calls. Filter, then copy.
| Name | What it does | Try it · who may call |
|---|---|---|
| Workspaces | ||
workspace-agent | Create, start, stop, assign and destroy workspaces, with --docker off|managed|full, --postgres and --languages at create. With the Docker broker, the only component that talks to the host's Docker; developers never run it. | bin/workspace-agent create --tenant acme --workspace dev01 --owner dev@example.test --ide |
docker-broker | Managed Docker for one workspace, through its own deny-by-default broker: it refuses privileged containers, host namespaces, binds outside the workspace, other workspaces' networks and unlisted registries. Off until an organisation allows Docker (workspace_docker_allowed); not available on members' computers. | bin/docker-broker list acme dev01 --json |
workspace-postgres | Each workspace's own Postgres, beside it on a network only that workspace reaches: up, status, down, drop-data, list, reap. On by default for new workspaces; skipped on members' computers. | bin/workspace-postgres status --tenant acme --workspace dev01 |
dev-offboard | Remove a developer for good, archiving their home first unless told otherwise. | bin/dev-offboard --dev dev01 --dry-run |
account-recover | Set a role, reset a password or show an account, from the host. | bin/account-recover show --email dev@example.test |
| Policy | ||
policy | Read and set every setting at platform, organisation or user scope. resolve says which value wins, and why. | bin/policy resolve --user dev@example.test --repo owner/name |
tenant-audit | Which organisations get more than the default, with a verdict per row. | bin/tenant-audit |
| Egress | ||
egress-proxy | The hostname proxy. summary ranks what was reached: build the allowlist from it. | bin/egress-proxy summary --days 14 |
egress-firewall | The fail-closed firewall that makes the proxy unavoidable. verify exits 1 if it is fail-open or absent. Needs root. | bin/egress-firewall verify |
egress-coverage | Which organisation networks the firewall covers, one sentence each. | bin/egress-coverage |
dns-filter | The per-organisation DNS filter: which gateways answer, which do not. | bin/dns-filter status |
| Brokers | ||
git-broker | Git over a per-workspace socket, with no GitHub credential in the container. check asks whether a push would pass. | bin/git-broker check --tenant acme --workspace dev01 --ref refs/heads/main |
gh-app-token | Mint a short-lived GitHub App token for one repository. --dry-run touches neither key nor network. | bin/gh-app-token --repo acme/api --dry-run |
claude-proxy | The model proxy: the real Anthropic credential stays on the host; each workspace gets its own key. | bin/claude-proxy status |
key-broker | Holds other providers’ credentials on the host. Off until an operator starts it. | bin/key-broker providers |
portal-broker | The workspace-to-console channel: an agent in a workspace lists, starts and stops its owners’ other workspaces in the same organisation, asks for a new one and records app feedback. It cannot change settings, members or credentials, and every call is audited. Off until an organisation turns on workspace_portal_api_enabled. | bin/portal-broker status |
front-door | The authenticating proxy every workspace request arrives through. | bin/front-door status |
| Audit and evidence | ||
audit-log | Query, verify and export the hash-chained record. verify names the stream and line of any break. | bin/audit-log verify |
audit-log export | Emit records for a SIEM: cef, leef, json, csv or syslog. | bin/audit-log export --format cef --stream egress --out egress.cef |
compliance-report | Score this host’s technical controls against ISO 27001, SOC 2 or NIST 800-53. Text, JSON or HTML. | bin/compliance-report --framework soc2 |
supply-chain | Pins, a CycloneDX SBOM and a release manifest. | bin/supply-chain sbom --out sbom |
| Operations | ||
provision-host | Bring the serving tier up on another machine over ssh. --check is a read-only report. | bin/provision-host --host 203.0.113.10 --user ops --check |
deploy | Publish one commit’s files byte for byte; status, verify, push, rollback. | bin/deploy verify --ref main |
whats-running | Whether the live code is the code you pulled, unit by unit. | bin/whats-running |
backup | Encrypted per-unit backups; verify re-opens every part. Refuses without a key. | bin/backup verify <name> |
deployment-readiness | The evidence step behind governed-run grants. | bin/deployment-readiness --prepare |
store-drift | Disagreements between the store and the files that mirror it. | bin/store-drift report |
obs-log | The ops log: tail, query by correlation id, errors, metrics. Off by default. | bin/obs-log errors --since 1h |
fetch-verified | Download a file and install it only if its sha256 matches. | bin/fetch-verified <url> <sha256> <dest> |
| Route families (internal, not a public API) | ||
/api/livez · /api/readyz2 routes | Health. livez reads nothing; readyz names the failing check. | Public |
/portal/__login · /portal/__logout · /portal/sso/…3 routes | Sign-in, sign-out and the per-organisation SSO entry points. | Public |
/api/invitations/… · /api/verify/… · /api/reset/…7 routes | Invitation, email verification and password reset. Each carries its own token. | Anonymous |
/api/me/… · /api/console/scope6 routes | Who this session is and which console it gets, plus the caller’s own requests to their organisation and their own computers. Each answers only for the caller. | Signed-in session |
/api/orgs/:org/…78 routes | Organisation settings, members, workspaces, requests, computers, the audit dashboard and its export, and AI usage. The member’s role is checked after the session; the audit and AI usage routes answer owners, admins and auditors. | Signed-in session |
/api/workspace/:org/:ws/…84 routes | Everything one workspace does: start, stop, logs, ports, Git, preview, attach tokens, its Docker and its database. | Workspace owner |
/ws/:org/:ws/…2 routes | The workspace itself and its preview ports, through the front door. | Workspace owner |
/api/workspaces/…4 routes | List, create and reassign workspaces. Creation is an admin action. | Signed-in session |
/api/console/…26 routes | The operator console: credentials, platform health, inventory, cluster, settings, mail and the changelog. | Operator session |
/api/policy · /api/governance · /api/proxy5 routes | Platform policy and the egress proxy’s view. | Operator session |
/api/ai/…5 routes | AI providers, model configuration and rates. Two are operator-only. | Signed-in session |
/api/audit · /api/audit/export1 route | The audit view and its SIEM export. | Operator session |
/api/workspace-channel/…7 routes | The workspace-to-console channel. Open at the gate, but every call needs the portal broker’s secret and a workspace key. | Broker secret |
/api/hosts/…7 routes | Hosts that run workspaces: a worker host or a member’s own computer enrols, fetches the agent and the workspace image, reports and keeps its channel open. Only the installer script is anonymous, and it holds no secret; the rest need a live enrolment token or the host’s own key. Both are off by default. | Enrolment token or host key |
Nothing matches. Try a command name without bin/.
Commands on the host
The table lists the 29 tools in bin/ an operator reaches for most; there are more, and each prints its own usage. Run them from the checkout the running console uses, as the user that runs it. workspace-agent and, for workspaces with managed Docker, docker-broker are the only components that talk to the host's Docker, and membership of the docker group is root-equivalent, so developers are never in it.
No generated CLI reference yet. The descriptions above are written from each tool’s own usage text on the main branch. A reference generated from every --help is planned.
Route families (internal, not a public API)
The console talks to the host over about 240 JSON routes (242 declared on the main branch at orxy V1.7.2.2; the counts in the table are declarations, and one declaration may answer more than one method). Each one declares who may call it, and a route without that declaration stops the process from starting. They exist to serve the console, and they change between releases without notice.
- Public
- Health, sign-in and SSO entry points. Nothing private is read.
- Anonymous
- Invitation, verification and reset flows, which carry their own token.
- Signed-in session
- A member’s session cookie. Organisation routes then check the member’s role.
- Operator session
- A platform operator. Organisation roles grant nothing on the host.
- Workspace owner
- Only that workspace’s owner, checked on every request.
- There is no public API. No OpenAPI description, no SDK, no webhooks and no personal API tokens.
- Calls ride a person’s session. Outside clients have no key to use; script against the
bin/tools instead.
Settings keys
Settings resolve across scopes, and the strictest value wins: an organisation can tighten the host’s setting, never loosen it. bin/policy tunables --json prints every setting, its value and where that value came from.
| Key | Default | What it does |
|---|---|---|
egress_enforce | observe | observe decides, logs and allows. deny enforces the allowlist, from the next connection. |
egress_allowlist | GitHub, npm, PyPI, Anthropic, Open VSX | Comma-separated hosts. An organisation’s list is added to the host’s and can never remove from it. |
workspace_file_transfer | off | off, download, upload or both, per organisation. Covers the Files pane, the browser IDE, copy tools in the terminal and copy over desktop attach; below both, GitHub is reached only through the git broker. |
workspace_docker_allowed | off | off, managed or full. An organisation may choose managed; only a platform operator may allow full. |
git_validation_gate_enabled | false | A push needs a passing verdict for its exact commit. Per organisation. |
ai_in_apps_enabled | false | Records whether apps built in a workspace may call a model through the platform’s brokers. It does not block a request. |
“Require identity” (portal_require_identity) is kept in the control store rather than set with the policy tool. It is off by default; while it is off, the shared front-door password is not tied to a person.
A selection, not the full list. Every key, with its scope, default, allowed values and one-way rule, is on Policy keys.
Audit streams
The audit record is kept as eight hash-chained streams: git, egress, claude, keys, policy, detect, workspace and identity. Every allowed push adds a push.authorship event naming who made its tip commit: agent, human-console or unattributed, never a bare human.
No event catalogue yet. The full list of event types is planned. Until then, bin/audit-log query --json shows the fields as they are written.
Environment variables
OPERATOR_EMAIL- The first operator’s email. The serving tier creates that account once, if it does not exist.
OPERATOR_PASSWORD- Its password, at least 12 characters. Read from the environment so it never appears on a command line.
FRONT_DOOR_PASSWORD- The shared front-door password. Unattributable to a person while
portal_require_identityis off.
What this reference does not cover yet
- Internal names. Some paths, units and variables inside the product still carry an older internal name. They are left out here and do not change behaviour.
- Every route. Families are shown, not the 240 routes one by one, because the routes are internal and move.
- Versioning. Releases carry names, such as orxy V1.7.2.2, and the changelog dates each one. Routes and command output carry no version of their own and can change between releases.
Next
Verified against the main branch, 4 Oct 2026 (orxy V1.7.2.2).