CLI Overview

Install and get started with the Arkveil CLI for managing datasources, datasets, policies, tests, and SDK codegen.

What is the Arkveil CLI

The Arkveil CLI (arkveil) is the command-line client for the Arkveil API. It manages navigation trees, datasources, datasets, actions, targets, policies, tags, access tests, and attribute schemas, and drives ABAC decision-making and SDK codegen for the arkveil-js SDK from the terminal or CI.

Requires Node.js >= 20.

Install

From npm:

npm install -g @arkveil/cli

Without installing:

npx @arkveil/cli --help

Shell installer (no npm required — downloads the package tarball directly from the npm registry):

curl -fsSL https://raw.githubusercontent.com/arkveil-abac/arkveil-cli/main/install.sh | bash

To uninstall:

curl -fsSL https://raw.githubusercontent.com/arkveil-abac/arkveil-cli/main/install.sh | bash -s -- --uninstall

The installer extracts to $HOME/.arkveil/lib (override with ARKVEIL_INSTALL_DIR) and writes a launcher script to an auto-detected bin directory (override with ARKVEIL_BIN_DIR; falls back to /usr/local/bin if writable, else $HOME/.local/bin). It doesn't build native keytar, so credentials fall back to file-based storage — see Authentication.

Other installer env vars: ARKVEIL_VERSION (pin a version), ARKVEIL_REGISTRY (alternate npm registry).

From source:

pnpm install
pnpm build
node bin/cli.js --help

# or link onto PATH
npm link
arkveil --help

Whichever install method you use, the command is always arkveil.

Quick start

# Authenticate (opens a browser for device authorization)
arkveil auth login

# Check connectivity
arkveil health

# See who you're logged in as
arkveil auth whoami

# Explore your workspace's navigation trees
arkveil trees all

# Generate a typed SDK file for arkveil-js
arkveil generate typescript -o src/arkveil.generated.ts

Global flags

These apply to every command:

Flag	Description
`--json`	Machine-readable JSON on stdout; disables spinners/color.
`-q, --quiet`	Suppress non-essential status output.
`-v, --verbose`	Print transport diagnostics to stderr (method, URL, request id, retries).
`--no-color`	Disable ANSI color.
`--base-url <url>`	Override the API base URL.
`--api-key <token>`	Bearer token, overrides stored credentials.
`--workspace <id>`	Workspace id, sent as `X-Workspace-Id`.
`--config-dir <dir>`	Override the config/credentials directory.
`--timeout <ms>`	Per-request timeout.
`-V, --version`	Print the CLI version.
`-h, --help`	Show help for any command or subcommand.

Color and spinners are automatically disabled when stdout isn't a TTY, or when NO_COLOR is set.

Next steps

Authentication — device login, API keys, workspaces.
Configuration — config file, environment variables, exit codes, networking.
Command reference — the full list of commands, flags, and examples.