bijection organization

Manage the current organization

Usage:
  bijection organization [flags]
  bijection organization [command]

Available Commands:
  delete      Delete the current organization
  get         Inspect the current organization
  invitation  Manage organization invitations
  member      Manage organization members
  oauth       Manage OAuth applications
  referral    Manage the organization's referrals
  role        Manage custom roles
  token       Manage your team tokens
  unpause     Unpause function execution across the organization (administrators)
  update      Update organization settings

Flags:
  -h, --help   help for organization

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization [command] --help" for more information about a command.

Requires team:delete and a browser session authenticated within the last 10 minutes. Personal tokens, automation keys and OAuth credentials cannot confirm this change. Atomically requests project and provisioned-deployment deletion and revokes every organization credential, including the caller. Registered deployments, WorkOS integrations, live subscriptions and active deployment work must be removed or settled first; a refusal changes nothing. The receipt confirms acceptance; workers complete provider deletion and deployment disposal. A retry using a revoked credential is refused. Sign in again and inspect your teams if the acceptance response was lost.

Usage:
  bijection organization delete [flags]

Flags:
  -h, --help   help for delete
      --json   Print the response as JSON
      --yes    Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Inspect the current organization

Usage:
  bijection organization get [flags]

Flags:
  -h, --help   help for get
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Manage organization invitations

Usage:
  bijection organization invitation [command]

Available Commands:
  cancel      Cancel a pending organization invitation
  create      Invite a member with a built-in organization role
  list        List pending and expired organization invitations

Flags:
  -h, --help   help for invitation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization invitation [command] --help" for more information about a command.

An absent or already canceled invitation returns 404.

Usage:
  bijection organization invitation cancel <email> [flags]

Flags:
  -h, --help   help for cancel
      --json   Print the response as JSON
      --yes    Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Repeating an email and role with a pending invitation succeeds without sending another invitation. A different pending role conflicts. Ambiguous provider dispatch stays unknown until reconciled by listing; it is never blindly resent. Member limits count pending invitations.

Usage:
  bijection organization invitation create <email> [flags]

Flags:
  -h, --help           help for create
      --input string   Read the complete JSON request body from a file, or - for stdin
      --json           Print the response as JSON
      --role string

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

List pending and expired organization invitations

Usage:
  bijection organization invitation list [flags]

Flags:
  -h, --help   help for list
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Manage organization members

Usage:
  bijection organization member [command]

Available Commands:
  get         Inspect an organization member and their assigned roles
  list        List active organization members and their assigned roles
  remove      Remove a member, or leave the organization
  role        Set a member's built-in role or custom role assignments

Flags:
  -h, --help   help for member

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization member [command] --help" for more information about a command.

Inspect an organization member and their assigned roles

Usage:
  bijection organization member get <member_id> [flags]

Flags:
  -h, --help   help for get
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

List active organization members and their assigned roles

Usage:
  bijection organization member list [flags]

Flags:
  -h, --help   help for list
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires member:remove for another member; every member may leave. Refuses removal of the last administrator. Credentials and issued backend keys are revoked before membership removal. An absent member returns 404.

Usage:
  bijection organization member remove <member_id> [flags]

Flags:
  -h, --help   help for remove
      --json   Print the response as JSON
      --yes    Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

The organization must retain an administrator. Directory-managed roles are changed through directory group mappings. Assigning custom roles to an admin is refused; first explicitly demote them. Built-in role assignment clears custom assignments. Provider-owned changes are reconciled by reading the member after an uncertain response.

Usage:
  bijection organization member role <member_id> [flags]

Flags:
      --custom-role-ids stringArray   Empty for a built-in role; one or more custom role IDs for role custom
  -h, --help                          help for role
      --input string                  Read the complete JSON request body from a file, or - for stdin
      --json                          Print the response as JSON
      --role string

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Manage OAuth applications

Usage:
  bijection organization oauth [command]

Available Commands:
  authorization Manage granted OAuth authorizations
  create        Register an OAuth application with a client-retained UUID and secret
  delete        Delete an OAuth application and revoke all its authorizations
  get           Inspect an OAuth application and its secret revision
  list          List the organization's OAuth applications
  secret        Replace an OAuth application secret conditionally
  update        Rename an OAuth application or replace its redirect URIs

Flags:
  -h, --help   help for oauth

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization oauth [command] --help" for more information about a command.

Manage granted OAuth authorizations

Usage:
  bijection organization oauth authorization [command]

Available Commands:
  list        List visible live OAuth authorizations
  revoke      Revoke an OAuth authorization and its backend keys

Flags:
  -h, --help   help for authorization

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization oauth authorization [command] --help" for more information about a command.

Members see their own authorizations; administrators see all. A custom role may additionally allow team-wide authorizations through team:token:view with creator selectors. Team grants do not expose another member's project-confined authorizations. Supply project_id to list one project's authorizations using project:token:view and creator selectors; project administrators may view them too.

Usage:
  bijection organization oauth authorization list [flags]

Flags:
  -h, --help                help for list
      --json                Print the response as JSON
      --project-id string   List only this project's authorizations, including those allowed by project:token:view.

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Administrators may revoke any authorization in the organization; a member may revoke their own. Custom roles may allow team-wide authorizations through team:token:delete with creator selectors. Project-confined authorizations require project:token:delete on the project, as project administrators have. An absent, already revoked or otherwise unrevocable authorization returns 404.

Usage:
  bijection organization oauth authorization revoke <id> [flags]

Flags:
  -h, --help   help for revoke
      --json   Print the response as JSON
      --yes    Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Generate and securely retain the UUID and bjos_ secret (32 random bytes in lowercase hexadecimal) before dispatch. The secret is never returned or stored in plaintext. Repeating identical inputs returns the current registration; changed inputs or a deleted identity conflict. Supply secret-bearing CLI input using --input with a private JSON file.

Usage:
  bijection organization oauth create <id> [flags]

Flags:
      --client-secret string        Client-generated secret, retained securely before dispatch
  -h, --help                        help for create
      --input string                Read the complete JSON request body from a file, or - for stdin
      --json                        Print the response as JSON
      --name string
      --redirect-uris stringArray   Unique, exact redirect URIs (HTTPS or loopback HTTP)

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Also revokes issued backend keys. A deleted or inaccessible identity returns 404.

Usage:
  bijection organization oauth delete <id> [flags]

Flags:
  -h, --help   help for delete
      --json   Print the response as JSON
      --yes    Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Inspect an OAuth application and its secret revision

Usage:
  bijection organization oauth get <id> [flags]

Flags:
  -h, --help   help for get
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

List the organization's OAuth applications

Usage:
  bijection organization oauth list [flags]

Flags:
  -h, --help   help for list
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Retain the new secret and the revision from get-oauth-application before dispatch. An identical-secret retry succeeds after a lost response. A different current revision returns 412, so a stale retry cannot revive a secret replaced since. Supply CLI secrets in a private JSON file with --input.

Usage:
  bijection organization oauth secret <id> [flags]

Flags:
      --client-secret string
      --expected-secret-revision string
  -h, --help                              help for secret
      --input string                      Read the complete JSON request body from a file, or - for stdin
      --json                              Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Rename an OAuth application or replace its redirect URIs

Usage:
  bijection organization oauth update <id> [flags]

Flags:
  -h, --help                        help for update
      --input string                Read the complete JSON request body from a file, or - for stdin
      --json                        Print the response as JSON
      --name string
      --redirect-uris stringArray   Unique, exact redirect URIs (HTTPS or loopback HTTP)

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Manage the organization's referrals

Usage:
  bijection organization referral [command]

Available Commands:
  check       Check a referral code
  get         Inspect the organization's referrals
  redeem      Redeem another organization's referral code

Flags:
  -h, --help   help for referral

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization referral [command] --help" for more information about a command.

Available to any credential of an organization. Returns the name of the organization holding the code and whether the code is exhausted; nothing else of that organization is disclosed. An unknown code, or one whose organization was deleted, returns 404.

Usage:
  bijection organization referral check <code> [flags]

Flags:
  -h, --help   help for check
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires organization view authority. Returns the organization's referral code, the organization that referred it, the existing organizations it referred and the reward. Each rewarded referral raises the free plan's included usage by amount_per_referral per billing period; the reward applies only while the organization holds the free plan, and an installation without billing limits nothing, so it reports no reward units. A deleted organization is no longer a referral.

Usage:
  bijection organization referral get [flags]

Flags:
  -h, --help   help for get
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires the built-in administrator role; custom roles and OAuth credentials cannot redeem. Records, once and permanently, that the organization was referred by the code's holder, and returns the organization's referrals. Refused with InvalidReferralCode for an unknown code, SelfReferral for the organization's own, ReferralCycle for the code of an organization it referred directly or through others, ReferralAlreadyRedeemed once any other code is redeemed, PaidSubscription while the organization has a subscription, and ReferralCodeExhausted when the code already has the most referred organizations it admits. A refusal changes nothing. The request is idempotent and takes no Idempotency-Key: the recorded referrer is its identity, so repeating it with the same code returns the same referrals, and a different code is refused with ReferralAlreadyRedeemed.

Usage:
  bijection organization referral redeem <referral_code> [flags]

Flags:
  -h, --help           help for redeem
      --input string   Read the complete JSON request body from a file, or - for stdin
      --json           Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Manage custom roles

Usage:
  bijection organization role [command]

Available Commands:
  delete      Delete an unassigned custom role (administrators)
  get         Inspect a custom role definition
  list        List the organization's custom role definitions
  put         Create or replace a complete custom role definition (administrators)
  templates   List supported starting definitions for custom roles

Flags:
  -h, --help   help for role

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization role [command] --help" for more information about a command.

Refuses roles held by current members or directory group mappings. An absent role returns 404.

Usage:
  bijection organization role delete <id> [flags]

Flags:
  -h, --help   help for delete
      --json   Print the response as JSON
      --yes    Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Inspect a custom role definition

Usage:
  bijection organization role get <id> [flags]

Flags:
  -h, --help   help for get
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

List the organization's custom role definitions

Usage:
  bijection organization role list [flags]

Flags:
  -h, --help   help for list
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Choose a UUID and submit a complete definition. Unsupported permission distinctions are refused with an explanation. Replacing a definition revokes issued backend keys beyond its new authority. PUT can recreate a deleted definition, but never restores its former member assignments. Built-in admin, deployer and viewer roles are selected on members and are not mutable custom definitions.

Usage:
  bijection organization role put <id> [flags]

Flags:
      --description string
  -h, --help                 help for put
      --input string         Read the complete JSON request body from a file, or - for stdin
      --json                 Print the response as JSON
      --name string
      --statements string

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

List supported starting definitions for custom roles

Usage:
  bijection organization role templates [flags]

Flags:
  -h, --help   help for templates
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Manage your team tokens

Usage:
  bijection organization token [command]

Available Commands:
  create      Register your team token
  delete      Revoke your team token
  get         Inspect your team token
  list        List your team tokens
  rotate      Replace your team token

Flags:
  -h, --help   help for token

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Use "bijection organization token [command] --help" for more information about a command.

Requires team:token:create. Generate and securely retain a random bb_ secret and UUID before calling. Repeat the same ID, name, secret and expiry after a lost response; revoked tokens stay revoked. The token follows your current membership, team, project and custom roles. It has no independent administrator authority. OAuth and service credentials cannot create member tokens.

Usage:
  bijection organization token create [flags]

Flags:
      --expires-at string   Optional explicit expiry, at least 30 minutes ahead; omitted means no explicit expiry. Membership and current permissions are always checked.
  -h, --help                help for create
      --id string
      --input string        Read the complete JSON request body from a file, or - for stdin
      --json                Print the response as JSON
      --name string
      --token string

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires team:token:delete, independently of view. Revokes the token and requests revocation of its issued backend keys. Repeating deletion is safe while the caller remains authorized.

Usage:
  bijection organization token delete [flags]

Flags:
  -h, --help        help for delete
      --id string
      --json        Print the response as JSON
      --yes         Confirm this destructive operation

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires team:token:view. A token owned by another member is not found.

Usage:
  bijection organization token get [flags]

Flags:
  -h, --help        help for get
      --id string
      --json        Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires team:token:view. Only your own tokens are returned, with active tokens before retained history. Bearer secrets are never returned. At most 200 entries, including at most 100 live tokens.

Usage:
  bijection organization token list [flags]

Flags:
  -h, --help   help for list
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires team:token:update. Retain the successor UUID and random secret before calling. Repeating them returns the same rotation after current authorization. Zero overlap revokes the predecessor immediately; otherwise it expires within the requested overlap, at most seven days. The successor remains bound to your current membership and permissions. Omitted expires_at gives the successor no explicit expiry.

Usage:
  bijection organization token rotate [flags]

Flags:
      --expires-at string
  -h, --help                     help for rotate
      --id string
      --input string             Read the complete JSON request body from a file, or - for stdin
      --json                     Print the response as JSON
      --overlap-seconds string
      --successor-id string
      --token string

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Visits the current deployments and unpauses function execution where possible. Billing, usage-limit, restoration and operator stops remain in force; the response reports each observed state. A null function_state means compute is not ready and was not started. An interrupted request may have unpaused earlier deployments; repeating it checks current state and safely continues. This command never maintains a desired organization-wide state that would undo later individual pauses.

Usage:
  bijection organization unpause [flags]

Flags:
  -h, --help   help for unpause
      --json   Print the response as JSON

Global Flags:
      --help-all   Show all commands and options, including administrative controls.

Requires team:update. Omitted fields preserve their current value; null clears default_region. New deployments use the saved region, while existing deployments and accepted requests keep their placement. Only a region supported by the installation is accepted. Supplied fields change together and the response is the current organization. Repeating the same values is safe.

Usage:
  bijection organization update [flags]

Flags:
      --default-region string   Default for new deployments. Null restores the installation default; omitted preserves it. Unsupported regions are refused.
  -h, --help                    help for update
      --input string            Read the complete JSON request body from a file, or - for stdin
      --json                    Print the response as JSON
      --name string
      --slug string

Global Flags:
      --help-all   Show all commands and options, including administrative controls.