CLI command reference¶

Generated from the eve-iac CLI parser (cli/eveiac_cli/main.py). Do not edit manually.

eve-iac is the reference CLI for the public Python SDK. It does not call native EVE REST.

Synopsis¶

eve-iac [GLOBAL OPTIONS] COMMAND [OPTIONS] [ARGS]

Global flags may appear before or after the command because every subparser inherits them.

Global options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

CLI flags win over environment variables. Omitted flags use argparse.SUPPRESS, so they are not serialized as defaults.

CA resolution: --ca-file / EVE_IAC_CA_FILE is read from disk when set; otherwise --ca-pem / EVE_IAC_CA_PEM. --insecure skips certificate verification and fingerprint pin; HTTPS is still required. There is no TOFU UI and no EVE_IAC_INSECURE environment variable.

Exit codes¶

Code	Meaning
0	Success
1	Local error (missing URL, invalid lab)
2	Usage
3	Authentication
4	TLS
5	Confirmation required (--yes missing)
10	Agent error

--json writes the SDK data object to stdout on success (not the HTTP envelope). Failures with --json write {"error", "code", "status?"} to stdout.

Warnings from --insecure go to stderr so jq pipelines stay valid: eve-iac --insecure plan ./lab --json | jq .

Response shapes and jq examples below come from response_samples.json (copied from site/response_samples.json at doc generation time). SDK field tables: Python models.

Safety (--yes)¶

--yes sets confirm=true. It does not invent plan_identity. Required for destroy, exec wipe, deploy --replace, reconcile --prune, and export-config. Remaining requires_stop still needs --yes --plan-identity <P> or the agent returns 409 plan_stale (exit 10, zero StopNode). There are no interactive prompts.

from_eve plus --prune is rejected (usage): prune is a to_eve topology delete.

eve-iac health¶

Synopsis¶

eve-iac health [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                      [--ca-pem CA_PEM] [--json] [--yes]
                      [--timeout-ms TIMEOUT_MS] [--insecure]
                      [--username USERNAME] [--password PASSWORD]

Description¶

GET agent health (no token required)

Tells you whether this eve-iac-agent process is reachable and which build is running. No project and no token are required.

Mental model: Is the agent up?

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

status=ok tls=true version=0.9.0-1

JSON (--json) — same object as SDK HealthData to_wire() / CLI result_to_data().

{
  "status": "ok",
  "tls": true,
  "version": "0.9.0-1"
}

Shell / jq

eve-iac health --json | jq -r .status
eve-iac health --json | jq -r .version

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac health
eve-iac --url https://eve.example:8787 --ca-file ./ca.pem health
eve-iac --url https://192.168.48.112:8787 --insecure health

eve-iac login¶

Synopsis¶

eve-iac login [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                     [--ca-pem CA_PEM] [--json] [--yes]
                     [--timeout-ms TIMEOUT_MS] [--insecure]
                     [--username USERNAME] [--password PASSWORD]

Description¶

Create an agent session

Opens an agent session and returns the bearer token later calls send.

Mental model: Sign me in.

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

signed in as admin

JSON (--json) — same object as SDK LoginData to_wire() / CLI result_to_data().

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "username": "admin"
}

Human login omits token. --json includes token — store as EVE_IAC_TOKEN, never log stdout in CI.

Shell / jq

eve-iac login --json --username admin --password "$PW" | jq -r .token

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac login --username admin --password secret
eve-iac login --json

eve-iac session¶

Synopsis¶

eve-iac session [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                       [--ca-pem CA_PEM] [--json] [--yes]
                       [--timeout-ms TIMEOUT_MS] [--insecure]
                       [--username USERNAME] [--password PASSWORD]

Description¶

Validate the current token

Checks that the bearer token is still a live agent session.

Mental model: Am I still signed in?

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

session admin

JSON (--json) — same object as SDK SessionData to_wire() / CLI result_to_data().

{
  "username": "admin"
}

Shell / jq

eve-iac session --json | jq -r .username

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac session

eve-iac templates¶

Synopsis¶

eve-iac templates [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                         [--ca-pem CA_PEM] [--json] [--yes]
                         [--timeout-ms TIMEOUT_MS] [--insecure]
                         [--username USERNAME] [--password PASSWORD]
                         [--provisioned]

Description¶

List templates

Lists the node templates this EVE can place in a lab.

Mental model: Which node templates exist?

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--provisioned	flag	False	Send provisioned=true (omit the query when unset)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

templates: 42
iol
vpcs

JSON (--json) — same object as SDK TemplatesData to_wire() / CLI result_to_data().

{
  "templates": [
    {
      "id": "iol",
      "description": "IOL",
      "type": "qemu",
      "provisioned": true,
      "configSupported": true
    },
    {
      "id": "vpcs",
      "description": "VPCS",
      "type": "vpcs",
      "provisioned": true,
      "configSupported": true
    }
  ]
}

Shell / jq

eve-iac templates --json | jq '.templates | length'
eve-iac templates --json | jq -r '.templates[].id'

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac templates
eve-iac templates --provisioned --json

eve-iac load¶

Synopsis¶

eve-iac load [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                    [--ca-pem CA_PEM] [--json] [--yes]
                    [--timeout-ms TIMEOUT_MS] [--insecure]
                    [--username USERNAME] [--password PASSWORD] [--name NAME]
                    [--force]
                    source_lab [project]

Description¶

Create a LOAD project locally (marker only, no agent call)

Arguments¶

Argument	Required	Description
source_lab	yes	Existing EVE lab path (e.g. /Customers/OSPF.unl)
project	no	Output directory (default: ./IaC//)

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--name	NAME	omitted	Directory name when project is omitted (default: basename of source_lab)
--force	flag	False	Replace an existing .eve-iac.yml

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

project=/work/IaC/OSPF mode=load source_lab=/Customers/OSPF.unl

JSON (--json) — local result object (no agent call).

{
  "project": "/work/IaC/OSPF",
  "source_lab": "/Customers/OSPF.unl",
  "mode": "load"
}

Local command. Does not call eve-iac-agent. Creates .eve-iac.yml with mode load only.

Shell / jq

eve-iac load /Customers/OSPF.unl --json | jq -r .project
eve-iac load /Customers/OSPF.unl --json | jq -r .source_lab

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac load /Customers/OSPF.unl
eve-iac load /Customers/OSPF.unl ./IaC/ospf-watch
eve-iac load /Customers/OSPF.unl --json

eve-iac validate¶

Synopsis¶

eve-iac validate [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                        [--ca-pem CA_PEM] [--json] [--yes]
                        [--timeout-ms TIMEOUT_MS] [--insecure]
                        [--username USERNAME] [--password PASSWORD]
                        [--lab LAB]
                        project

Description¶

Validate a packed lab

Checks the packed IaC intent and returns every public-path error. A failed check is still HTTP 200 with valid set to false.

Mental model: Is my IaC intent valid?

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

valid=true

JSON (--json) — same object as SDK ValidateData to_wire() / CLI result_to_data().

{
  "valid": true,
  "errors": []
}

Shell / jq

eve-iac validate ./lab --json | jq -r .valid
eve-iac validate ./lab --json | jq -r '.errors[].path'

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac validate ./lab
eve-iac validate ./lab --json

eve-iac import¶

Synopsis¶

eve-iac import [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                      [--ca-pem CA_PEM] [--json] [--yes]
                      [--timeout-ms TIMEOUT_MS] [--insecure]
                      [--username USERNAME] [--password PASSWORD] [--lab LAB]
                      project

Description¶

Import a source lab into IaC intent (does not deploy or mutate source_lab)

Imports an existing EVE lab into IaC intent. The source lab is left unchanged. No managed lab is created; deploy is a separate step. This is not from_eve.

Mental model: Import this EVE lab as IaC intent. Do not deploy.

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

lab=/IaC/OSPF.unl

JSON (--json) — same object as SDK ImportData to_wire() / CLI result_to_data().

{
  "mode": "import",
  "source_lab": "/Customers/OSPF.unl",
  "managed_lab": "/IaC/OSPF.unl",
  "lab": "/IaC/OSPF.unl",
  "name": "OSPF",
  "state": {
    "node_ids": {
      "n_1": 3,
      "n_2": 4
    }
  }
}

Response includes yaml/files on first import. Never mutate source_lab.

Shell / jq

eve-iac import ./lab --json | jq -r .managed_lab
eve-iac import ./lab --json | jq -r '.state.node_ids | keys[]'

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac import ./imported-lab
eve-iac import ./imported-lab --json

eve-iac plan¶

Synopsis¶

eve-iac plan [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                    [--ca-pem CA_PEM] [--json] [--yes]
                    [--timeout-ms TIMEOUT_MS] [--insecure]
                    [--username USERNAME] [--password PASSWORD] [--lab LAB]
                    [--direction {to_eve,from_eve}]
                    [--plan-identity PLAN_IDENTITY]
                    project

Description¶

Dry-run plan

Compares IaC intent with the EVE lab and returns the work that would be required. It never writes the project files and it never changes EVE.

Mental model: What would have to change?

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--direction	to_eve|from_eve	omitted	Omitted stays omitted (agent treats omitted as to_eve)
--plan-identity	PLAN-IDENTITY	omitted	Opaque plan token from the last same-direction plan or live-only reconcile (required with --yes when requires_stop remains)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

direction=to_eve actions=2 exists=true plan_identity=abc123

JSON (--json) — same object as SDK PlanData to_wire() / CLI result_to_data().

{
  "lab": "/IaC/demo.unl",
  "exists": true,
  "direction": "to_eve",
  "applicable": true,
  "plan_identity": "abc123def456",
  "actions": [
    {
      "op": "update_node",
      "key": "n_1",
      "summary": "config changed"
    },
    {
      "op": "restart_node",
      "key": "n_1",
      "summary": "running node needs restart"
    }
  ],
  "summary": {
    "create": 0,
    "update": 1,
    "delete": 0,
    "restart": 1
  }
}

Shell / jq

eve-iac plan ./lab --json | jq '.actions | length'
eve-iac plan ./lab --json | jq -r .plan_identity
eve-iac plan ./lab --json | jq -r '.actions[] | .op'

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac plan ./lab
eve-iac plan ./lab --json
eve-iac plan ./lab --direction to_eve
eve-iac plan ./lab --direction from_eve

eve-iac reconcile¶

Synopsis¶

eve-iac reconcile [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                         [--ca-pem CA_PEM] [--json] [--yes]
                         [--timeout-ms TIMEOUT_MS] [--insecure]
                         [--username USERNAME] [--password PASSWORD]
                         [--lab LAB] [--direction {to_eve,from_eve}]
                         [--plan-identity PLAN_IDENTITY] [--prune]
                         project

Description¶

Reconcile Local vs managed runtime (to_eve live-safe by default; from_eve never mutates runtime)

Applies one direction. to_eve makes the EVE lab match IaC intent. from_eve reads the current EVE UNL definition and returns it as the new IaC intent. from_eve does not capture transient runtime state and it is not importProject.

Mental model: to_eve: make EVE match my intent. from_eve: make the current UNL definition my new intent.

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--direction	to_eve|from_eve	omitted	Omitted stays omitted (agent treats omitted as to_eve)
--plan-identity	PLAN-IDENTITY	omitted	Opaque plan token from the last same-direction plan or live-only reconcile (required with --yes when requires_stop remains)
--prune	flag	False	Delete extra live objects (requires --yes)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

applied=2 direction=to_eve

JSON (--json) — same object as SDK ReconcileData to_wire() / CLI result_to_data().

{
  "lab": "/IaC/demo.unl",
  "applied": 2,
  "direction": "to_eve",
  "applicable": true,
  "state": {
    "node_ids": {
      "n_1": 3
    }
  }
}

reconcile --direction from_eve may add files_written / files_removed after local persist:

{
  "applied": 3,
  "direction": "from_eve",
  "applicable": true,
  "lab": "/IaC/demo.unl",
  "files_written": [
    "topology.yml",
    "configs/default/n_1.cfg"
  ],
  "files_removed": [
    "configs/default/stale.cfg"
  ]
}

Shell / jq

eve-iac reconcile ./lab --json | jq .applied
eve-iac reconcile ./lab --json | jq -r .direction

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac reconcile ./lab --direction to_eve
eve-iac --yes reconcile ./lab --direction to_eve --plan-identity <P>
eve-iac reconcile ./lab --direction from_eve --json
eve-iac --yes reconcile ./lab --prune --plan-identity <P>

eve-iac deploy¶

Synopsis¶

eve-iac deploy [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                      [--ca-pem CA_PEM] [--json] [--yes]
                      [--timeout-ms TIMEOUT_MS] [--insecure]
                      [--username USERNAME] [--password PASSWORD] [--lab LAB]
                      [--replace]
                      project

Description¶

Create the managed lab

Creates the managed EVE lab from this project. If the managed lab already exists, the call fails unless replace is set, in which case the existing lab is removed and created again.

Mental model: Create the managed lab.

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--replace	flag	False	Replace an existing managed lab (requires --yes)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

lab=/IaC/demo.unl

JSON (--json) — same object as SDK DeployData to_wire() / CLI result_to_data().

{
  "lab": "/IaC/demo.unl",
  "state": {
    "node_ids": {
      "n_1": 3,
      "n_2": 4
    }
  }
}

Shell / jq

eve-iac deploy ./lab --json | jq -r .lab

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac deploy ./lab
eve-iac deploy ./lab --replace --yes

eve-iac destroy¶

Synopsis¶

eve-iac destroy [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                       [--ca-pem CA_PEM] [--json] [--yes]
                       [--timeout-ms TIMEOUT_MS] [--insecure]
                       [--username USERNAME] [--password PASSWORD] [--lab LAB]
                       [--no-wipe]
                       project

Description¶

Destroy the managed lab (requires --yes)

Deletes the managed EVE lab. Omitted wipe still wipes the nodes first.

Mental model: Delete the managed lab.

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--no-wipe	flag	omitted	Send wipe=false (omitted wipe still means wipe nodes on the agent)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

lab=/IaC/demo.unl

JSON (--json) — same object as SDK DestroyData to_wire() / CLI result_to_data().

{
  "lab": "/IaC/demo.unl"
}

Shell / jq

eve-iac destroy ./lab --json | jq -r .lab

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac destroy ./lab --yes
eve-iac destroy ./lab --yes --no-wipe

eve-iac status¶

Synopsis¶

eve-iac status [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                      [--ca-pem CA_PEM] [--json] [--yes]
                      [--timeout-ms TIMEOUT_MS] [--insecure]
                      [--username USERNAME] [--password PASSWORD] [--lab LAB]
                      project

Description¶

Project runtime status

Returns a lightweight view of the project's current live EVE state, including node runtime states and current link impairments, without rebuilding the structural lab model.

Mental model: What is alive right now?

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

lab=/IaC/demo.unl

JSON (--json) — same object as SDK ProjectStatusData to_wire() / CLI result_to_data().

{
  "mode": "create",
  "runtime_lab": "/IaC/demo.unl",
  "managed_lab": "/IaC/demo.unl",
  "capabilities": {
    "topology_mutation": true,
    "reconcile": true,
    "destroy": true,
    "lifecycle": {
      "start": true,
      "stop": true,
      "wipe": true
    }
  },
  "locked": false
}

Shell / jq

eve-iac status ./lab --json | jq -r .runtime_lab
eve-iac status ./lab --json | jq -r .mode
eve-iac status ./lab --json | jq .capabilities.topology_mutation

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac status ./lab
eve-iac status ./lab --json

eve-iac inspect¶

Synopsis¶

eve-iac inspect [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                       [--ca-pem CA_PEM] [--json] [--yes]
                       [--timeout-ms TIMEOUT_MS] [--insecure]
                       [--username USERNAME] [--password PASSWORD] [--lab LAB]
                       [--refresh]
                       project

Description¶

Observe the live lab

Builds a rich structural observation of the EVE lab: nodes, templates, interfaces, networks, links, topology, presentation, config sets, and the runtime metadata attached to that model.

Mental model: What does the current EVE lab look like?

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--refresh	flag	False	Send refresh=true

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

lab=/Customers/OSPF.unl

JSON (--json) — same object as SDK InspectionData to_wire() / CLI result_to_data().

{
  "mode": "load",
  "observation": true,
  "desired_state": false,
  "runtime_lab": "/Customers/OSPF.unl",
  "cached": false,
  "capabilities": {
    "topology_mutation": false,
    "reconcile": false,
    "destroy": false,
    "lifecycle": {
      "start": true,
      "stop": true,
      "wipe": true
    }
  }
}

Large observation payload is under additional keys when present. LOAD mode sets desired_state=false.

Shell / jq

eve-iac inspect ./lab --json | jq -r .runtime_lab
eve-iac inspect ./lab --json | jq .capabilities.lifecycle.start

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac inspect ./lab
eve-iac inspect ./lab --refresh --json

eve-iac exec¶

Synopsis¶

eve-iac exec [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                    [--ca-pem CA_PEM] [--json] [--yes]
                    [--timeout-ms TIMEOUT_MS] [--insecure]
                    [--username USERNAME] [--password PASSWORD] [--lab LAB]
                    [--node NODE] [--stopmode {0,1,2,3}]
                    project {start,stop,wipe}

Description¶

start, stop, or wipe nodes

Starts, stops, or wipes nodes in the runtime lab. One call covers the listed IaC keys, or every node when the selection is omitted.

Mental model: Start, stop, or wipe these nodes.

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
action	yes

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--node	NODE	omitted	IaC node key; omitted means all nodes
--stopmode	0|1|2|3	omitted	Explicit stop mode; omitted stays omitted

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

requested=2 started=2 stopped=0 wiped=0 failed=0 invalid=0

JSON (--json) — same object as SDK BulkResult to_wire() / CLI result_to_data().

{
  "requested": 2,
  "started": 2,
  "already_running": 0,
  "already_starting": 0,
  "stopped": 0,
  "already_stopped": 0,
  "wiped": 0,
  "failed": 0,
  "invalid": 0
}

Shell / jq

eve-iac exec ./lab --json | jq '.failed + .invalid'
eve-iac exec ./lab --json | jq '{started, stopped, wiped}'

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac exec ./lab start
eve-iac exec ./lab stop
eve-iac exec ./lab wipe --yes
eve-iac exec ./lab start --node n_1

eve-iac export-config¶

Synopsis¶

eve-iac export-config [-h] [--url URL] [--token TOKEN]
                             [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                             [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                             [--username USERNAME] [--password PASSWORD]
                             [--lab LAB] --configset CONFIGSET [--node NODES]
                             project

Description¶

Copy running configuration into an existing startup-config set (requires --yes)

Writes the running configuration into the chosen EVE startup-config set so a later from_eve can adopt that blob. It does not change IaC files.

Mental model: Save the running configuration into this startup-config set.

Arguments¶

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--configset	CONFIGSET	omitted	default, or a named set that already exists on the lab
--node	NODES	omitted	IaC node key; repeat to select more than one. Omitted means every config-capable node

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Human (default)

configset=default exported=1 skipped=0 failed=0

JSON (--json) — same object as SDK ExportConfigData to_wire() / CLI result_to_data().

{
  "lab": "/Lab.unl",
  "configset": "default",
  "nodes": [
    {
      "key": "n_1",
      "id": 1,
      "status": "exported"
    }
  ]
}

Copies the running NOS configuration into an existing EVE startup-config set. Does not write topology.yml or configs/**. A later from_eve adopts the blob. Unknown set is unknown_configset and creates nothing. LOAD and source_lab are refused.

Shell / jq

eve-iac export-config ./lab --json | jq .configset
eve-iac export-config ./lab --json | jq '[.nodes[].status] | group_by(.) | map({status: .[0], count: length})'

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac export-config ./lab --configset default --yes
eve-iac export-config ./lab --configset backup --node n_1 --node n_2 --yes

eve-iac link¶

Synopsis¶

eve-iac link [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                    [--ca-pem CA_PEM] [--json] [--yes]
                    [--timeout-ms TIMEOUT_MS] [--insecure]
                    [--username USERNAME] [--password PASSWORD]
                    {quality,suspend,resume} ...

Description¶

Live link quality and suspend (Interaction as Code; never writes topology.yml)

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac link quality ./lab --from n_1:e0/0 --to n_2:e0/1 --delay 50 --loss 1
eve-iac link quality ./lab --from n_1:e0/0 --to n_2:e0/1 --delay 50 --save
eve-iac link suspend ./lab --from n_1:e0/0 --to n_2:e0/1 --side source
eve-iac link resume ./lab --from n_1:e0/0 --to n_2:e0/1

Subcommands¶

eve-iac link quality¶

eve-iac link quality [-h] [--url URL] [--token TOKEN]
                            [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                            [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                            [--username USERNAME] [--password PASSWORD]
                            [--lab LAB] --from LINK_FROM --to LINK_TO
                            [--vlan VLAN] [--delay DELAY] [--jitter JITTER]
                            [--loss LOSS] [--bandwidth BANDWIDTH]
                            [--dest-delay DEST_DELAY]
                            [--dest-jitter DEST_JITTER]
                            [--dest-loss DEST_LOSS]
                            [--dest-bandwidth DEST_BANDWIDTH] [--save]
                            project

Applies live delay, jitter, loss, and bandwidth to one Ethernet link identified by public YAML endpoints. It does not rewrite topology.yml.

Mental model: Impair this live link.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--from	LINK-FROM	omitted	Source endpoint n_1:e0/0 or net:net_11
--to	LINK-TO	omitted	Destination endpoint n_2:e0/1 or net:net_11
--vlan	VLAN	omitted	VLAN identity; omitted is the untagged default
--delay	DELAY	omitted	source_impairment.delay
--jitter	JITTER	omitted	source_impairment.jitter
--loss	LOSS	omitted	source_impairment.loss
--bandwidth	BANDWIDTH	omitted	source_impairment.bandwidth
--dest-delay	DEST-DELAY	omitted	destination_impairment.delay
--dest-jitter	DEST-JITTER	omitted	destination_impairment.jitter
--dest-loss	DEST-LOSS	omitted	destination_impairment.loss
--dest-bandwidth	DEST-BANDWIDTH	omitted	destination_impairment.bandwidth
--save	flag	False	Persist NETEM into the UNL (native save=1). Omitted stays live-only

eve-iac link suspend¶

eve-iac link suspend [-h] [--url URL] [--token TOKEN]
                            [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                            [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                            [--username USERNAME] [--password PASSWORD]
                            [--lab LAB] --from LINK_FROM --to LINK_TO
                            [--vlan VLAN] [--side {source,destination,both}]
                            project

Suspends or resumes a live link identified by public YAML endpoints. Suspend is not an IaC intent field and is not written to topology.yml.

Mental model: Pause or resume this live link.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--from	LINK-FROM	omitted	Source endpoint n_1:e0/0 or net:net_11
--to	LINK-TO	omitted	Destination endpoint n_2:e0/1 or net:net_11
--vlan	VLAN	omitted	VLAN identity; omitted is the untagged default
--side	source|destination|both	omitted	Omitted is both

eve-iac link resume¶

eve-iac link resume [-h] [--url URL] [--token TOKEN]
                           [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                           [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                           [--username USERNAME] [--password PASSWORD]
                           [--lab LAB] --from LINK_FROM --to LINK_TO
                           [--vlan VLAN] [--side {source,destination,both}]
                           project

Suspends or resumes a live link identified by public YAML endpoints. Suspend is not an IaC intent field and is not written to topology.yml.

Mental model: Pause or resume this live link.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)
--from	LINK-FROM	omitted	Source endpoint n_1:e0/0 or net:net_11
--to	LINK-TO	omitted	Destination endpoint n_2:e0/1 or net:net_11
--vlan	VLAN	omitted	VLAN identity; omitted is the untagged default
--side	source|destination|both	omitted	Omitted is both

eve-iac console¶

Synopsis¶

eve-iac console [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                       [--ca-pem CA_PEM] [--json] [--yes]
                       [--timeout-ms TIMEOUT_MS] [--insecure]
                       [--username USERNAME] [--password PASSWORD]
                       {attach,watch,history,exec,run,wait,sessions,close} ...

Description¶

Node console attach, watch, exec, run, wait, sessions

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac console --help

Subcommands¶

eve-iac console attach¶

eve-iac console attach [-h] [--url URL] [--token TOKEN]
                              [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                              [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                              [--username USERNAME] [--password PASSWORD]
                              [--lab LAB]
                              project node

Returns a ticket for an interactive or read-only console stream. Omitted mode is interact.

Mental model: Attach me to this console.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
node	yes	IaC node key

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab

eve-iac console watch¶

eve-iac console watch [-h] [--url URL] [--token TOKEN]
                             [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                             [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                             [--username USERNAME] [--password PASSWORD]
                             [--lab LAB]
                             project node [node ...]

Returns a ticket for an interactive or read-only console stream. Omitted mode is interact.

Mental model: Attach me to this console.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
node	yes	IaC node key(s)

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab

eve-iac console history¶

eve-iac console history [-h] [--url URL] [--token TOKEN]
                               [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                               [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                               [--username USERNAME] [--password PASSWORD]
                               [--lab LAB] [--bytes BYTES]
                               project node

Returns the recent bytes the console session has already received. It is not the result of a new command.

Mental model: What did this console already print?

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
node	yes	IaC node key

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab
--bytes	BYTES	omitted	Max history bytes (1-65536)

eve-iac console exec¶

eve-iac console exec [-h] [--url URL] [--token TOKEN]
                            [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                            [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                            [--username USERNAME] [--password PASSWORD]
                            [--lab LAB] [--stdin] [--session SESSION_ID]
                            project node [cmd_text]

Sends one command to a node console and returns when the prompt comes back.

Mental model: Run one command on this console.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
node	yes	IaC node key
cmd_text	no	Command to send

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab
--stdin	flag	False	Read command from stdin when omitted
--session	SESSION-ID	omitted	Optional Hub session. Omit to join or open the Hub. A missing session reopens once.

eve-iac console run¶

eve-iac console run [-h] [--url URL] [--token TOKEN]
                           [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                           [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                           [--username USERNAME] [--password PASSWORD]
                           [--lab LAB]
                           project node file

Runs an ordered expect and send script on one console. Use execConsole for a single command.

Mental model: Play this dialogue on the console.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
node	yes	IaC node key
file	yes	YAML steps file

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab

eve-iac console wait¶

eve-iac console wait [-h] [--url URL] [--token TOKEN]
                            [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                            [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                            [--username USERNAME] [--password PASSWORD]
                            [--lab LAB] --expect EXPECT
                            project node

Waits until the console output matches a regular expression, or until the wait times out.

Mental model: Tell me when the console prints this.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml
node	yes	IaC node key

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab
--expect	EXPECT	omitted	Go regexp pattern

eve-iac console sessions¶

eve-iac console sessions [-h] [--url URL] [--token TOKEN]
                                [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                                [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                                [--username USERNAME] [--password PASSWORD]
                                [--lab LAB]
                                project

Lists the console sessions the agent currently holds.

Mental model: Which console sessions are open?

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab

eve-iac console close¶

eve-iac console close [-h] [--url URL] [--token TOKEN]
                             [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                             [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                             [--username USERNAME] [--password PASSWORD]
                             [--lab LAB] --session SESSION_ID
                             project

Closes one console session.

Mental model: Release this console.

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab
--session	SESSION-ID	omitted	Console session_id

eve-iac oob¶

Synopsis¶

eve-iac oob [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                   [--ca-pem CA_PEM] [--json] [--yes]
                   [--timeout-ms TIMEOUT_MS] [--insecure]
                   [--username USERNAME] [--password PASSWORD]
                   {start,status,credentials,stop,proxy} ...

Description¶

Out-of-band SSH runtime files for this agent session

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac login
eve-iac oob start ./IaC/sample
eve-iac oob status ./IaC/sample
ssh -F ./IaC/sample/.eve-iac/oob/ssh_config iol1
eve-iac oob stop ./IaC/sample

Subcommands¶

eve-iac oob start¶

eve-iac oob start [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                         [--ca-pem CA_PEM] [--json] [--yes]
                         [--timeout-ms TIMEOUT_MS] [--insecure]
                         [--username USERNAME] [--password PASSWORD]
                         [--lab LAB]
                         project

Starts the OOB SSH generation for this authenticated session and runtime project, or returns it unchanged when it is already active.

Mental model: Open out-of-band SSH for this lab.

eve-iac oob start ./IaC/sample
eve-iac oob start ./IaC/sample --json

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

eve-iac oob status¶

eve-iac oob status [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                          [--ca-pem CA_PEM] [--json] [--yes]
                          [--timeout-ms TIMEOUT_MS] [--insecure]
                          [--username USERNAME] [--password PASSWORD]
                          [--lab LAB]
                          project

Reports whether this session has an active OOB generation for the runtime project.

Mental model: Is out-of-band SSH on?

eve-iac oob status ./IaC/sample

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

eve-iac oob credentials¶

eve-iac oob credentials [-h] [--url URL] [--token TOKEN]
                               [--ca-file CA_FILE] [--ca-pem CA_PEM] [--json]
                               [--yes] [--timeout-ms TIMEOUT_MS] [--insecure]
                               [--username USERNAME] [--password PASSWORD]
                               [--lab LAB]
                               project

Returns the SSH user key, host public key, fingerprint, known_hosts line, and node snapshot for the active generation.

Mental model: Give me the SSH material for this generation.

eve-iac oob credentials ./IaC/sample

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

eve-iac oob stop¶

eve-iac oob stop [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                        [--ca-pem CA_PEM] [--json] [--yes]
                        [--timeout-ms TIMEOUT_MS] [--insecure]
                        [--username USERNAME] [--password PASSWORD]
                        [--lab LAB]
                        project

Destroys the OOB generation for this session and project and closes its SSH sessions.

Mental model: Turn out-of-band SSH off.

eve-iac oob stop ./IaC/sample

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--lab	LAB	omitted	Override eve.lab (EVE API path starting with /)

eve-iac oob proxy¶

eve-iac oob proxy [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                         [--ca-pem CA_PEM] [--json] [--yes]
                         [--timeout-ms TIMEOUT_MS] [--insecure]
                         [--username USERNAME] [--password PASSWORD] --project
                         PROJECT --node NODE

Upgrades an OOB ticket to the raw SSH byte stream. The hub attaches only after a later shell request.

Mental model: Give me the SSH bytes.

ssh -F ./IaC/sample/.eve-iac/oob/ssh_config iol1

None.

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--project	PROJECT	omitted	Lab directory containing .eve-iac.yml
--node	NODE	omitted	Canonical node key

eve-iac inventory¶

Synopsis¶

eve-iac inventory [-h] [--url URL] [--token TOKEN] [--ca-file CA_FILE]
                         [--ca-pem CA_PEM] [--json] [--yes]
                         [--timeout-ms TIMEOUT_MS] [--insecure]
                         [--username USERNAME] [--password PASSWORD]
                         {targets,generate} ...

Description¶

Generate an automation inventory from the project catalogue

Arguments¶

None.

Options¶

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

Output¶

On success, stdout is either human text or JSON (--json). stderr stays empty on success except --insecure warnings.

Failure with --json (exit code ≠ 0):

{
  "error": "unauthenticated",
  "code": "unauthenticated",
  "status": 401
}

Examples¶

eve-iac inventory targets
eve-iac inventory generate ./IaC/sample --target ansible
eve-iac inventory generate ./IaC/sample --target netmiko
eve-iac inventory generate ./IaC/sample --target ansible --stdout

Subcommands¶

eve-iac inventory targets¶

eve-iac inventory targets [-h] [--url URL] [--token TOKEN]
                                 [--ca-file CA_FILE] [--ca-pem CA_PEM]
                                 [--json] [--yes] [--timeout-ms TIMEOUT_MS]
                                 [--insecure] [--username USERNAME]
                                 [--password PASSWORD]

eve-iac inventory targets

None.

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD

eve-iac inventory generate¶

eve-iac inventory generate [-h] [--url URL] [--token TOKEN]
                                  [--ca-file CA_FILE] [--ca-pem CA_PEM]
                                  [--json] [--yes] [--timeout-ms TIMEOUT_MS]
                                  [--insecure] [--username USERNAME]
                                  [--password PASSWORD] --target TARGET
                                  [--output OUTPUT] [--stdout]
                                  project

eve-iac inventory generate ./IaC/sample --target ansible
eve-iac inventory generate ./IaC/sample --target netmiko
eve-iac inventory generate ./IaC/sample --target ansible --stdout
eve-iac inventory generate ./IaC/sample --target ansible --output ./out/inventory.yml

Argument	Required	Description
project	yes	Lab directory containing .eve-iac.yml

Option	Value	Default	Description	Env
--url	URL	omitted (not sent / not set)	HTTPS eve-iac-agent URL (or EVE_IAC_URL)	EVE_IAC_URL
--token	TOKEN	omitted (not sent / not set)	Bearer token (or EVE_IAC_TOKEN)	EVE_IAC_TOKEN
--ca-file	CA-FILE	omitted (not sent / not set)	Pinned CA certificate file (or EVE_IAC_CA_FILE)	EVE_IAC_CA_FILE
--ca-pem	CA-PEM	omitted (not sent / not set)	Pinned CA PEM (or EVE_IAC_CA_PEM)	EVE_IAC_CA_PEM
--json	flag	omitted (not sent / not set)	Write SDK result JSON to stdout
--yes	flag	omitted (not sent / not set)	Set confirm=true. Does not invent plan_identity; remaining requires_stop still needs --plan-identity or the agent returns 409 plan_stale with zero StopNode
--timeout-ms	TIMEOUT-MS	omitted (not sent / not set)	Override the operation timeout
--insecure	flag	omitted (not sent / not set)	Skip TLS certificate verification (lab/dev only; never the default)
--username	USERNAME	omitted (not sent / not set)	Login username (or EVE_IAC_USERNAME)	EVE_IAC_USERNAME
--password	PASSWORD	omitted (not sent / not set)	Login password (or EVE_IAC_PASSWORD)	EVE_IAC_PASSWORD
--target	TARGET	omitted	Exporter name from inventory-exporters.yaml
--output	OUTPUT	omitted	Write here instead of the exporter default path
--stdout	flag	False	Write the inventory to stdout and do not create a file