matelot command reference

Generated from apps/cli/src/resources.ts (CUSTOM_COMMANDS + RESOURCES). Every command accepts --json; resource commands accept --body '{...}' to pass a raw JSON body (merged last) and the path flags --org --workspace --team --project --service --env --id --scope. Exit codes: 0 ok · 1 error · 2 policy violation · 3 not evaluated (SBOM pending/failed) · 4 authentication.

Command	Route
`matelot deploy`	`POST /api/v1/environments/:env/deployments`
`matelot gate`	`POST /api/v1/environments/:env/gate`
`matelot promote`	`POST /api/v1/environments/:env/promote`
`matelot pipeline`	`POST /api/v1/services/:service/pipelines`
`matelot sbom`	`POST /api/v1/services/:service/sboms`
`matelot release create`	`POST /api/v1/services/:service/releases`
`matelot registry login`	`POST /api/v1/services/:service/registries/:id/credentials`
`matelot registry path --create`	`POST /api/v1/services/:service/registries/:id/repositories`
`matelot apply --scope`	`POST /api/v1/:scope/config/apply`
`matelot vulnerabilities recorrelate`	`POST /api/v1/organizations/:org/findings/recorrelate`
`matelot vulnerabilities recorrelate --service`	`POST /api/v1/services/:service/findings/recorrelate`
`matelot evidence verify`	`POST /api/v1/evidence/verify`

Verb	Route	Does
`create`	`POST /organizations/:org/notification-channels`	Add a channel (--name ops --kind slack
`update`	`PATCH /notification-channels/:id`	Update (--name --url --events --enabled true
`test`	`POST /notification-channels/:id/test`	Send a test message
`delete`	`DELETE /notification-channels/:id`	Remove a channel
`create-scope`	`POST /:scope/notification-channels`	Add a channel at a scope (--scope projects/ID --name --kind --url [--events])

Verb	Route	Does
`list`	`GET /organizations/:org/notification-channels`	Notification channels (Slack / webhook)
`events`	`GET /notification-events`	Events a channel can subscribe to
`list-scope`	`GET /:scope/notification-channels`	Channels in force at a scope (--scope workspaces/ID

Verb	Route	Does
`create`	`POST /organizations/:org/api-tokens`	Create a CI token (--name --scope-type PROJECT --scope-id ID --preset full
`revoke`	`DELETE /api-tokens/:id`	Revoke a CI token

Verb	Route	Does
`list`	`GET /projects/:project/code-findings`	Secrets / IaC / SAST findings (--kind --severity --status)
`summary`	`GET /projects/:project/code-findings/summary`	Code findings counts
`list-workspace`	`GET /workspaces/:id/code-findings`	Code findings of a workspace (--id, [--team])

Verb	Route	Does
`search`	`GET /organizations/:org/components`	Where a component is used (--q)
`search-workspace`	`GET /workspaces/:id/components`	Component search in a workspace (--id --q [--team])
`search-project`	`GET /projects/:project/components`	Component search in a project (--q)

Verb	Route	Does
`create`	`POST /organizations/:org/integrations`	Create a connection (--body with the JSON the web app sends: provider, scopeType, scopeId, name, baseUrl, auth)
`test`	`POST /organizations/:org/integrations/test`	Test connection settings without saving (--body JSON)
`verify`	`POST /integrations/:id/verify`	Verify a connection (deploy key / credentials)
`link-installation`	`POST /integrations/:id/link-installation`	GitHub App: bind an existing installation / re-read permissions
`create-ecr-repository`	`POST /integrations/:id/ecr/repositories`	Create an ECR repository through the connection
`sync`	`POST /integrations/:id/sync`	Read the source now (repositories / tags)
`delete`	`DELETE /integrations/:id`	Delete a connection

Verb	Route	Does
`readiness`	`GET /services/:service/cra/readiness`	CRA readiness checks of a service (SBOM shipped, no KEV in prod, policy, SLAs, gate evidence, secrets, IaC, traceability, monitoring)
`readiness-project`	`GET /projects/:project/cra/readiness`	CRA readiness of every service in a project
`readiness-workspace`	`GET /workspaces/:id/cra/readiness`	CRA readiness of every service in a workspace (--id, [--team])

Verb	Route	Does
`list`	`GET /services/:service/deployments`	Current deployment per environment + history
`list-org`	`GET /organizations/:org/deployments`	Current production deployments of the organization

Verb	Route	Does
`settings`	`PATCH /environments/:env/settings`	Environment settings (--protected true, --kubernetes-namespace ...)
`kubernetes-sync`	`POST /environments/:env/kubernetes-sync`	Read what the cluster runs now
`create`	`POST /services/:service/environments`	Create an environment (--kind development
`update`	`PATCH /environments/:env`	Update an environment
`delete`	`DELETE /environments/:env`	Archive an environment
`show`	`GET /environments/:env`	Environment details
`registry`	`GET /environments/:env/registry`	Environment repository in the built-in registry
`lineage`	`GET /environments/:env/lineage`	Released vs running lanes, drift, history
`gate`	`GET /environments/:env/gate`	Latest gate evaluation of the environment

Verb	Route	Does
`summary`	`GET /releases/:id/evidence`	Evidence summary of a release (JSON): images, SBOMs, findings + decisions, gate, deployments, policies, risk
`vex`	`GET /releases/:id/vex`	OpenVEX document of a release (decisions per vulnerability and shipped image)

Verb	Route	Does
`create`	`POST /services/:service/exceptions`	Time-boxed acceptance in a service (--kind vulnerability
`create-project`	`POST /projects/:project/exceptions`	Same, at a project
`create-org`	`POST /organizations/:org/exceptions`	Same, organization-wide
`approve`	`POST /exceptions/:id/approve`	Approve a pending exception
`revoke`	`DELETE /exceptions/:id`	Revoke (findings reopen immediately)

Verb	Route	Does
`show`	`GET /findings/:id`	One finding with where it runs
`set`	`PATCH /findings/:id`	Decision: --status open

Verb	Route	Does
`snapshot`	`POST /organizations/:org/findings/snapshots`	Take today's findings snapshot now (trend charts)
`list`	`GET /projects/:project/findings`	Dependency findings (--severity --status --kev --q)
`list-org`	`GET /organizations/:org/findings`	Findings across the organization
`summary`	`GET /projects/:project/findings/summary`	Open / KEV / production counts
`environments`	`GET /projects/:project/findings/environments`	What runs in each environment, with counts
`trend`	`GET /projects/:project/findings/trend`	Daily trend per environment (--days)
`list-workspace`	`GET /workspaces/:id/findings`	Findings of a workspace (--id WORKSPACE [--team ID] --severity --status --kev --q)
`list-team`	`GET /teams/:id/findings`	Findings of a team (--id TEAM)
`summary-workspace`	`GET /workspaces/:id/findings/summary`	Counts for a workspace (--id, [--team])
`environments-workspace`	`GET /workspaces/:id/findings/environments`	What runs where, in a workspace

Verb	Route	Does
`delete`	`DELETE /services/:service/images/:id`	Stop tracking an image
`add`	`POST /services/:service/images`	Register an image (name, optional integrationId)
`sync`	`POST /services/:service/images/:id/sync`	Read the registry now (tags, digests): --service ID --id IMAGE

Verb	Route	Does
`list`	`GET /organizations/:org/integrations`	Connections (git, registries, k8s)
`providers`	`GET /integrations/providers`	Available providers

Verb	Route	Does
`retry`	`POST /jobs/:id/retry`	Retry a job
`cancel`	`POST /jobs/:id/cancel`	Cancel a job
`show`	`GET /jobs/:id`	Job details
`logs`	`GET /jobs/:id/logs`	Job log lines
`create`	`POST /services/:service/jobs`	Queue a job (--type sbom

Verb	Route	Does
`list`	`GET /projects/:project/jobs`	Jobs of a project
`active`	`GET /organizations/:org/jobs/active`	Queued / running jobs

Verb	Route	Does
`revoke`	`DELETE /memberships/:id`	Revoke a membership
`grant`	`POST /memberships`	Grant a role (--email --role DEVELOPER --scope-type PROJECT --scope-id ID)

Verb	Route	Does
`create`	`POST /organizations`	Create an organization (platform admin)
`update`	`PATCH /organizations/:org`	Rename an organization

Verb	Route	Does
`cancel`	`POST /pipelines/:id/cancel`	Cancel a pipeline
`show`	`GET /pipelines/:id`	Pipeline with its jobs
`templates`	`GET /pipeline-templates`	Pipeline templates

Verb	Route	Does
`list`	`GET /organizations/:org/policies`	Policies of the organization
`in-force`	`GET /projects/:project/policies`	Policies in force on a project (own + inherited)

Verb	Route	Does
`from-template-workspace`	`POST /workspaces/:workspace/policies/from-template`	Policy from a template at a workspace
`from-template-team`	`POST /teams/:team/policies/from-template`	Policy from a template at a team
`create-workspace`	`POST /workspaces/:workspace/policies`	Create a policy at a workspace
`create-team`	`POST /teams/:team/policies`	Create a policy at a team
`create`	`POST /organizations/:org/policies`	Create at the organization (--name --environments prod,staging --max-severity high --block-kev --block-secrets --require-sbom --max-iac high --action block
`create-project`	`POST /projects/:project/policies`	Create at a project (same flags)
`update`	`PATCH /policies/:id`	Update (--enabled true
`delete`	`DELETE /policies/:id`	Delete a policy
`templates`	`GET /policy-templates`	Ready-made policies (cra-baseline, production-baseline, staging-gate, dev-advisory, no-secrets-anywhere)
`from-template`	`POST /organizations/:org/policies/from-template`	Create a policy from a template at the organization (--template cra-baseline [--name])
`from-template-project`	`POST /projects/:project/policies/from-template`	Create from a template at a project

Verb	Route	Does
`create`	`POST /teams/:team/projects`	Create a project (--team ID --slug --name [--criticality])
`update`	`PATCH /projects/:project`	Update a project
`delete`	`DELETE /projects/:project`	Archive a project
`show`	`GET /projects/:project`	Project details
`overview`	`GET /projects/:project/overview`	Project overview

Verb	Route	Does
`info`	`GET /registry/info`	Built-in registry info
`reconcile`	`POST /organizations/:org/registry/reconcile`	Read the built-in registry now

Verb	Route	Does
`sync`	`POST /services/:service/releases/sync`	Read releases / tags from the source now
`list`	`GET /services/:service/releases`	Releases of a service

Verb	Route	Does
`queue`	`GET /projects/:project/remediation/queue`	Fix-first queue of a project: open findings grouped by advisory × service, ranked by exposure, severity, KEV, SLA
`queue-org`	`GET /organizations/:org/remediation/queue`	Fix-first queue of the organization
`create`	`POST /services/:service/remediations`	Track an advisory/rule in a service as work (--kind vulnerability
`show`	`GET /remediations/:id`	One remediation
`update`	`PATCH /remediations/:id`	Update (--status open
`issue`	`POST /remediations/:id/issue`	Open an issue: github
`queue-workspace`	`GET /workspaces/:id/remediation/queue`	Fix-first queue of a workspace (--id, [--team])

Verb	Route	Does
`list`	`GET /projects/:project/remediations`	Tracked remediations of a project (--status open,in_progress)
`list-org`	`GET /organizations/:org/remediations`	Tracked remediations of the organization

Verb	Route	Does
`attach`	`POST /services/:service/repositories`	Attach a repository to a service (--repository-id ID [--role primary])
`detach`	`DELETE /services/:service/repositories/:id`	Detach a repository from a service

Verb	Route	Does
`recompute-project`	`POST /projects/:project/risk/recompute`	Recompute the risk scores of a project now
`list`	`GET /organizations/:org/risk`	Risk score per service
`project`	`GET /projects/:project/risk`	Risk of a project
`recompute`	`POST /organizations/:org/risk/recompute`	Recompute risk now
`workspace`	`GET /workspaces/:id/risk`	Risk per service in a workspace (--id, [--team])
`team`	`GET /teams/:id/risk`	Risk per service in a team

Verb	Route	Does
`delete`	`DELETE /runners/:id`	Remove a runner
`agent`	`GET /runner-agent`	Latest runner version + image

Verb	Route	Does
`create`	`POST /organizations/:org/runner-pools`	Create a runner pool
`delete`	`DELETE /runner-pools/:id`	Delete a runner pool
`registration-token`	`POST /runner-pools/:id/registration-tokens`	New registration token for a pool

Verb	Route	Does
`show`	`GET /sboms/:id`	SBOM with components
`findings`	`GET /sboms/:id/findings`	Findings of one SBOM
`diff`	`GET /sboms/:from/diff/:to`	Diff two SBOMs (--from, --to)

Verb	Route	Does
`create`	`POST /projects/:project/services`	Create a service
`update`	`PATCH /services/:service`	Update a service (name, kind, criticality)
`archive`	`DELETE /services/:service`	Archive a service (history kept)
`show`	`GET /services/:service`	Service details