iclients
Shared OAuth2 credential stores (app registrations) that multiple connections can reference — rotate a client secret in one place instead of per connection.
REST API: iClients
celigo iclients <subcommand> [args] [flags]Supports all global flags.
Subcommands
list
List all iClients.
get <id>
Fetch one iClient (secrets are masked as ******).
create
Create an iClient from a JSON body (--file <path> or stdin).
update <id>
Full-replace PUT from a JSON body (--file <path> or stdin). Refuses masked placeholders unless --force.
set <id> key=value …
Edit whitelisted fields (e.g. name) via atomic PATCH. Credential fields cannot be set; use update.
delete <id>
Delete an iClient by ID.
dependencies <id>
List resources that depend on this iClient (alias used-by).
audit <id>
Show the audit log (change history) for one iClient.
setis limited on iClients. Because iClients are credential-masked,setmay only touch the PATCH-whitelisted fields (e.g.name,disabled). To change the OAuth client secret or other encrypted fields, useupdatewith a hand-built payload that contains the actual secret, ordelete+createto re-enter credentials from scratch. A GET, modify, PUT round-trip would otherwise write the masked placeholder back over the real value.
celigo iclients list
List every iClient in the current account.
Signature
Arguments
None.
Flags
None beyond global flags. Default table columns: _id, name, lastModified.
Example
Corresponds to: GET /v1/iClients
celigo iclients get <id>
Fetch a single iClient by ID. Encrypted fields (e.g. clientSecret) are returned as ******.
Signature
Arguments
<id>
string
Yes
iClient ID.
Flags
None beyond global flags.
Example
Corresponds to: GET /v1/iClients/{_id}
celigo iclients create
Create an iClient from a JSON payload. Read the body from a file with -f, --file or pipe it on stdin.
Signature
Arguments
None.
Flags
-f, --file <path>
string
—
Read the JSON body from a file instead of stdin (--file - also means stdin). Added in celigo-cli 2026.6.1.
Request body
Reads JSON on stdin (or from --file). See the POST /v1/iClients request schema in dist/iclient.yml for the full payload shape (application, oauth2.clientId, oauth2.clientSecret, oauth2.authorizeURI, oauth2.tokenURI, and provider-specific fields).
Example
Corresponds to: POST /v1/iClients
celigo iclients update <id>
Full-replace an iClient with a JSON payload. Read the body from a file with -f, --file or pipe it on stdin. Refuses to submit a payload containing masked placeholders (all-asterisk strings) unless --force is passed.
⚠️
PUTfully replaces the iClient. Any omitted field is erased. Supply the realclientSecretin the body — submitting the masked******value (with--force) overwrites the stored secret.
Signature
Arguments
<id>
string
Yes
iClient ID.
Flags
-f, --file <path>
string
—
Read the JSON body from a file instead of stdin (--file - also means stdin). Added in celigo-cli 2026.6.1.
--force
boolean
false
Submit even if the body contains masked credential values (***) copied from a GET. Without it, masked fields cause the command to abort with the list of offending paths.
Request body
Reads JSON on stdin (or from --file). Payload must be the complete iClient object — PUT is a full replace. See PUT /v1/iClients/{_id} in dist/iclient.yml.
Example
Corresponds to: PUT /v1/iClients/{_id}
celigo iclients set <id>
Edit one or more fields on an iClient. Because iClients are credential-masked, only PATCH-whitelisted fields (e.g. name, disabled) can be set via an atomic PATCH; other fields must go through update. This avoids the GET → modify → PUT round-trip writing a masked ****** placeholder back over the real client secret.
Signature
Arguments
<id>
string
Yes
iClient ID.
[assignments...]
key=value pairs
Yes
At least one assignment. Values are auto-parsed (disabled=false → boolean, debugUntil=null → removes field). Dot and array-index notation supported.
Example
Corresponds to: PATCH /v1/iClients/{_id}
celigo iclients delete <id>
Delete an iClient. Prompts for confirmation unless -y is passed.
⚠️ Deleting an iClient is destructive. Connections that reference it via
_iClientIdlose their credential store and stop authenticating. Rundependenciesfirst to confirm nothing uses it.
Signature
Arguments
<id>
string
Yes
iClient ID.
Flags
-y, --yes
boolean
false
Skip the interactive confirmation.
Example
Corresponds to: DELETE /v1/iClients/{_id}
celigo iclients dependencies <id>
List the resources (typically connections) that depend on this iClient. Use it to check whether the iClient is safe to delete; an empty result means no dependents. Aliased as used-by.
Signature
Arguments
<id>
string
Yes
iClient ID.
Example
Corresponds to: GET /v1/iClients/{_id}/dependencies
celigo iclients audit <id>
Show the audit log (change history) for one iClient.
Signature
Arguments
<id>
string
Yes
iClient ID.
Example
Corresponds to: GET /v1/iClients/{_id}/audit
Gotchas
setonly touches non-credential fields. iClients hold OAuth client secrets, and the API masks those fields as******on every GET. Sosetis limited to PATCH-whitelisted fields (e.g.name,disabled) that are written via an atomicPATCH; it cannot change the client secret. To rotate a secret, useupdatewith a hand-built payload that includes the real value, ordelete+createto re-enter the credentials.updaterefuses masked payloads by default. Pipeget | updatewithout replacing the masked fields and the command aborts, listing each offending path (e.g.oauth2.clientSecret). Fill them in with the real values (or""to clear) before re-running, or pass--forceto submit the masked payload anyway — which will write******back to the server.iClients are shared. One iClient can back many connections via
_iClientId. Rotating a secret on the iClient flows to every connection pointing at it.
Related
connections — OAuth connections reference an iClient via
_iClientId.workspace-users — the other half of the former
users-iclientspage.
Last updated
Was this helpful?