Command Reference

Harness CLI — Command Reference

Complete list of every command supported by the Harness CLI, grouped by module.

The grammar is harness <verb> <noun> [identifier] [flags]. A small set of management commands (auth, install, version, debug) sit outside the verb/noun grammar because they operate on the tool itself.

Module	Commands	Notes
core	15	Auth, install, version, discovery (list/get module, list/get noun)
platform	38	Orgs, projects, users, roles, connectors, secrets, settings, delegates, entity usage
pipeline	27	Pipelines, executions, triggers, input sets, templates, freezes
cd	20	Services, environments, infrastructure, service overrides
iacm	3	IaCM workspaces
har	40	Artifact Registry — push/pull, registries, metadata, scans, migrate
code	23	Harness Code — repos, PRs, branches, commits, tags
governance	11	OPA policies, policy sets, policy evaluations
audit	2	Audit trail across every Harness resource
aievals	30	AI evaluations — datasets, evaluations, runs, metrics, targets, models, suites
kg	6	Knowledge Graph schema and HQL query engine

Use harness list noun --matrix for the live noun × verb matrix. Use harness <verb> <noun> --help for full flag details on any command.

---

Contents

• Core (management & discovery)
• Platform
• Pipelines / CI-CD
• CD (Continuous Delivery)
• IaCM
• Artifact Registry (HAR)
• Code (Harness Code)
• Governance
• Audit
• AI Evals (aievals)
• Knowledge Graph (kg)
• Interactive TUI (--ui)
• Conventions used in this doc

---

Core (management & discovery)

Source: pkg/spec/core.spec.yaml.

Auth

Command	One-line description
harness auth login	Save credentials (PAT) to a profile via interactive flow.
harness auth setscope	Set the default org and/or project on a profile.
harness auth logout	Remove a profile and its stored credentials.
harness auth profiles	List all configured authentication profiles.
harness auth status	Show the current auth profile and validate credentials.
harness auth env	Print env vars for the current auth context (use with --export for sourcing).
harness auth token	Print the active API token to stdout.

Version & install

Command	One-line description
harness version	Print the Harness CLI version.
harness install cli	Install or upgrade the harness binary itself.
harness install module <name>	Install or upgrade a CLI module binary (e.g. har).

Discovery

Command	One-line description
harness list module	List all loaded CLI modules (builtin + plugin).
harness get module <name>	Show the domain model and nouns for a module (--matrix for noun/verb support).
harness list noun	List all registered nouns with their module and supported verbs (--matrix).
harness get noun <noun>	Show fields and supported commands for a specific noun.

Debug

Command	One-line description
harness debug miscfg	Trigger a misconfigured command (dev-only — registry self-test).

---

Platform

Source: pkg/spec/platform.spec.yaml.

Account, Organizations & Projects

Command	One-line description
harness get account	Get the current account details.
harness list organization	List organizations in the account.
harness get organization <id>	Get an organization by identifier.
harness create organization	Create a new organization.
harness update organization	Update an organization (get-then-put via --set/--del).
harness delete organization	Delete an organization by identifier.
harness list project	List projects in an organization.
harness get project <id>	Get a project by identifier.
harness create project	Create a new project.
harness update project	Update a project (get-then-put via --set/--del).
harness delete project	Delete a project by identifier.

Users, Groups & Service Accounts

Command	One-line description
harness list user	List users in the account.
harness get user <id>	Get a user by identifier.
harness list user_group	List user groups in the account.
harness get user_group <id>	Get a user group by identifier.
harness list service_account	List service accounts in the account.
harness get service_account <id>	Get a service account by identifier.

Roles, Permissions & Resource Groups

Command	One-line description
harness list role	List roles in the account.
harness get role <id>	Get a role by identifier.
harness list role_assignment	List role assignments in scope.
harness get role_assignment <id>	Get a role assignment by identifier.
harness list resource_group	List resource groups in scope.
harness get resource_group <id>	Get a resource group by identifier.
harness list permission	List all available permissions.
harness get permission <id>	Get a permission by identifier.

Settings

Command	One-line description
harness list setting	List platform settings.
harness get setting <id>	Get a setting value by identifier.

Connectors & Secrets

Command	One-line description
harness list connector	List connectors (multi-level via --level).
harness get connector <id>	Get a connector by identifier.
harness create connector <id>	Create a connector (--set fields or -f YAML body).
harness update connector <id>	Update a connector (get-then-put via --set/--del).
harness delete connector <id>	Delete a connector by identifier.
harness execute connector <id>	Run a connectivity test against a connector and return the structured result.
harness list secret	List secrets (metadata only — values never returned).
harness get secret <id>	Get a secret by identifier (metadata only — value never returned).
harness create secret <id>	Create a secret (--set fields or -f YAML body; values redacted from echo).
harness update secret <id>	Update a secret (get-then-put via --set/--del).
harness delete secret <id>	Delete a secret by identifier.

Delegates & Delegate Tokens

Command	One-line description
harness list delegate	List delegates in the account.
harness get delegate <id>	Get a delegate by identifier.
harness list delegate_token	List delegate tokens in the account.
harness create delegate_token <id>	Create a delegate token (token value is returned once at creation time).
harness delete delegate_token <id>	Revoke (delete) a delegate token.

Entity Usage

Command	One-line description
harness list entity_usage	List every place a given entity (connector, secret, template, …) is referenced (--entity-type/--entity-ref).

---

Pipelines / CI-CD

Source: pkg/spec/pipeline.spec.yaml.

Pipelines

Command	One-line description
harness list pipeline	List pipelines in a project.
harness get pipeline <id>	Get a pipeline's YAML definition (--format json to convert; --raw for full envelope).
harness create pipeline	Create a pipeline — inline from YAML (-f file.yaml) or Git-backed (--connector/--repo/--file-path).
harness update pipeline	Update a pipeline's YAML definition (-f file.yaml or -f - for stdin).
harness delete pipeline <id>	Delete a pipeline by identifier.
harness execute pipeline <id>	Trigger a pipeline execution.
harness execute pipeline:dynamic	Execute a dynamic pipeline (no saved pipeline definition required).
harness execute pipeline:input_set <id>	Execute a pipeline using the inputSetList endpoint (merges input sets server-side).
harness list pipeline_v1	List v1-schema pipelines in a project (legacy API compatibility).
harness get pipeline_v1 <id>	Get a v1-schema pipeline by identifier.
harness get pipeline:summary <id>	Get a lightweight pipeline summary (without full YAML).
harness get runtime_input_template <id>	Get the runtime input template for a pipeline (shows all <+input> placeholders).

Executions

Command	One-line description
harness list execution	List pipeline executions in a project (optionally scope to a pipeline ID).
harness get execution <id>	Get a pipeline execution by ID.
harness list execution_step	List expanded execution steps (including loop/matrix iterations) for a pipeline execution.
harness list execution_log	List all log keys for a pipeline execution.
harness get execution_log <key>	Fetch logs for a log key; use <pipeline/execId> or append / to fetch all logs by prefix.

Triggers, Input Sets & Templates

Command	One-line description
harness list trigger	List triggers for a pipeline.
harness get trigger <id>	Get a trigger by identifier.
harness list input_set	List input sets for a pipeline.
harness get input_set <id>	Get an input set by identifier.
harness list template	List templates in a project.
harness get template <id>	Get a template by identifier.

Approvals & Freezes

Command	One-line description
harness list approval_instance	List approval instances for a pipeline execution.
harness list freeze_window	List deployment freeze windows (multi-level via --level).
harness get freeze_window <id>	Get a deployment freeze window by identifier.
harness get global_freeze	Get the global deployment freeze status.

---

CD (Continuous Delivery)

Source: pkg/spec/cd.spec.yaml.

The CD module covers the four primary deployment resources: services (what you deploy), environments (where you deploy), infrastructure definitions (how you deploy), and service overrides (per-environment service config).

Services

Command	One-line description
harness list service	List services in a project.
harness get service <id>	Get a service by identifier.
harness create service <id>	Create a service (--set name=<name> [description=...]).
harness update service <id>	Update a service's name, description, or tags.
harness delete service <id>	Delete a service by identifier.

Environments

Command	One-line description
harness list environment	List environments in a project.
harness get environment <id>	Get an environment by identifier.
harness create environment <id>	Create an environment (--set name=<name> type=Production|PreProduction).
harness update environment <id>	Update an environment's name, type, description, or tags.
harness delete environment <id>	Delete an environment by identifier.

Infrastructure

Command	One-line description
harness list infrastructure --env <e>	List infrastructure definitions inside an environment.
harness get infrastructure <id>	Get an infrastructure definition (--env <environment_id> required).
harness create infrastructure <id>	Create an infrastructure definition (--set name=<name> environmentRef=<env> …).
harness update infrastructure <id>	Update an infrastructure definition.
harness delete infrastructure <id>	Delete an infrastructure definition (--env <environment_id> required).

Service Overrides

Command	One-line description
harness list service_override --env <e>	List service overrides for an environment.
harness get service_override <id>	Get a service override by identifier.
harness create service_override <id>	Create a service override (--set environmentRef=<env> type=ENV_GLOBAL_OVERRIDE|ENV_SERVICE_OVERRIDE).
harness update service_override <id>	Update a service override.
harness delete service_override <id>	Delete a service override.

---

IaCM

Source: pkg/spec/iacm.spec.yaml.

Command	One-line description
harness list workspace	List IACM workspaces in a project.
harness get workspace <id>	Get an IACM workspace by identifier.
harness execute workspace <id>	Execute a remote Terraform plan on a workspace.

---

Artifact Registry (HAR)

Source: pkg/spec/har.spec.yaml. Ships as the separate harness-har binary; dispatched transparently from harness.

Registries

Command	One-line description
harness list registry	List artifact registries in a project.
harness get registry <id>	Get an artifact registry by identifier.
harness create registry	Create a new artifact registry.
harness delete registry <id>	Delete an artifact registry by identifier.
harness configure registry <id>	Configure a local package-manager client (e.g. .npmrc/pip.conf) to use a Harness registry.

Registry metadata

Command	One-line description
harness get registry_metadata <id>	Get metadata for an artifact registry.
harness update registry_metadata	Update metadata on an artifact registry (--set key=value, --del key).

Artifacts — push (per-format)

Command	One-line description
harness push artifact:maven	Push a Maven artifact (.jar/.war) to a Harness registry.
harness push artifact:npm	Push an npm package (.tgz) to a Harness registry.
harness push artifact:python	Push a Python package (.whl) to a Harness registry.
harness push artifact:nuget	Push a NuGet package (.nupkg) to a Harness registry.
harness push artifact:rpm	Push an RPM package to a Harness registry.
harness push artifact:cargo	Push a Cargo crate (.crate) to a Harness registry.
harness push artifact:go	Push a Go module to a Harness registry.
harness push artifact:conda	Push a Conda package to a Harness registry.
harness push artifact:dart	Push a Dart package to a Harness registry.
harness push artifact:composer	Push a Composer package (.zip) to a Harness registry.
harness push artifact:swift	Push a Swift package to a Harness registry.
harness push artifact:puppet	Push a Puppet module (.tar.gz) to a Harness registry.
harness push artifact:helm	Push a Helm chart to a Harness registry.
harness push artifact:docker	Push a Docker image to a Harness registry.

Artifacts — pull / list / get / delete

Command	One-line description
harness pull artifact <registry>	Pull a generic artifact from a Harness registry.
harness list artifact <registry>	List artifacts in a registry.
harness get artifact <id>	Get artifact metadata by registry and name.
harness delete artifact <id>	Delete an artifact and all its versions.

Artifact versions

Command	One-line description
harness list artifact_version	List versions of an artifact.
harness get artifact_version <id>	Get artifact-version metadata.
harness delete artifact_version <id>	Delete a specific artifact version.
harness list artifact_file	List files in a specific artifact version.
harness execute artifact_version:copy <id>	Copy a specific artifact version to another registry.
harness execute artifact_version:firewall_scan <id>	Evaluate firewall policy for a specific artifact version.

Artifact / version metadata

Command	One-line description
harness get artifact_metadata <id>	Get metadata for an artifact.
harness update artifact_metadata	Update metadata on an artifact (--set key=value, --del key).
harness get artifact_version_metadata <id>	Get metadata for an artifact version.
harness update artifact_version_metadata	Update metadata on an artifact version (--set key=value, --del key).

Registry-level execute verbs

Command	One-line description
harness execute registry:firewall_scan	Audit lock-file dependencies against firewall policies for a registry.
harness execute registry:migrate	Migrate artifacts from a source registry into Harness using a config file (-f).

---

Code (Harness Code)

Source: pkg/spec/code.spec.yaml.

Built-in git hosting. Repositories are top-level. PRs, branches, commits, and tags live inside a repo. Compound IDs are <repo>/<pr-number>, <repo>/<branch>, <repo>/<sha>.

Repositories

Command	One-line description
harness list repository	List code repositories in a project.
harness get repository <id>	Get a repository by identifier.
harness create repository <id>	Create a new repository (--set identifier=<name> [default_branch=main] [description=…] [is_public=true]).
harness update repository <id>	Update a repository (description, default_branch, is_public).
harness delete repository <id>	Delete a repository by identifier.

Pull Requests

Command	One-line description
harness list pr <repo>	List pull requests for a repository.
harness get pr <repo>/<pr_number>	Get pull request details.
harness create pr <repo>	Create a pull request (--set title=… source_branch=… target_branch=…).
harness update pr <repo>/<pr_number>	Update a pull request (--set title=…).
harness execute pr:merge <repo>/<pr_number>	Merge a pull request (--method merge|squash|rebase|fast-forward).
harness execute pr:close <repo>/<pr_number>	Close a pull request without merging.
harness list pr_activity <repo> --pr <n>	List PR activity (comments, reviews, state changes).

Branches, Commits & Tags

Command	One-line description
harness list branch <repo>	List branches in a repository.
harness get branch <repo>/<branch>	Get branch details.
harness create branch <repo>	Create a branch (--set name=<branch> target=<sha_or_branch>).
harness delete branch <repo>/<branch>	Delete a branch by name.
harness list commit <repo>	List commits (--branch <ref> to scope).
harness get commit <repo>/<sha>	Get commit details.
harness list tag <repo>	List tags in a repository.
harness create tag <repo>	Create a tag (--set name=<tag> target=<sha>).
harness delete tag <repo>/<tag>	Delete a tag by name.

---

Governance

Source: pkg/spec/governance.spec.yaml.

OPA (Open Policy Agent) policies authored in Rego, grouped into policy sets that are evaluated on pipeline runs and resource changes.

Policies

Command	One-line description
harness list policy	List governance policies.
harness get policy <id>	Get a policy's details (including its Rego source).
harness create policy <id>	Create a policy (--set name=<name> rego='package main…').
harness update policy <id>	Update a policy's name or Rego source.
harness delete policy <id>	Delete a policy by identifier.

Policy Sets

Command	One-line description
harness list policy_set	List policy sets.
harness get policy_set <id>	Get a policy set's details.
harness create policy_set <id>	Create a policy set (--set name=<name> type=pipeline action=onrun enabled=true).
harness update policy_set <id>	Update a policy set (name, enabled, member policies).
harness delete policy_set <id>	Delete a policy set by identifier.

Policy Evaluations

Command	One-line description
harness list policy_evaluation	List recorded policy-set evaluations against resources.

---

Audit

Source: pkg/spec/audit.spec.yaml.

Read-only access to the audit trail across every Harness module. Every create/update/delete produces an audit_event.

Command	One-line description
harness list audit_event	List audit-trail events (defaults to last 7 days; filter via --from, --to, --resource-type, --action, --principal).
harness get audit_event <id>	Get a single audit event with the YAML diff of the change.

---

AI Evals (aievals)

Source: pkg/spec/aievals.spec.yaml.

Define, run, and score evaluations of LLM pipelines and prompts. The lifecycle is dataset → evaluation → run, with reusable metrics, metric sets, targets, and models.

Datasets

Command	One-line description
harness list eval_dataset	List AI Evals datasets.
harness get eval_dataset <id>	Get an AI Evals dataset by identifier.
harness create eval_dataset <id>	Create a dataset (--set name=… identifier=…).
harness delete eval_dataset <id>	Delete a dataset by identifier.

Evaluations & Runs

Command	One-line description
harness list evaluation	List AI Evals evaluations.
harness get evaluation <id>	Get an evaluation by identifier.
harness create evaluation <id>	Create an evaluation (--set name=… identifier=… dataset_id=… target_id=… metric_set_id=…).
harness delete evaluation <id>	Delete an evaluation by identifier.
harness execute evaluation:run <id>	Trigger a new run for an evaluation.
harness list eval_run	List eval runs (optionally scoped to an evaluation as parentid).
harness get eval_run <id>	Get an eval run by identifier (status, scores, per-row results).

Metrics & Metric Sets

Command	One-line description
harness list eval_metric	List AI Evals metrics.
harness get eval_metric <id>	Get a metric by identifier.
harness create eval_metric <id>	Create a metric (--set name=… identifier=… kind=exact_match|contains|rubric_judge|geval).
harness delete eval_metric <id>	Delete a metric by identifier.
harness list eval_metric_set	List metric sets.
harness get eval_metric_set <id>	Get a metric set by identifier.
harness create eval_metric_set <id>	Create a metric set (--set name=… identifier=…).
harness delete eval_metric_set <id>	Delete a metric set by identifier.

Targets, Models, Suites

Command	One-line description
harness list eval_target	List AI Evals targets (LLM endpoints under test).
harness get eval_target <id>	Get a target by identifier.
harness create eval_target <id>	Create a target (--set name=… identifier=… type=prompt).
harness delete eval_target <id>	Delete a target by identifier.
harness list eval_model	List AI Evals model definitions.
harness get eval_model <id>	Get a model definition by identifier.
harness create eval_model <id>	Create a model (--set name=… identifier=… provider=openai model_id=gpt-4o).
harness delete eval_model <id>	Delete a model definition by identifier.
harness list eval_suite	List eval suites (collections of evaluations run together).
harness get eval_suite <id>	Get an eval suite by identifier.
harness delete eval_suite <id>	Delete an eval suite by identifier.
harness execute eval_suite:run <id>	Trigger a run for every evaluation in the suite.

---

Knowledge Graph (kg)

Source: pkg/spec/kg.spec.yaml.

Schema browser plus the HQL (Harness Query Language) execution engine. Schema types are entities, events, metrics, views, relationships, and configs that map every resource in Harness into a unified, typed graph.

Schema browser

Command	One-line description
harness list kg	List schema types (--kind OBJECT_KIND_ENTITY|EVENT|METRIC|VIEW|RELATIONSHIP|CONFIG to filter).
harness get kg <type_id>	Get a schema type with full field metadata.
harness list kg:queryable_type	List types that are reachable via HQL.
harness list kg:related_type <type_id>	List types related to a source type via relationship edges (--kind to filter).
harness list kg:connection	List active data-source connections backing the query engine (valid: false ⇒ stale data).

HQL — Harness Query Language

Command	One-line description
harness execute hql:run	Execute an HQL query (--query 'find entity "platform:project" | select { * } | limit 10').
harness execute hql:validate	Parse-check an HQL query without running it.
harness execute hql:explain	Show the execution plan for an HQL query.
harness execute hql:grammar	Fetch the HQL ANTLR4 grammar (useful for editor tooling).

---

Interactive TUI (--ui)

Many commands support a --ui flag that launches an interactive terminal UI (Bubble Tea TUI). It requires a TTY on both stdin and stdout — running under a pipe, in CI, or with output redirected will error with --ui requires an interactive terminal (TTY).

Two flavors:

• Paged list browser — auto-enabled on every list command whose API supports paging. Lets you scroll, search, and drill into rows. Wired in pkg/registry/registry.go at the list+paging branch.
• Resource picker / detail view — opt-in on selected get commands via ui: true in the spec. Used to interactively pick or inspect a single resource.

list commands with --ui

Module	Commands
core	auth profiles, list module, list noun
platform	list organization, list project, list user, list user_group, list service_account, list role, list role_assignment, list resource_group, list permission, list setting, list connector, list secret, list delegate, list delegate_token, list entity_usage
pipeline	list pipeline, list pipeline_v1, list execution, list execution_step, list execution_log, list trigger, list input_set, list template, list approval_instance, list freeze_window
cd	list service, list environment, list infrastructure, list service_override
iacm	list workspace
har	list registry, list artifact, list artifact_version, list artifact_file
code	list repository, list pr, list branch, list commit, list tag, list pr_activity
governance	list policy, list policy_set, list policy_evaluation
audit	list audit_event
aievals	list eval_dataset, list evaluation, list eval_run, list eval_metric, list eval_metric_set, list eval_target, list eval_model, list eval_suite
kg	list kg, list kg:queryable_type, list kg:connection

get commands with --ui

Command	What --ui does
harness get project --ui	Interactive project picker (org-aware).
harness get workspace --ui	Interactive IaCM workspace picker.
harness get artifact_version --ui	Interactive artifact + version picker.
harness get execution_log --ui	Live log viewer for a pipeline execution — tails steps, supports navigation. Use <[pipeline/]execId> form (not a full log key) and don't pair with --stage or --step.

Notes

• --ui is mutually exclusive with --format, --out, and stream redirection — pick one.
• For list commands with --ui, paging flags (--limit, --offset, --all, --count) are ignored; the TUI handles paging itself.
• If a noun is added to a spec with a paged list endpoint, --ui is wired automatically — no extra spec changes needed.

---

Conventions used in this doc

• <id> placeholder — the resource identifier (e.g. pipeline ID, project ID).
• Compound IDs — code, governance, and pipeline-execution resources use <parent>/<child> forms (e.g. <repo>/<pr_number>, <pipeline>/<execId>). The CLI accepts the same form everywhere a parent is required.
• Get-then-put updates — update verbs accept --set key=value and --del key (instead of a full body) for fields the API doesn't natively support PATCH on.
• YAML I/O — -f file.yaml reads the body from a file; -f - reads from stdin; without -f, get prints YAML by default.
• Output format — every command supports --format json|jsonl|table|text|csv|tsv|markdown; defaults are table for list and text for everything else.
• Paging — list commands support --limit, --offset, --all, and --count where the underlying API supports it.
• Scope — --account, --org, --project override profile scope per-invocation; some nouns also accept --level to switch between account/org/project scope.

For the always-current source of truth, run:

harness list noun --matrix     # all nouns × verbs
harness get noun pipeline      # fields and supported verbs for one noun
harness <verb> <noun> --help   # full flag list for any command