ironflow platform

Manage the Ironflow platform: users, tenants, roles, and audit log.

Requires platform credentials (via ironflow platform login) or IRONFLOW_API_KEY.

ironflow platform <subcommand> [flags]

`ironflow platform create-admin`

Bootstrap the first platform admin user. Refuses if any platform user already exists. Uses IRONFLOW_API_KEY for authentication (bootstrap runs before platform login is available).

ironflow platform create-admin --email <email> --name <name> [flags]

Flag	Short	Type	Description
`--email`		string	Admin email (required)
`--name`		string	Admin display name (required)
`--server`	`-s`	string	Server URL override

Password is read interactively from the terminal.

Examples:

ironflow platform create-admin --email admin@example.com --name "Admin"

`ironflow platform login`

Authenticate with email and password to obtain a platform JWT token. The token is stored in ~/.config/ironflow/credentials.json (or $IRONFLOW_CONFIG_DIR/credentials.json).

ironflow platform login --email <email> [flags]

Flag	Short	Type	Default	Description
`--email`		string		Platform user email (required)
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform login --email admin@example.com
ironflow platform login --email admin@example.com --server http://localhost:9000

`ironflow platform users`

Manage platform users.

ironflow platform users <subcommand> [flags]

`ironflow platform users list`

List all platform users with their IDs, emails, names, and active status.

ironflow platform users list [flags]

Flag	Short	Type	Default	Description
`--json`		bool	false	Output as JSON
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform users list
ironflow platform users list --json

`ironflow platform users create`

Create a new platform user with email, name, and password.

ironflow platform users create --email <email> --name <name> [flags]

Flag	Short	Type	Description
`--email`		string	User email (required)
`--name`		string	User display name (required)
`--role-ids`		[]string	Role IDs to assign
`--server`	`-s`	string	Server URL override

Password is read interactively from the terminal.

Examples:

ironflow platform users create --email user@example.com --name "User"
ironflow platform users create --email user@example.com --name "User" --role-ids role_abc

`ironflow platform users delete`

Delete a platform user by ID.

ironflow platform users delete <id> [flags]

Flag	Short	Type	Default	Description
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform users delete usr_abc123

Platform API Keys

Platform API keys are managed through the unified ironflow apikey command with the --platform flag. See ironflow apikey.

# Create a platform key
ironflow apikey create my-platform-key --platform

# List platform keys
ironflow apikey list --platform

# Rotate a platform key
ironflow apikey rotate ak_abc123

# Delete a platform key
ironflow apikey delete ak_abc123

`ironflow platform tenants`

Manage tenants.

ironflow platform tenants <subcommand> [flags]

`ironflow platform tenants list`

List all tenants with their IDs, names, and creation dates.

ironflow platform tenants list [flags]

Flag	Short	Type	Default	Description
`--json`		bool	false	Output as JSON
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform tenants list
ironflow platform tenants list --json

`ironflow platform tenants provision`

Provision a new tenant.

ironflow platform tenants provision --name <name> [flags]

Flag	Short	Type	Default	Description
`--name`		string		Tenant name (required)
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform tenants provision --name my-tenant

`ironflow platform tenants delete`

Delete a tenant by ID.

ironflow platform tenants delete <id> [flags]

Flag	Short	Type	Default	Description
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform tenants delete tnt_abc123

`ironflow platform roles`

Manage platform roles.

ironflow platform roles <subcommand> [flags]

`ironflow platform roles list`

List all platform roles with their IDs, names, and default status.

ironflow platform roles list [flags]

Flag	Short	Type	Default	Description
`--json`		bool	false	Output as JSON
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform roles list
ironflow platform roles list --json

`ironflow platform roles create`

Create a new platform role with the given name.

ironflow platform roles create <name> [flags]

Flag	Short	Type	Default	Description
`--policy-ids`		[]string		Policy IDs to attach
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform roles create my-role
ironflow platform roles create my-role --policy-ids pol_abc

`ironflow platform roles delete`

Delete a platform role by ID.

ironflow platform roles delete <id> [flags]

Flag	Short	Type	Default	Description
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform roles delete role_abc123

`ironflow platform audit`

Query the platform audit log with optional filters.

ironflow platform audit [flags]

Flag	Short	Type	Default	Description
`--event-type`		string		Filter by event type
`--from`		string		Filter events from this date or RFC3339 timestamp (inclusive)
`--to`		string		Filter events up to this date or RFC3339 timestamp; a bare date means its midnight, so it excludes the named day
`--cursor`		string		Pagination cursor
`--limit`		int	0	Maximum number of events to return
`--json`		bool	false	Output as JSON
`--server`	`-s`	string		Server URL override

Examples:

ironflow platform audit
ironflow platform audit --event-type user.created --limit 50
ironflow platform audit --from 2024-01-01 --to 2024-12-31 --json