CLI command reference

This reference covers all 320 commands in the current Anectico CLI. It is generated from the same Cobra command tree used by the binary, so command names, positional arguments, aliases, flags, and defaults stay aligned with the implementation.

For the exact manifest bundled into the version you installed, run:

anectico docs

How commands behave

• Interactive terminals receive readable tables; redirected or piped output is JSON. Commands without a purpose-built table use a deterministic PATH / TYPE / VALUE tree that includes every JSON container and scalar without truncation.
• Use --output json or --output table to choose explicitly.
• Destructive commands never prompt. They require --yes and fail without it.
• Commands that accept structured bodies use --body '<inline JSON>', --file path, or --file - for standard input.
• Issue lifecycle writes require the exact --expected-version shown by anectico issues view; the CLI never auto-fetches a newer revision or silently overwrites concurrent triage.
• The active project comes from --project, ANECTICO_PROJECT, or the selected profile, in that order.
• For a project-bound API key, that active project must be omitted or match the key binding exactly. A conflict fails before product logic with HTTP 403 and exit code 4; it is never silently replaced.
• Non-interactive errors are one JSON object on standard error with error, message, and exit_code.
• API failures also include their real HTTP status; local failures omit status.
• For anectico send, throttled responses preserve the server's Retry-After value as retry_after.
• anectico send event exits zero only for a complete validated queue acknowledgement. Queue acceptance does not prove storage visibility. Refusals (capture_rejected), publication uncertainty (capture_uncertain), and invalid receipts (capture_ack_invalid) exit 1; JSON failures go to stderr with no success output.
• send event makes one attempt and does not retry automatically or preserve a message ID across invocations. Rerunning after uncertainty may duplicate the event.

Global flags

Global flags can appear before or after a subcommand.

Flag	Type/default	What it controls
--api-key	string	API key for headless auth (env: ANECTICO_API_KEY)
--api-url	string	Anectico API origin, no path (e.g. https://api.example.com); every endpoint path (/api/v1/..., /mcp, /auth/me) is appended to it (env: ANECTICO_API_URL)
--ingest-url	string	ingest base URL for 'anectico send' (env: ANECTICO_INGEST_URL)
--json	bool	alias for --output json; the last of --output/--json wins
--no-color	bool; default: false	disable colored output
-o, --output	string	output format: table|json (default: table on a TTY, json when piped); the last of --output/--json wins
--profile	string	config profile to use (env: ANECTICO_PROFILE)
--project	string	project id scope (env: ANECTICO_PROJECT)

Exit codes

Code	Meaning
0	success
1	API/general error, invalid JSON output, or signal interruption
2	usage error (unknown command or bad flags/arguments)
3	unauthenticated (log in or set ANECTICO_API_KEY)
4	forbidden (credential lacks scope or conflicts with the requested project)
5	not found

Command catalog

Required positional arguments use angle brackets. Optional arguments use square brackets. Flags shown in the last column are command-specific; all global flags remain available.

accounts

Command	What it does	Command-specific flags
anectico accounts get <group-type> <group-key>	Show one account's profile	—
anectico accounts list	List accounts	--limit (int; default: 0) — maximum rows --offset (int; default: 0) — pagination offset --search (string) — search by key/name --type (string) — filter by group type (e.g. company)
anectico accounts timeline <group-type> <group-key>	The account's all-signal timeline (every member's activity)	--cursor (string) — pagination cursor from the previous page --limit (int; default: 0) — maximum entries
anectico accounts types	List the org's group types with counts	—

agent

Command	What it does	Command-specific flags
anectico agent bootstrap	Mint a narrow agent key, install host config, and verify MCP	--agent (string) — declare the registry agent asset this key is for (an asset id from anectico fleet list); without it a kill containment on that agent cannot stop this key being re-minted --embed-secret (bool; default: false) — write the literal key into the host MCP config (0600) instead of an ANECTICO_API_KEY reference --env-file (string) — path for --secret-dest env-file; written 0600 with ANECTICO_API_KEY=... --expires-in (string; default: 30d) — expire the key after a relative duration, e.g. 30m, 6h, 30d (max 365d); empty means never, which is discouraged --force (bool; default: false) — allow --env-file to replace an existing file --host (string; default: none) — install skill and MCP config for an agent host: none, claude, codex, cursor, or gemini --name (string) — display name for the key (default: agent-HOSTNAME-YYYY-MM-DD) --org-wide (bool; default: false) — mint a key with NO project binding — it reads every project in the org; overrides the active project --scope (stringSlice; default: []) — extra scope to grant (repeatable), unioned with the bundle --scope-profile (string; default: investigate) — capability bundle to materialize into explicit scopes, unioned with any --scope; pass an empty value to grant only --scope. Bundles: investigate (28 scopes), incident (46 scopes), agent-observability (10 scopes), admin (umbrellas only — requires explicit --scope) --secret-dest (string; default: keychain) — where the secret goes: keychain, env-file, or stdout
anectico agent key env	Print ANECTICO_API_KEY=... for the stored agent key	--export (bool; default: false) — prefix the assignment with the export keyword, for eval in a shell

agent-runs

Command	What it does	Command-specific flags
anectico agent-runs context <run-id>	Show context step summaries and assembly, compaction, and cache rows	—
anectico agent-runs get <run-id>	Show one run with its spans	—
anectico agent-runs list	List agent runs	--agent-observation-key (stringSlice; default: []) — filter by immutable agent observation key (repeatable) --distinct-id (string) — filter to one person --env (string) — deployment environment scope --errors-only (bool; default: false) — only runs with errors --group-key (string) — account key (requires --group-type) --group-type (string) — account type (requires --group-key) --person-id (string) — filter to one canonical person --provider (string) — filter to runs that used this provider --since (string; default: 24h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --status (string) — terminal status (completed, failed, timed_out, cancelled, max_steps) --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)

alerts

Command	What it does	Command-specific flags
anectico alerts ack <alert-id>	Acknowledge an alert Aliases: acknowledge.	--note (string) — optional acknowledgment note
anectico alerts list	List active alerts	--cursor (string) — opaque cursor returned by the previous page --limit (int; default: 50) — maximum rows --severity (string) — filter by severity --state (string) — filter by active state (pending, firing, acknowledged, silenced; comma-separated)
anectico alerts resolve <alert-id>	Manually resolve an alert	--note (string) — optional resolution note
anectico alerts rules create	Create an alert rule (body = the rule JSON; see anectico docs)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico alerts rules delete <rule-id>	Delete an alert rule	--yes (bool; default: false) — confirm this destructive operation (required)
anectico alerts rules get <rule-id>	Show one alert rule	—
anectico alerts rules history-metric <watch-id>	Read metric-watch evaluation history under current source permissions	--cursor (string) — opaque next_cursor for the same project, watch and limit --limit (uint32; default: 20) — page size, 1..50
anectico alerts rules list	List alert rules	--limit (int; default: 0) — maximum rows --offset (int; default: 0) — pagination offset --severity (string) — filter by severity
anectico alerts rules preview-metric	Preview a native metric watch without scheduling or sending	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico alerts rules test <rule-id>	Validate a rule and preview its query	—
anectico alerts rules update <rule-id>	Update an alert rule (body must include the current version)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico alerts silences create	Create a silence (body: name, matchers[{label_name,operator,value}], starts_at, ends_at)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico alerts silences delete <silence-id>	Expire a silence	--yes (bool; default: false) — confirm this destructive operation (required)
anectico alerts silences list	List active silences	—

analytics

Command	What it does	Command-specific flags
anectico analytics audiences create <result-id>	Preview and create a full resolved-person audience through MCP	--confirm-token (string) — preview token; omission previews without applying --description (string) — optional description (up to 4096 UTF-8 bytes) --idempotency-key (string) — required stable UUID; identical mutation retries reuse it --lifetime-seconds (uint32; default: 86400) — audience generation lifetime, 1..2592000 seconds; default one day --name (string) — required audience name (up to 256 UTF-8 bytes) --selection-id (string) — required exact complete selection UUID from the source result
anectico analytics audiences get <cohort-id>	Read one exact retained generation under current source authority	--generation (string) — required exact generation as a canonical decimal string
anectico analytics audiences list	Discover derived audience names and exact generation references	--after-id (string) — last cohort UUID from the preceding live page --limit (uint32; default: 50) — page size, 1..100 --search (string) — literal case-insensitive name or description substring
anectico analytics audiences members <cohort-id>	Page exact saved audience members under current source authority	--cursor (string) — opaque next_cursor from the same generation and page size --generation (string) — required exact generation as a canonical decimal string --limit (uint32; default: 50) — page size, 1..100; keep unchanged across pages
anectico analytics audiences replace <cohort-id>	Preview and replace a full resolved-person audience through MCP	--confirm-token (string) — preview token; omission previews without applying --expected-generation (string) — required exact current generation as a decimal string --idempotency-key (string) — required stable UUID; identical mutation retries reuse it --lifetime-seconds (uint32; default: 86400) — audience generation lifetime, 1..2592000 seconds; default one day --result-id (string) — required new source result UUID --selection-id (string) — required exact complete selection UUID from the source result
anectico analytics catalog	List event names and counts in an explicit window; completeness remains unknown	--cursor (string) — opaque next_cursor; reuse identical filters and page size; expires after 15 minutes --end-time (string) — exclusive RFC3339 event time; maximum window 90 days --environment (string) — exact environment; empty selects all environments --limit (uint32; default: 50) — page size; maximum 200; zero uses 50 --prefix (string) — literal case-sensitive event name prefix --start-time (string) — inclusive RFC3339 event time; millisecond precision or coarser
anectico analytics exports create <result-id>	Preview and enqueue an exact frozen measurement or full participant export	--confirm-token (string) — token from intent preview; omission previews without writing --format (string; default: json) — csv, json or parquet --idempotency-key (string) — required stable ASCII key; reuse identical retries --projection (string) — required: measurement or participants --selection-id (string) — required full selection UUID, not a participant page --snapshot-id (string) — required exact frozen snapshot UUID
anectico analytics insights create <insight-id>	Preview and create a saved-insight definition through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from the preview; omission previews without applying --description (string) — full replacement description; omission clears it --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID; reuse only for the identical mutation --title (string) — full replacement title (required, up to 200 bytes)
anectico analytics insights delete <insight-id>	Preview and delete a saved-insight definition through MCP	--confirm-token (string) — token from the preview; omission previews without applying --expected-revision (string) — exact current revision as a decimal string --idempotency-key (string) — required stable UUID; reuse only for the identical mutation
anectico analytics insights duplicate <source-insight-id> <new-insight-id>	Preview and copy an exact retained revision into a new insight in this project	--confirm-token (string) — token from preview; repeat exact arguments to apply --idempotency-key (string) — required stable UUID; use the same source revision and title on retries --revision (int64; default: 0) — required exact retained source revision; current/zero is refused --title (string) — optional replacement title; defaults to the source title
anectico analytics insights export <insight-id>	Export an exact saved revision as portable JSON without ownership or history	--revision (int64; default: 0) — required exact positive retained revision; writes portable JSON to stdout
anectico analytics insights get <insight-id>	Read current or retained configuration without executing it	--revision (int64; default: 0) — zero selects current; positive selects that retained revision
anectico analytics insights import <new-insight-id>	Preview and import a portable document as a new saved insight through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from the preview; omission validates and previews without creating --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID; retries must retain the identical document
anectico analytics insights list	List or search live saved-insight metadata	--after-insight-id (string) — next_after_insight_id from the previous page; live UUID ordering --limit (uint32; default: 50) — page size up to 100; zero defaults to 50 --search (string) — literal title or description substring
anectico analytics insights run <insight-id>	Execute an exact retained insight revision under current source permissions	--execution-key (string) — required UUID; reuse only to retry the same saved revision, use a new key for a new measurement --revision (int64; default: 0) — required positive retained revision; edits never change the chosen revision
anectico analytics insights update <insight-id>	Preview and update a saved-insight definition through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from the preview; omission previews without applying --description (string) — full replacement description; omission clears it --expected-revision (string) — exact current revision as a decimal string --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID; reuse only for the identical mutation --title (string) — full replacement title (required, up to 200 bytes)
anectico analytics insights validate	Check a portable definition and current target-project references without writing or querying	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico analytics quality	Inspect submitted capture positions and declared sampling; completeness remains unknown	--end-time (string) — exclusive RFC3339 event time; maximum window 183 days --environment (string) — exact environment; empty selects all environments --start-time (string) — inclusive RFC3339 event time; millisecond precision or coarser
anectico analytics query	Execute trends, person funnels or exact-period retention with an explicit retry key	--body (string) — request body as inline JSON --execution-key (string) — required UUID; retries return the same frozen result or an explicit conflict/expiry --file (string) — request body from a JSON file ("-" for stdin) --no-wait (bool; default: false) — equivalent to --wait 0: return the current status immediately without blocking --wait (duration; default: 20s) — block up to this long for a terminal execution status before returning (max 25s); the response always carries status regardless of whether it blocked
anectico analytics remeasurement compare <original-result-id> <later-result-id>	Compare exact executions under current permissions	--audience-id (string) — exact audience UUID saved from the original result; saved_audience only --comparison-end (string) — optional explicit comparison end; absence clears the original comparison --comparison-start (string) — optional explicit comparison start; requires comparison-end --end-time (string) — required exclusive new entry time, RFC3339 --generation (int64; default: 0) — exact positive retained generation; no current-generation default --population-mode (string) — required: fresh_population or saved_audience; never inferred --start-time (string) — required inclusive new entry time, RFC3339 with millisecond precision or coarser
anectico analytics remeasurement source <original-result-id>	Prepare a query template without running it	--audience-id (string) — exact audience UUID saved from the original result; saved_audience only --comparison-end (string) — optional explicit comparison end; absence clears the original comparison --comparison-start (string) — optional explicit comparison start; requires comparison-end --end-time (string) — required exclusive new entry time, RFC3339 --generation (int64; default: 0) — exact positive retained generation; no current-generation default --population-mode (string) — required: fresh_population or saved_audience; never inferred --start-time (string) — required inclusive new entry time, RFC3339 with millisecond precision or coarser
anectico analytics result audience-preview <result-id>	Assess a complete frozen person selection without creating a cohort	--selection-id (string) — exact full-population selection UUID; eligible is not authorization to publish
anectico analytics result cancel <result-id>	Stop a pending or running execution and report the status that stands	--yes (bool; default: false) — confirm this destructive operation (required)
anectico analytics result contribution <result-id>	Read one participant's frozen funnel event chain	--contribution-ref (string) — exact contribution_ref from the participant row --ordinal (uint64; default: 0) — exact positive ordinal from the participant row --selection-id (string) — exact selection ID used for the participant page --snapshot-id (string) — exact frozen snapshot ID from the result
anectico analytics result get <result-id>	Read a frozen result under current permissions and content-erasure checks	--no-wait (bool; default: false) — equivalent to --wait 0: return the current status immediately without blocking --wait (duration; default: 20s) — block up to this long for a terminal execution status before returning (max 25s); the response always carries status regardless of whether it blocked
anectico analytics result participants <result-id>	Page one exact frozen result selection	--cursor (string) — opaque next_cursor from the same result, selection and page size --limit (uint32; default: 50) — page size 1..100; keep fixed with a cursor --selection-id (string) — exact population selection_id returned by the result
anectico analytics schema	Inspect permitted event property types and counts; completeness remains unknown	--end-time (string) — exclusive RFC3339 event time; maximum window 90 days --environment (string) — exact environment; empty selects all environments --event (string) — exact event name --start-time (string) — inclusive RFC3339 event time; millisecond precision or coarser
anectico analytics tracking-plans apply <plan-id>	Review a portable document against the exact target revision through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from matching preview/diff; omission previews only --expected-revision (string) — required exact target revision; explicit 0 for create --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID for identical document values and target revision
anectico analytics tracking-plans create <plan-id>	Preview and create a tracking-plan definition through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from the preview; omission previews without applying --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID; reuse only for the identical mutation --name (string) — full replacement name (required, up to 200 bytes)
anectico analytics tracking-plans delete <plan-id>	Preview and delete a tracking-plan definition through MCP	--confirm-token (string) — token from the preview; omission previews without applying --expected-revision (string) — exact current revision as a decimal string --idempotency-key (string) — required stable UUID; reuse only for the identical mutation
anectico analytics tracking-plans diff <plan-id>	Review a portable document against the exact target revision through MCP	--body (string) — request body as inline JSON --expected-revision (string) — required exact target revision; explicit 0 for create --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID for identical document values and target revision
anectico analytics tracking-plans drift <plan-id>	Compare one pinned event declaration with permitted stored observations through MCP	--end (string) — required exclusive RFC3339 event time; window at most 90 days --environment (string) — exact environment; omission selects all --event (string) — required exact event declared in the pinned revision --revision (string) — required exact positive retained revision --start (string) — required inclusive RFC3339 event time, millisecond precision
anectico analytics tracking-plans export <plan-id>	Export an exact saved revision as portable JSON without ownership or history	--revision (int64; default: 0) — required exact positive retained revision; writes portable JSON to stdout
anectico analytics tracking-plans get <plan-id>	Read one current or retained revision; retired plans are unavailable	--revision (int64; default: 0) — zero reads current; positive reads that retained revision
anectico analytics tracking-plans import <new-plan-id>	Preview and import a portable document as a new tracking plan through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from the preview; omission validates and previews without creating --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID; retries must retain the identical document
anectico analytics tracking-plans list	List live tracking-plan metadata; pages are not a snapshot	--after-plan-id (string) — next_after_plan_id from the preceding page --limit (uint32; default: 50) — page size, maximum 100; zero defaults to 50
anectico analytics tracking-plans update <plan-id>	Preview and update a tracking-plan definition through MCP	--body (string) — request body as inline JSON --confirm-token (string) — token from the preview; omission previews without applying --expected-revision (string) — exact current revision as a decimal string --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — required stable UUID; reuse only for the identical mutation --name (string) — full replacement name (required, up to 200 bytes)
anectico analytics tracking-plans validate	Check a portable definition and current target-project references without writing or querying	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

anomalies

Command	What it does	Command-specific flags
anectico anomalies ack <finding-id>	Acknowledge a finding	—
anectico anomalies delete <finding-id>	Delete a finding	--yes (bool; default: false) — confirm this destructive operation (required)
anectico anomalies get <finding-id>	Show one finding	—
anectico anomalies list	List anomaly findings	--limit (int; default: 0) — maximum rows --severity (string) — info|warning|critical --signal (string) — filter by signal --since (string) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --sort (string) — detected_at (default; newest first) or actionability (most likely to be a real fault first, unranked last); both return the same findings --status (string) — open|acknowledged|resolved --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico anomalies resolve <finding-id>	Resolve a finding	—

apikey

Command	What it does	Command-specific flags
anectico apikey create	Create an API key (the secret is shown once)	--agent (string) — declare the registry agent asset this key is for (an asset id from anectico fleet list); without it a kill containment on that agent cannot stop this key being re-minted --expires-at (string) — expire the key at an exact RFC3339 instant (max 365d out) --expires-in (string) — expire the key after a relative duration, e.g. 30m, 6h, 7d (max 365d) --name (string) — display name for the key (default: agent-HOSTNAME-YYYY-MM-DD) --rate-limit (int; default: 0) — expected request volume per HOUR (0 = server default) --scope (stringSlice; default: []) — scope to grant (repeatable), e.g. --scope logs:read --scope-profile (string) — materialize a capability bundle into explicit scopes, unioned with any --scope: investigate (28 scopes), incident (46 scopes), agent-observability (10 scopes), admin (umbrellas only — requires explicit --scope)
anectico apikey list	List the org's API keys	—
anectico apikey revoke <key-id>	Revoke an API key	--yes (bool; default: false) — confirm this destructive operation (required)
anectico apikey scopes	List the grantable scope catalog	—

asset

Command	What it does	Command-specific flags
anectico asset list	List assets by review state, owner, or declared/discovered origin	--approval-state (stringSlice; default: []) — review state: unreviewed|approved|rejected (repeatable or comma-separated) --cursor (string) — opaque next_cursor from the previous page --limit (int; default: 0) — maximum assets (server cap 200) --origin (string; default: all) — asset origin: all|shadow|declared --owner-principal (string) — exact owning-principal filter --owner-team (string) — exact owning-team filter --risk-tier (stringSlice; default: []) — reviewed risk tier: unassessed|low|medium|high|critical (repeatable or comma-separated)
anectico asset own asset-id [asset-id...]	Replace the owners of one or more assets (requires agents:write)	--owner-principal (string) — new owner principal; omit or pass empty to clear --owner-team (string) — new owner team; omit or pass empty to clear
anectico asset review asset-id [asset-id...]	Review one or more assets (requires agents:write)	--approval-state (string) — decision: unreviewed|approved|rejected (required; unspecified is invalid) --reason (string) — non-blank reason applied to every named asset (required) --risk-tier (string) — reviewed blast radius: unassessed|low|medium|high|critical (required; unspecified is invalid)

channels

Command	What it does	Command-specific flags
anectico channels create	Create a channel (body: type, name, config{…})	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico channels delete <channel-id>	Delete a channel	--yes (bool; default: false) — confirm this destructive operation (required)
anectico channels get <channel-id>	Show one channel (secrets redacted)	—
anectico channels list	List notification channels	—
anectico channels test <channel-id>	Send a test notification through a channel	—
anectico channels update <channel-id>	Update a channel (omitted secret fields keep their stored value)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

cohorts

Command	What it does	Command-specific flags
anectico cohorts create	Create a cohort (body: name, kind behavioral|property|static, definition?/members?)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico cohorts delete <cohort-id>	Delete a cohort	--yes (bool; default: false) — confirm this destructive operation (required)
anectico cohorts get <cohort-id>	Show one cohort	—
anectico cohorts history <cohort-id>	List immutable cohort membership generations newest first	--cursor (string) — opaque next_cursor from the previous page --limit (int; default: 0) — maximum generations (1-1000; default 50)
anectico cohorts list	List cohorts	--cursor (string) — opaque next_cursor from the previous page --limit (int; default: 0) — maximum rows (1-1000; default 50)
anectico cohorts members <cohort-id>	List a cohort's member person ids (paginated)	--cursor (string) — opaque next_cursor from the previous page --generation (int64; default: 0) — retained membership generation (default current) --limit (int; default: 0) — maximum rows (1-1000; default 50)
anectico cohorts preview	Preview a behavioral/property body ({kind, definition}) without saving it	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --sample-limit (uint32; default: 0) — maximum sampled person ids (1-100; default 20)
anectico cohorts refresh <cohort-id>	Recompute a cohort's membership now	—
anectico cohorts replace-members <cohort-id>	Replace complete static membership (body is a JSON string array; [] clears)	--body (string) — request body as inline JSON --expected-generation (int64; default: 0) — current membership generation (required) --file (string) — request body from a JSON file ("-" for stdin) --yes (bool; default: false) — confirm this destructive operation (required)
anectico cohorts update <cohort-id>	Update a cohort (name/description/definition; kind is immutable)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

connections

Command	What it does	Command-specific flags
anectico connections create	Create a connection (body: provider, kind, display_name, secret)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico connections delete <connection-id>	Delete a connection	--yes (bool; default: false) — confirm this destructive operation (required)
anectico connections get <connection-id>	Show one connection (metadata only)	—
anectico connections list	List connections	--provider (string) — filter by provider
anectico connections update <connection-id>	Update a connection (rotate the secret / rename)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

dashboards

Command	What it does	Command-specific flags
anectico dashboards clone <dashboard-id>	Clone a dashboard	—
anectico dashboards create	Create a dashboard (body: name, project_id, description?, layout?, tags?)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico dashboards delete <dashboard-id>	Delete a dashboard	--expected-version (uint64; default: 0) — current dashboard aggregate version (required) --yes (bool; default: false) — confirm this destructive operation (required)
anectico dashboards get <dashboard-id>	Show a dashboard with its widgets	—
anectico dashboards list	List dashboards	—
anectico dashboards update <dashboard-id>	Update a dashboard (partial body; tags as {"values":[…]})	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico dashboards widgets add <dashboard-id>	Add a widget (body: expected_version, type, title, query{…}, visualization?, refresh_interval?)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico dashboards widgets delete <dashboard-id> <widget-id>	Delete a widget	--expected-version (uint64; default: 0) — current dashboard aggregate version (required) --yes (bool; default: false) — confirm this destructive operation (required)
anectico dashboards widgets query <dashboard-id> <widget-id>	Read a saved-insight widget under current permissions	--execution-key (string) — UUID reused only for identical widget retries --owner-revision (string) — exact positive owner revision returned by status
anectico dashboards widgets status <dashboard-id> <widget-id>	Read a saved-insight widget under current permissions	—
anectico dashboards widgets update <dashboard-id> <widget-id>	Update a widget	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

deliveries

Command	What it does	Command-specific flags
anectico deliveries get <delivery-id>	Show one delivery receipt and its retry state	—
anectico deliveries list	List delivery receipts for an alert, incident, channel, or status	--alert (string) — filter by alert id --channel (string) — filter by channel id --cursor (string) — opaque cursor returned by the previous page --incident (string) — filter by incident id --limit (int; default: 50) — maximum receipts (1-50) --status (string) — filter by status: pending|sending|sent|failed|retrying|suppressed|dlq

docs

Command	What it does	Command-specific flags
anectico docs	Print the full command manifest (JSON; --markdown for humans)	--api-key (string) — API key for headless auth (env: ANECTICO_API_KEY) --api-url (string) — Anectico API origin, no path (e.g. https://api.example.com); every endpoint path (/api/v1/..., /mcp, /auth/me) is appended to it (env: ANECTICO_API_URL) -h, --help (bool; default: false) — help for docs --ingest-url (string) — ingest base URL for 'anectico send' (env: ANECTICO_INGEST_URL) --json (bool) — alias for --output json; the last of --output/--json wins --markdown (bool; default: false) — render the manifest as markdown --no-color (bool; default: false) — disable colored output -o, --output (string) — output format: table|json (default: table on a TTY, json when piped); the last of --output/--json wins --profile (string) — config profile to use (env: ANECTICO_PROFILE) --project (string) — project id scope (env: ANECTICO_PROJECT)

doctor

Command	What it does	Command-specific flags
anectico doctor	Check API, auth, project, ingestion, and MCP connectivity	—
anectico doctor captures cancel <capture-id>	Stop new allocations; existing grants expire within 30 seconds	--yes (bool; default: false) — confirm this destructive operation (required)
anectico doctor captures create	Request capture (JSON: id UUID, distinct_id, environment, duration_seconds, max_spans)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico doctor captures list	List unexpired diagnostic requests	--distinct-id (string) — restrict to an exact customer identifier
anectico doctor instrumentation	Explain trace and log visibility in a bounded time window (default: last 15 minutes)	--backend-service (string; default: api) — backend service name --browser-service (string; default: web) — browser service name --end-time (string) — window end (RFC3339; defaults to now) --environment (string) — optional deployment environment --error-message (string) — exact controlled test error for a service or mobile story --event-name (string; default: checkout_started) — expected diagnostic event in the browser session --expect-replay (bool; default: true) — require a matching replay session when verifying a person --person (string) — verify this identified customer's connected story --start-time (string) — window start (RFC3339; defaults to 15 minutes before end; maximum window seven days) --story-kind (string) — service or mobile; omit for browser-to-backend verification --trace-id (string) — trace generated by your application (32 hex characters) --tracking-plan-id (string) — optional pinned declaration for a complete browser/mobile journey; adds tracking and analytics read requirements --tracking-plan-revision (string) — exact positive retained tracking revision; schema observation remains separate from person-linked journey checks

escalation

Command	What it does	Command-specific flags
anectico escalation create	Create a policy (body: name, levels[{level,delay,channels,users,schedules}], max_escalations)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico escalation delete <policy-id>	Delete a policy	--yes (bool; default: false) — confirm this destructive operation (required)
anectico escalation get <policy-id>	Show one escalation policy	—
anectico escalation list	List escalation policies	—
anectico escalation update <policy-id>	Replace a policy (full body)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

evals

Command	What it does	Command-specific flags
anectico evals annotations add run-id	Record or replace YOUR judgment of one agent run on one metric	--comment (string) — free-text rationale, in your own words --label (string) — short verdict, e.g. good or bad --metric (string) — the dimension being judged (required) --value (float64; default: 0) — numeric judgment (0.0-1.0 by convention); OMIT it rather than passing 0 when only labeling
anectico evals annotations list run-id [run-id...]	Read the human judgments recorded for one or more agent runs	--author (string) — exact author (user id) filter; a filter, not a permission --limit (int; default: 0) — maximum judgments to return (server default: 20 per run named) --metric (string) — exact metric-name filter
anectico evals budget get	Show the daily cap and what has been consumed today	—
anectico evals budget set	Set the daily cap on paid evaluations	--daily-cap (uint64; default: 0) — maximum paid evaluations per day for this org
anectico evals datasets create	Register an EMPTY dataset (body: dataset_id, display_name, description)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals datasets get dataset-id	Show one dataset with every sealed version	—
anectico evals datasets items dataset-id	List the frozen cases of one sealed dataset version	--version (uint32; default: 0) — the exact sealed version to read (required)
anectico evals datasets list	List the project's datasets	—
anectico evals datasets promote dataset-id	Seal a NEW version with the named subjects added (body: subjects[{subject_kind, subject_ref}])	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals datasets remove dataset-id	Seal a NEW version without the named cases (body: item_ids). Nothing is deleted: earlier versions keep every case they had	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --yes (bool; default: false) — confirm this destructive operation (required)
anectico evals datasets replay dataset-id item-id	Re-execute one frozen case in a sandbox that stubs every effectful tool call (body: plan{tools[{tool_name, effect}], default_effect}). Stores nothing	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --version (uint32; default: 0) — the exact sealed version holding the case (required)
anectico evals evaluate	Evaluate one subject now (body: subject_kind, subject_ref, evaluator). Spends the org's budget	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals evaluators add-version evaluator-id	Seal a NEW evaluator version (body: kind, metric_name, definition, …). A version is immutable; a changed rule is a new version	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals evaluators calibrate evaluator-id version	Measure how far one evaluator version agrees with human labels on the named subjects	--author (string) — restrict the comparison to one reviewer's labels --min-labels (uint32; default: 0) — the minimum comparable human labels this calibration declares it needs (required) --subject (stringSlice; default: []) — a subject whose human labels and judge verdicts are compared (repeatable, at most 200)
anectico evals evaluators calibrations evaluator-id	Show one evaluator's calibration history against human labels, newest first	--limit (uint32; default: 0) — maximum records to return (max 100) --version (uint32; default: 0) — show only this version's calibrations; omit for every version
anectico evals evaluators create	Register an evaluator (body: evaluator_id, display_name, description)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals evaluators get evaluator-id	Show one evaluator with every sealed version	—
anectico evals evaluators list	List the project's evaluators	—
anectico evals evaluators version evaluator-id version	Resolve one exact evaluator version, the reference a rule or gate stores	—
anectico evals experiments comparison experiment-id	Compare every challenger with the baseline, with the declared correction applied across the whole family. Stores nothing and returns the same interval every time	—
anectico evals experiments create	Declare an experiment (body: experiment_id, dataset, evaluators, candidates with exactly one baseline, correction, alpha). The correction has no default and an unset one is refused	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals experiments get experiment-id	Show one experiment and its progress	—
anectico evals experiments list	List the project's experiments	—
anectico evals experiments run experiment-id	Run one BOUNDED, resumable batch and report what remains. Spends the org's budget; call again while remaining is non-zero	--max-evaluations (uint32; default: 0) — upper bound on evaluations this call performs; unset lets the server choose
anectico evals experiments trials experiment-id	Record which subject realizes each case under each candidate (body: trials[])	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals gates create	Declare a gate (body: release, evidence_kind, experiment or canary, objectives with exact evaluator versions, confidence_level, analysis_seed). A gate is fixed at creation; a changed objective is a new gate	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico evals gates evaluate gate-id	Reach one permanent verdict. Omit the key for one stable default decision; use a new explicit key to evaluate newly arrived evidence	--idempotency-key (string) — optional decision-intent key; use a new value for fresh evidence
anectico evals gates get gate-id	Show one gate, its objectives, and its full decision history newest first	—
anectico evals gates list	List the project's gates with their latest verdict	--release (string) — narrow to the gates declared about one release label
anectico evals release-series	Show one exact evaluator metric by observed agent release	--end (string) — inclusive upper bound on the subject's time, RFC3339 --evaluator (string) — exact evaluator id (required) --evaluator-version (uint32; default: 0) — exact positive evaluator version (required) --metric (string) — exact metric name (required) --start (string) — inclusive lower bound on the subject's time, RFC3339
anectico evals results	List stored evaluation results	--end (string) — exclusive upper bound on the subject's time, RFC3339 --evaluator (string) — exact evaluator id filter --limit (int; default: 0) — maximum results to return (server default 100, maximum 500) --metric (string) — exact metric name filter --mode (string) — production, experiment or simulation; unset returns every mode --start (string) — inclusive lower bound on the subject's time, RFC3339 --subject (string) — exact subject reference filter
anectico evals rules delete rule-id	Delete a sampling rule; production traffic stops being evaluated by it	--yes (bool; default: false) — confirm this destructive operation (required)
anectico evals rules list	List the project's sampling rules	—
anectico evals rules set	Create or replace a sampling rule (body: rule_id, evaluator, sample_rate, filters, …)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

events

Command	What it does	Command-specific flags
anectico events names	List captured analytics event names	--cursor (string) — opaque next_cursor from the previous page --limit (int; default: 0) — page size from 1 to 50 (default 50) --prefix (string) — restrict names to this prefix --property-key (string) — event property key (requires --property-value) --property-value (string) — exact event property value (requires --property-key)
anectico events triggerers <event>	List people who triggered an event in an exact time window	--cursor (string) — opaque next_cursor from the previous page --limit (int; default: 0) — page size from 1 to 1000 (default 50) --property-key (string) — event property key (requires --property-value) --property-value (string) — exact event property value (requires --property-key) --since (string) — required exact RFC3339 start timestamp --until (string) — required exact RFC3339 end timestamp

export

Command	What it does	Command-specific flags
anectico export create	Create an export job (body: type EXPORT_TYPE_CSV|JSON|PARQUET + query)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — stable 1-128 character ASCII key using letters, digits, . _ : or -
anectico export jobs cancel <job-id>	Cancel an export job	--yes (bool; default: false) — confirm this destructive operation (required)
anectico export jobs download <job-id>	Safely download a finished export to a new local file	--file (string) — new destination path (existing files and symlinks are never overwritten)
anectico export jobs download-url <job-id>	Get the API download URL for a finished job	—
anectico export jobs get <job-id>	Show one export job	—
anectico export jobs list	List export jobs	--cursor (string) — signed next cursor from the previous page --limit (int; default: 0) — page size from 1 to 100 --status (string) — filter by status enum name --type (string) — filter by type enum name
anectico export jobs retry <job-id>	Retry a failed export job	—
anectico export jobs watch <job-id>	Watch one export job until it reaches a terminal state	--interval (duration; default: 2s) — successful poll interval (100ms to 1m) --max-polls (int; default: 1000) — maximum API polls (1 to 100000) --max-transient-errors (int; default: 8) — consecutive HTTP 429/503 errors to retry (0 to 100) --timeout (duration; default: 30m0s) — maximum total watch duration (1s to 24h)
anectico export logs	Export logs (body: format, service_name?, level?, start_time?, end_time?, columns?)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — stable 1-128 character ASCII key using letters, digits, . _ : or -

flags

Command	What it does	Command-specific flags
anectico flags create	Create a flag (body: key, name?, active?, variants?, filters?; project_id injected)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico flags decide <distinct-id>	Evaluate feature flags remotely for one exact identity	--groups (string) — group type to key mappings as a JSON object --person-properties (string) — person properties as a JSON object
anectico flags delete <flag-key>	Delete a flag	--yes (bool; default: false) — confirm this destructive operation (required)
anectico flags get <flag-key>	Show one flag's full definition	—
anectico flags list	List the project's feature flags	—
anectico flags snapshot	Download the project's local-evaluation snapshot	—
anectico flags toggle <flag-key> <on|off>	Turn a feature flag on or off	—
anectico flags update <flag-key>	Update a flag (partial body; project_id injected)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

fleet

Command	What it does	Command-specific flags
anectico fleet list	List agents with 24-hour run health, review signals, and containment	--cursor (string) — opaque next_cursor from the previous page --limit (int; default: 0) — maximum agents (server cap 200)

friction

Command	What it does	Command-specific flags
anectico friction list	Read bounded click observations; pass explicit time windows in --body	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

incidents

Command	What it does	Command-specific flags
anectico incidents acknowledge <incident-id>	Acknowledge an incident Aliases: ack.	--expected-version (uint64; default: 0) — incident version returned by incidents view (required) --idempotency-key (string) — stable retry key for this exact transition (required)
anectico incidents comment <incident-id> <text>	Add a comment to the incident timeline	--expected-version (uint64; default: 0) — incident version returned by incidents view (required) --idempotency-key (string) — stable retry key for this exact comment (required)
anectico incidents create <title>	Declare an incident	--description (string) — incident description --link-ref (string) — primary signal reference id --link-type (string) — primary signal type: alert|error_group|anomaly --severity (int; default: 0) — severity 1 (SEV1) to 4 (SEV4)
anectico incidents delete <incident-id>	Delete an incident	--yes (bool; default: false) — confirm this destructive operation (required)
anectico incidents link <incident-id>	Link a signal (alert / error_group / anomaly) to an incident	--ref (string) — signal reference id (required) --type (string) — alert|error_group|anomaly (required)
anectico incidents list	List incidents	--status (string) — filter by status: open|acknowledged|resolved
anectico incidents reopen <incident-id>	Reopen a resolved incident	--expected-version (uint64; default: 0) — incident version returned by incidents view (required) --idempotency-key (string) — stable retry key for this exact transition (required)
anectico incidents resolve <incident-id>	Resolve an incident	--expected-version (uint64; default: 0) — incident version returned by incidents view (required) --idempotency-key (string) — stable retry key for this exact transition (required)
anectico incidents unlink <incident-id> <link-id>	Remove a linked signal	--yes (bool; default: false) — confirm this destructive operation (required)
anectico incidents update <incident-id>	Edit an incident (body: title, description, severity)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico incidents view <incident-id>	Show an incident's case file (links + timeline)	—
anectico incidents watch <incident-id>	Stream an incident timeline with verified resume and bounded reconnects	--cursor (string) — opaque cursor from a prior incident watch record --include-existing (bool; default: false) — emit existing timeline history before following new events --interval (duration; default: 2s) — successful poll interval (100ms to 1m) --max-events (int; default: 0) — stop after this many timeline events (0 keeps watching until another bound) --max-polls (int; default: 100000) — maximum API attempts (1 to 100000) --max-transient-errors (int; default: 100) — consecutive transient failures to retry (0 to 100) --timeout (duration; default: 1h0m0s) — maximum observation window (1s to 24h)

investigate

Command	What it does	Command-specific flags
anectico investigate cancel <investigation-id>	Stop a running investigation	--yes (bool; default: false) — confirm this destructive operation (required)
anectico investigate continue <investigation-id> <question>	Ask a follow-up in an existing investigation's context	—
anectico investigate get <investigation-id>	Show one investigation with its full turn history	—
anectico investigate list	List investigations for an anchor, or the org's most recent	--anchor-kind (string) — what the investigation is about: issue|person|account|llm_spend|project|agent_run|incident|audience (optional — omit to list the org's most recent) --anchor-ref (string) — the anchor's identifier — issue=GROUP_ID · person=PERSON_ID or DISTINCT_ID · account=GROUP_TYPE:GROUP_KEY · llm_spend=PERSON_ID (optional, empty is org-wide) · project=PROJECT_ID[:ENVIRONMENT[:LOOKBACK_SECONDS]] · agent_run=RUN_ID · incident=INCIDENT_ID · audience=COHORT_ID (also --audience-generation, --since, --until) --audience-generation (string) — Audience only: exact positive generation as a decimal string --limit (int; default: 0) — maximum investigations to return (0 takes the server default) --since (string) — Audience only: explicit inclusive evidence start (RFC3339, millisecond precision) --until (string) — Audience only: explicit inclusive evidence end (RFC3339, at most 90 days after since)
anectico investigate start [question]	Start an investigation on an anchor and stream its conclusion	--anchor-kind (string) — what the investigation is about: issue|person|account|llm_spend|project|agent_run|incident|audience (required) --anchor-ref (string) — the anchor's identifier — issue=GROUP_ID · person=PERSON_ID or DISTINCT_ID · account=GROUP_TYPE:GROUP_KEY · llm_spend=PERSON_ID (optional, empty is org-wide) · project=PROJECT_ID[:ENVIRONMENT[:LOOKBACK_SECONDS]] · agent_run=RUN_ID · incident=INCIDENT_ID · audience=COHORT_ID (also --audience-generation, --since, --until) --audience-generation (string) — Audience only: exact positive generation as a decimal string --since (string) — Audience only: explicit inclusive evidence start (RFC3339, millisecond precision) --until (string) — Audience only: explicit inclusive evidence end (RFC3339, at most 90 days after since)
anectico investigate watch <investigation-id>	Follow an investigation's durable event journal, resumably	--cursor (string) — opaque cursor from a prior watch record or from get's last_event_cursor; echoed verbatim --max-events (int; default: 0) — stop after this many journal events (0 keeps following until another bound) --max-reconnects (int; default: 100) — consecutive reconnects to attempt after a transient failure (0 to 100) --reconnect-delay (duration; default: 1s) — base reconnect backoff, doubled per consecutive failure (100ms to 1m) --state-file (string) — file to keep the last accepted cursor in, so an identical re-run resumes without bookkeeping --timeout (duration; default: 1h0m0s) — maximum observation window (1s to 24h)

invitations

Command	What it does	Command-specific flags
anectico invitations create <email>	Invite someone to the org	--role (string) — role to grant (e.g. ROLE_MEMBER)
anectico invitations list	List invitations	--status (string) — filter by status enum name
anectico invitations revoke <invitation-id>	Revoke a pending invitation	--yes (bool; default: false) — confirm this destructive operation (required)

issues

Command	What it does	Command-specific flags
anectico issues affected <issue-id>	The people and accounts an issue hit (blast radius)	--cursor (string) — opaque pagination cursor from response.pagination.next_cursor --limit (int; default: 0) — maximum rows
anectico issues assign <issue-id> [user-id]	Assign an issue to a member (or --unassign)	--expected-version (uint64; default: 0) — issue version returned by issues view (required) --unassign (bool; default: false) — clear the assignee
anectico issues compare-customers	Compare JSON group_id, success_event, start_time, end_time and optional dimensions/environment	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico issues ignore <issue-id>	Ignore an issue	--expected-version (uint64; default: 0) — issue version returned by issues view (required)
anectico issues list	List issues	--cursor (string) — opaque cursor returned by the previous page --env (string) — filter by deployment environment --limit (int; default: 30) — maximum rows -q, --query (string) — full-text search over error message, service, and class --service (string) — filter by service name --since (string) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --status (string) — filter by status: new|ongoing|resolved|ignored|snoozed --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico issues merge <canonical-issue-id>	Merge duplicate issues into a canonical one	--source (stringSlice; default: []) — issue id to merge in (repeatable)
anectico issues merged-sources <canonical-issue-id>	The issues merged into a canonical one	—
anectico issues occurrences <issue-id>	An issue's occurrence time series	--interval (string) — bucket size --since (string; default: 24h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico issues recovery	Observe customer outcomes for explicit issue group IDs and time windows	--account-key (string) — activity account key; requires account-type --account-type (string) — activity account type; requires account-key --after (string) — end of baseline and start of outcome observation (RFC3339) --baseline-start (string) — start of affected-customer baseline (RFC3339) --environment (string) — exact deployment environment (empty includes all) --group-ids (stringSlice; default: []) — issue group IDs, including any merged source IDs --match-operation (bool; default: false) — require matching logical operation and account context --success-event (string) — event that explicitly marks this workflow as successful --until (string) — end of outcome observation (RFC3339, no later than now)
anectico issues releases <issue-id>	An issue's per-release context and breakdown	—
anectico issues reopen <issue-id>	Reopen an issue	--expected-version (uint64; default: 0) — issue version returned by issues view (required)
anectico issues resolve <issue-id>	Mark an issue resolved	--expected-version (uint64; default: 0) — issue version returned by issues view (required) --in-next-release (bool; default: false) — resolve in the next release (regression re-opens it)
anectico issues search	Search raw error events (occurrences, not groups)	--level (string) — filter by level --limit (int; default: 0) — maximum rows -q, --query (string) — full-text query --service (string) — filter by service name --since (string; default: 24h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico issues snooze <issue-id>	Snooze (archive-until) an issue	--escalating (bool; default: false) — wake when the issue escalates (spike) --expected-version (uint64; default: 0) — issue version returned by issues view (required) --for (string) — snooze for a duration (30m, 6h, 7d) --forever (bool; default: false) — snooze forever --occurrences (int; default: 0) — wake after N more events --users (int; default: 0) — wake after N more affected users
anectico issues unmerge <source-issue-id>	Restore a previously merged issue	—
anectico issues view <issue-id>	Show one issue's detail	—
anectico issues watches create	Save a watch (JSON: id UUID, title, criteria with a future observation_end)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico issues watches delete <watch-id>	Delete a saved recovery watch	--yes (bool; default: false) — confirm this destructive operation (required)
anectico issues watches get <watch-id>	Read the current evidence for a saved baseline	—
anectico issues watches list	List saved recovery watches	--group-id (string) — restrict to one issue group

llm

Command	What it does	Command-specific flags
anectico llm pricing delete <model>	Remove a model's pricing override	--yes (bool; default: false) — confirm this destructive operation (required)
anectico llm pricing list	List pricing overrides	—
anectico llm pricing set <model>	Set a model's pricing (body: input_cost_per_token, output_cost_per_token, …)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico llm series	Bucketed LLM cost time series	--interval (string; default: 1h) — bucket size (1h, 6h, 1d) --since (string; default: 7d) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico llm summary	Org LLM cost summary (by model, by agent)	--since (string; default: 7d) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico llm top-persons	The people your LLM spend goes to	--limit (int; default: 0) — maximum rows --since (string; default: 7d) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)

login

Command	What it does	Command-specific flags
anectico login	Log in via your browser (device flow)	--no-browser (bool; default: false) — print the verification URL instead of opening a browser

logout

Command	What it does	Command-specific flags
anectico logout	Log out (clear the stored session for the profile)	—

logs

Command	What it does	Command-specific flags
anectico logs aggregate	Count logs grouped by a dimension	--group-by (string) — dimension to group by (required) --since (string) — time window (30m, 6h, 7d)
anectico logs context	Logs surrounding an exact anchor log	--after (int; default: 0) — records after the anchor --before (int; default: 0) — records before the anchor --log-id (string) — canonical 32-character uppercase log id (required)
anectico logs delete <canonical-log-id>	Delete one exact canonical log	--yes (bool; default: false) — confirm this destructive operation (required)
anectico logs fields	Filterable log fields and their values	--since (string; default: 24h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico logs patterns	Detected log pattern clusters	--level (string) — filter by severity --limit (int; default: 0) — maximum clusters --min-count (int; default: 0) — minimum cluster size --service (string) — filter by service name --since (string; default: 24h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico logs query	Search logs	--cursor (string) — opaque pagination cursor from pagination.next_cursor --distinct-id (string) — filter to one person's distinct_id --env (string) — filter by deployment environment --level (string) — filter by level (error, warn, info, …) --limit (int; default: 50) — maximum rows -q, --query (string) — full-text query --service (string) — filter by service name --since (string; default: 1h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --sort (string; default: timestamp_desc) — sort order: timestamp_desc|timestamp_asc --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico logs tail	Live-tail logs (SSE); Ctrl-C to stop	--distinct-id (string) — filter to one person's distinct_id --env (string) — filter by deployment environment --level (string) — filter by level (error, warn, info, …) -q, --query (string) — full-text query --service (string) — filter by service name

mcp

Command	What it does	Command-specific flags
anectico mcp endpoint	Print the MCP Streamable HTTP endpoint without credentials	—
anectico mcp verify	Verify the MCP server end to end without invoking a tool	—

members

Command	What it does	Command-specific flags
anectico members list	List org members	—
anectico members remove <user-id>	Remove a member from the org	--yes (bool; default: false) — confirm this destructive operation (required)
anectico members set-role <user-id> <role>	Change a member's role (e.g. ROLE_ADMIN, ROLE_MEMBER)	—

metrics

Command	What it does	Command-specific flags
anectico metrics delete <metric-name>	Delete a metric's datapoints	--yes (bool; default: false) — confirm this destructive operation (required)
anectico metrics forecast <metric-name>	Forecast a metric (expected band + horizon)	--env (string) — deployment environment scope --horizon (string) — forecast horizon --interval (string) — bucket size --service (string) — filter by service name
anectico metrics labels <metric-name>	A metric's labels and their values	--since (string; default: 24h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico metrics list	List the available metric names	—
anectico metrics query <metric-name>	Run a bucketed aggregation over a metric	--agg (string; default: avg) — aggregation: avg|sum|min|max|count|p50|p95|p99 --env (string) — filter by deployment environment --group-by (stringSlice; default: []) — group by dimensions: service_name, environment, instance, job --interval (string; default: 5m) — bucket size: 1m,5m,15m,30m,1h,6h,12h,1d --since (string; default: 1h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)

Current limitation: anectico metrics query accepts --since, --until, and --interval, but the CLI adapter does not yet forward those three values. It uses the service-default window and bucket. Use the Metrics REST API when explicit query bounds are required.

oncall

Command	What it does	Command-specific flags
anectico oncall contact-methods add	Add a contact method	--label (string) — display label --type (string) — email|slack_dm|sms|phone (required) --value (string) — the address / number / handle (required)
anectico oncall contact-methods delete <method-id>	Delete a contact method	--yes (bool; default: false) — confirm this destructive operation (required)
anectico oncall contact-methods list	List your contact methods	—
anectico oncall now <schedule-id>	Who is on call right now (or --at a time)	--at (string) — evaluate at this RFC3339 time (default now)
anectico oncall overrides create <schedule-id>	Create an override	--end (string) — override end, RFC3339 (required) --start (string) — override start, RFC3339 (required) --user (string) — user id taking the shift (required)
anectico oncall overrides delete <override-id>	Delete an override	--yes (bool; default: false) — confirm this destructive operation (required)
anectico oncall overrides list <schedule-id>	List a schedule's overrides	—
anectico oncall schedules create	Create a schedule (body: name, layers[{name,users,rotation_length,start_at,…}])	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico oncall schedules delete <schedule-id>	Delete a schedule	--yes (bool; default: false) — confirm this destructive operation (required)
anectico oncall schedules get <schedule-id>	Show one schedule	—
anectico oncall schedules list	List schedules	—
anectico oncall schedules update <schedule-id>	Replace a schedule (full body)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

persons

Command	What it does	Command-specific flags
anectico persons correct-identity <distinct-id>	Preview alias separation and history; apply only with the reviewed revision	--apply (bool; default: false) — apply the reviewed separation (default previews only) --reason (string; default: incorrect_identify) — incorrect_identify, shared_device, or recycled_id --revision (string) — revision returned by the preview
anectico persons get <person-id-or-distinct-id>	Show one person's profile and cross-signal stats	—
anectico persons search [query]	Search persons by email / name / distinct_id	--limit (int; default: 25) — maximum rows
anectico persons stats <person-id-or-distinct-id>	A person's cross-signal counters	—
anectico persons timeline <person-id-or-distinct-id>	Show a person's cross-signal timeline (newest first)	--before (string) — paginate: entries before this opaque cursor; keep the same time window --limit (int; default: 50) — maximum entries --since (string) — explicit RFC3339 window start; requires --until --until (string) — explicit RFC3339 window end; requires --since

problem-reports

Command	What it does	Command-specific flags
anectico problem-reports delete <report-id>	Delete report text; replay has separate deletion controls	--yes (bool; default: false) — confirm this destructive operation (required)
anectico problem-reports get <report-id>	Read one report and its correlation context	—
anectico problem-reports list	List reports from the last seven days	--cursor (string) — next_cursor from the prior page --distinct-id (string) — exact reported identity --group-id (string) — filter by reported issue
anectico problem-reports submit	Submit JSON with stable UUID id, description and distinct_id; reuse on retry	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

projects

Command	What it does	Command-specific flags
anectico projects create <name>	Create a project	--description (string) — project description --slug (string) — immutable project slug (required)
anectico projects current	Show the effective project scope	—
anectico projects delete <project-id>	Delete a project and its scoping	--yes (bool; default: false) — confirm this destructive operation (required)
anectico projects list	List the org's projects	—
anectico projects update <project-id>	Rename a project / edit its description	--description (string) — new description (empty string clears it) --name (string) — new display name
anectico projects use <project-id-or-slug>	Set the profile's default project scope	—

receipt-chains

Command	What it does	Command-specific flags
anectico receipt-chains verify [chain-id]	Verify one action receipt chain's digests, links and sequence	—

releases

Command	What it does	Command-specific flags
anectico releases create <release>	Register a release/deploy (full replace: omitted fields are cleared)	--author (string) — deploy author; omitted clears it --commit (string) — commit SHA; omitted clears it --deploy-at (string) — deploy time, RFC3339; omitted clears it and the release orders by first-seen --ref (string) — branch or tag; omitted clears it --url (string) — link to the release/CI run; omitted clears it
anectico releases get <release>	Show one release's detail (new/regressed issues, blast radius)	—
anectico releases impact	Compare release customer impact with explicit before/after windows in --body	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico releases list	List releases with error/regression counts	—

replay

Command	What it does	Command-specific flags
anectico replay delete <session-id>	Delete a recording	--yes (bool; default: false) — confirm this destructive operation (required)
anectico replay for-trace <trace-id>	Find the session recording covering a trace	—
anectico replay get <session-id>	Show one recording's metadata	—
anectico replay highlights <session-id>	Read recorded replay moments with timestamps and evidence references	—
anectico replay list	List recordings	—
anectico replay related <session-id>	Errors and events that happened during the session	—
anectico replay snapshots <session-id>	Dump the recording's rrweb events (decoded JSON)	--problem-report-id (string) — Return only this report screenshot; has_gaps marks an incomplete bounded search

saved-searches

Command	What it does	Command-specific flags
anectico saved-searches create	Create a saved search (body: name, signal, query, is_shared)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --idempotency-key (string) — stable retry key for this exact create (required)
anectico saved-searches delete <search-id>	Delete a saved search with compare-and-swap	--expected-version (uint64; default: 0) — current saved-search version returned by list/get (required) --yes (bool; default: false) — confirm this destructive operation (required)
anectico saved-searches duplicate <search-id>	Duplicate a visible saved search into a private copy	--expected-version (uint64; default: 0) — current source version returned by list/get (required) --idempotency-key (string) — stable retry key for this exact duplicate (required) --name (string) — optional name for the duplicate
anectico saved-searches get <search-id>	Get a saved search and its version	—
anectico saved-searches list	List visible saved searches	--cursor (string) — opaque next_cursor returned by the previous page --limit (int; default: 0) — page size from 1 to 100 (default 50) --signal (string) — signal page: logs|errors|traces|metrics (required)
anectico saved-searches update <search-id>	Update a saved search with compare-and-swap	--body (string) — request body as inline JSON --expected-version (uint64; default: 0) — current saved-search version returned by list/get (required) --file (string) — request body from a JSON file ("-" for stdin)

search

Command	What it does	Command-specific flags
anectico search correlate <trace-id>	Everything correlated with a trace (logs, errors, metrics)	--include (stringSlice; default: []) — signals to include: logs,errors,metrics (default all)
anectico search filters <field>	Distinct values of a filterable field	—
anectico search unified <query>	Search traces, logs, and metrics with one query	--limit (int; default: 0) — maximum hits per signal --service (string) — filter by service name --since (string) — time window (30m, 6h, 7d) --types (stringSlice; default: []) — signal types: traces,logs,metrics (default all)

segments

Command	What it does	Command-specific flags
anectico segments create	Create a segment (body: name, group_type, filters[{field,op,value}])	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)
anectico segments delete <segment-id>	Delete a segment	--yes (bool; default: false) — confirm this destructive operation (required)
anectico segments list	List account segments	—
anectico segments preview <segment-id>	Preview the accounts a segment currently matches	—
anectico segments update <segment-id>	Update a segment	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

send

Command	What it does	Command-specific flags
anectico send event <event-name>	Send one product event (capture)	--distinct-id (string) — the person's distinct_id (required) --properties (string) — event properties as a JSON object --session-id (string) — optional session id

services

Command	What it does	Command-specific flags
anectico services list	Per-service RED snapshot (error_rate is a 0..1 fraction)	--env (string) — deployment environment scope --since (string; default: 1h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico services red <service-name>	One service's RED time series	--env (string) — deployment environment scope --interval (string) — bucket size (1m, 5m, 1h) --since (string; default: 1h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)

settings

Command	What it does	Command-specific flags
anectico settings config delete <config-row-id>	Delete a configuration entry by its row id (see list)	--yes (bool; default: false) — confirm this destructive operation (required)
anectico settings config get <key>	Show one configuration entry	--org (bool; default: false) — read org-level configuration instead of the active project
anectico settings config list	List configuration entries	--org (bool; default: false) — list org-level configuration instead of the active project --type (string) — filter by config type
anectico settings config set <key>	Set a configuration entry (body: config_value, config_type?; config_type is retention, sampling, alert, dashboard, general, notification, or integration; empty defaults to general)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin) --org (bool; default: false) — write org-level configuration instead of the active project
anectico settings github get	Show the GitHub config	—
anectico settings github set	Set the GitHub config	--enabled (bool; default: true) — enable suspect-commit blame --repo (string) — repository "owner/name" (required) --repo-root (string) — monorepo subpath the service lives under

skill

Command	What it does	Command-specific flags
anectico skill install <claude|codex|cursor|gemini>	Write the skill where the agent discovers it	--global (bool; default: false) — codex: install into ~/.codex/AGENTS.md instead of ./AGENTS.md --project (bool; default: false) — claude: install into ./.claude/skills (this repo) instead of ~/.claude/skills
anectico skill show	Print the canonical skill markdown	—

slo

Command	What it does	Command-specific flags
anectico slo burn <rule-id>	Show an SLO rule's error-budget burn rate	--compliance-window (string) — the objective's period, as a relative range such as 30d. Defaults to the rule's own --factor (float64; default: 0) — burn multiple both windows must exceed to fire. Defaults to the rule's own --target (float64; default: 0) — objective ratio between 0 and 1, such as 0.99 for a 99 percent objective. Defaults to the rule's own --window (stringSlice; default: []) — window to report, as a relative range such as 6h or 30m; repeatable. Defaults to the rule's own long and short windows

symbols

Command	What it does	Command-specific flags
anectico symbols upload-dsym <App.dSYM or DWARF path>	Upload an iOS dSYM bundle or DWARF binary	—
anectico symbols upload-proguard <mapping.txt>	Upload an Android ProGuard/R8 mapping	--dist (string) — optional distribution qualifier --release (string) — release the mapping belongs to (required)
anectico symbols upload-sourcemap	Upload one JS source map (body: release, dist, filename, content)	--body (string) — request body as inline JSON --file (string) — request body from a JSON file ("-" for stdin)

tickets

Command	What it does	Command-specific flags
anectico tickets create <issue-id>	Create a provider ticket from an issue	--idempotency-key (string) — stable key required for safe retries of this exact create --issue-url (string) — trusted absolute Anectico issue URL (required) --provider (string) — jira|linear|github (required) --repo (string) — GitHub repository "owner/name" (GitHub only) --title (string) — ticket title (defaults to the Anectico issue id)
anectico tickets get <ticket-id>	Show one ticket link and its current synchronization state	—
anectico tickets list <issue-id>	List an issue's linked tickets	—
anectico tickets unlink <ticket-id>	Unlink a ticket (the provider ticket itself is kept)	--yes (bool; default: false) — confirm this destructive operation (required)

traces

Command	What it does	Command-specific flags
anectico traces critical-path <trace-id>	The trace's latency-critical span path	—
anectico traces delete <trace-id>	Delete a trace's spans	--yes (bool; default: false) — confirm this destructive operation (required)
anectico traces get <trace-id>	Show a trace's spans	—
anectico traces search	Search traces	--cursor (string) — opaque pagination cursor from pagination.next_cursor --distinct-id (string) — only traces touching this person --env (string) — filter by deployment environment --limit (int; default: 30) — maximum rows --operation (string) — filter by operation name --service (string) — filter by service name --since (string; default: 1h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --sort-by (string; default: start_time) — sort field: start_time|duration|span_count|service_count|error_count --sort-order (string; default: desc) — sort order: asc|desc --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico traces service-map	Service dependency topology built from traces	--since (string; default: 1h) — window start: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp --until (string) — window end: positive duration (30m, 6h, 7d) or exact RFC3339 timestamp (default current/open upper bound)
anectico traces stats <trace-id>	Aggregate statistics for one trace	—

usage

Command	What it does	Command-specific flags
anectico usage	Show the org's usage meters (events, metric series, replay sessions)	--period (string) — billing period YYYY-MM (default: current month)

version

Command	What it does	Command-specific flags
anectico version	Print the installed CLI version	—

whoami

Command	What it does	Command-specific flags
anectico whoami	Show the authenticated identity	—

Discover one command interactively

Append --help at any level to see the same information in the terminal:

anectico issues --help
anectico incidents create --help

• Use the Anectico CLI
• Choose safe permissions
• REST API reference