Commands

ferris-ctl has seven top-level commands. All of them accept the global flags, and all of them resolve where to connect, who you are, and which realm to act on before sending anything. Authentication explains how.

Connect and authenticate

context

Named connection profiles storing a server URL, a client, and a default realm. Switch environments without retyping flags.

logout

Drop the stored session by deleting the credentials file.

Administer a realm

realm

Create, inspect, and delete realms, manage their roles, and import one from an external source.

client

Create, inspect, and delete OAuth2 clients within a realm.

user

Create, inspect, and delete users, set their passwords, and assign roles.

Import

source

Store reusable import sources, so credentials and URLs are not repeated on every import.

Importing realms

The import guide: from a description file, a live Keycloak, or a live Zitadel instance.

At a glance

Command	Purpose
`context`	Manage connection contexts
`realm`	Manage realms, their roles, and realm imports
`client`	Manage OAuth2 clients
`user`	Manage users, their passwords, and their role assignments
`source`	Manage reusable import sources
`login`	Sign in via the OAuth 2.0 Device Authorization Grant
`logout`	Remove the stored login session

Each command carries its own help, down to the subcommand:

ferris-ctl <command> --help
ferris-ctl <command> <subcommand> --help