Skip to content
DebesisDebesis Docs

Command reference

Generated from debesis-ccp 0.4.0 — the same artifact this site offers for download. Nothing here is transcribed by hand, so it cannot drift from the release.

Every command that reaches the API accepts --json for machine-readable output (the default is a plain table) and the TLS flags --ca-bundle / --insecure. Commands that touch encrypted values also accept --kek. Errors go to stderr.

usage: debesis-ccp [-h] COMMAND ...

Non-interactive CCP CLI for CI/CD pipelines. Auth: CCP_API_TOKEN (bearer
token) + CCP_API_URL (base URL).

positional arguments:
  COMMAND
    version         print CLI version
    whoami          show the token's org/project/scopes/expiry
    projects        list projects (defaults to the token's org)
    environments    list environments of a project
    registry-quota  show registry storage cap/usage (pre-push gate for CI)
    services        list services
                    (compute/sql/cache/messaging/search/document) in an
                    environment
    redeploy        redeploy compute: copy latest revision + apply only your
                    deltas
    cache           manage cache instances
    messaging       manage messaging instances
    search          manage search instances
    sql             manage sql instances
    document        manage document instances
    compute         manage compute instances
    secret          manage environment-scoped secrets
    api             call any CCP API endpoint directly (escape hatch)

options:
  -h, --help        show this help message and exit

Exit codes

Section titled “Exit codes”
Code Meaning
0 Success.
1 API or transport error — a 5xx, an unreachable server, a malformed flow.
2 Usage or configuration error — bad arguments, missing or malformed CCP_API_*.
3 Authentication failed — token unknown, revoked, or expired (HTTP 401).
4 Permission denied — insufficient scope, or wrong organisation (HTTP 403).

3 and 4 are separate on purpose, and the distinction is worth wiring into your alerting: a 3 means somebody must rotate a dead token, while a 4 usually means the token was issued with scopes too narrow for a pipeline step somebody added later.

Commands

Section titled “Commands”

version

usage: debesis-ccp version [-h] [--json]

options:
  -h, --help  show this help message and exit
  --json      machine-readable JSON output (default: table)

whoami

usage: debesis-ccp whoami [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)

projects

usage: debesis-ccp projects [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]
                            [--org ORG]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --org ORG             organization id (default: token's org)

environments

usage: debesis-ccp environments [-h] [--json] [--ca-bundle CA_BUNDLE]
                                [--insecure] --project PROJECT

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --project PROJECT     project id

registry-quota

usage: debesis-ccp registry-quota [-h] [--json] [--ca-bundle CA_BUNDLE]
                                  [--insecure] [--org ORG] [--project PROJECT]
                                  [--fail-if-blocked]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --org ORG             organization id (default: token's org)
  --project PROJECT     also report the project tier (the organization tier is
                        always checked, since either can block a push)
  --fail-if-blocked     exit non-zero when pushes are blocked, to gate a CI
                        build step

services

usage: debesis-ccp services [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]
                            --env ENV
                            [--type {compute,sql,cache,messaging,search,document}]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
  --type {compute,sql,cache,messaging,search,document}
                        restrict to one service type (default: all)

redeploy

usage: debesis-ccp redeploy [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]
                            [--kek KEK] [--kek-stdin] --service SERVICE
                            [--image-tag IMAGE_TAG] [--env KEY=VALUE]
                            [--unset-env KEY] [--secret NAME=SECRET_ID]
                            [--unset-secret NAME] [--sku SKU] [--cpu CPU]
                            [--memory MEMORY] [--min-replicas MIN_REPLICAS]
                            [--max-replicas MAX_REPLICAS]
                            [--liveness-path LIVENESS_PATH]
                            [--readiness-path READINESS_PATH]
                            [--probe-protocol PROBE_PROTOCOL]
                            [--description DESCRIPTION]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --service SERVICE     compute service id
  --image-tag IMAGE_TAG
                        override the container image tag (e.g.
                        registry/app:build-42)
  --env KEY=VALUE       set/override an env var (repeatable)
  --unset-env KEY       remove an env var (repeatable)
  --secret NAME=SECRET_ID
                        set/override a secret reference (repeatable)
  --unset-secret NAME   remove a secret reference (repeatable)
  --sku SKU             override product SKU id
  --cpu CPU             override requested CPU (millicores)
  --memory MEMORY       override requested memory (MB)
  --min-replicas MIN_REPLICAS
                        override min replicas
  --max-replicas MAX_REPLICAS
                        override max replicas
  --liveness-path LIVENESS_PATH
                        override liveness probe path
  --readiness-path READINESS_PATH
                        override readiness probe path
  --probe-protocol PROBE_PROTOCOL
                        override probe protocol (e.g. HTTP/TCP)
  --description DESCRIPTION
                        override the description

cache

usage: debesis-ccp cache [-h] VERB ...

positional arguments:
  VERB
    create     create a cache instance from a workload template
    redeploy   redeploy a cache instance: copy its latest revision + apply
               only your deltas
    list       list cache instances in an environment
    get        show one cache instance
    delete     delete a cache instance
    templates  list available cache workload templates

options:
  -h, --help   show this help message and exit
cache create
usage: debesis-ccp cache create [-h] [--json] [--ca-bundle CA_BUNDLE]
                                [--insecure] [--kek KEK] [--kek-stdin]
                                --env ENV --name NAME --template TEMPLATE
                                [--sku SKU] [--cpu CPU] [--memory MEMORY]
                                [--disk DISK] [--description DESCRIPTION]
                                [--password PASSWORD]
                                [--maxmemory-policy MAXMEMORY_POLICY]
                                [--service-id SERVICE_ID]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --name NAME           instance name
  --template TEMPLATE   workload template id
  --sku SKU             product SKU id (sets resources)
  --cpu CPU             requested CPU (millicores)
  --memory MEMORY       requested memory (MB)
  --disk DISK           requested disk (MB)
  --description DESCRIPTION
                        free-text description
  --password PASSWORD   auth password (auto-generated if omitted; 8-128 chars,
                        must not contain " \ , [ ] = whitespace or control
                        characters)
  --maxmemory-policy MAXMEMORY_POLICY
                        Redis maxmemory-policy (default allkeys-lru)
  --service-id SERVICE_ID
                        redeploy an EXISTING instance in place instead of
                        creating one
cache redeploy
usage: debesis-ccp cache redeploy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                  [--insecure] [--kek KEK] [--kek-stdin]
                                  --service SERVICE [--template TEMPLATE]
                                  [--sku SKU] [--cpu CPU] [--memory MEMORY]
                                  [--disk DISK] [--description DESCRIPTION]
                                  [--maxmemory-policy MAXMEMORY_POLICY]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --service SERVICE     cache instance id
  --template TEMPLATE   override workload template id
  --sku SKU             override product SKU id
  --cpu CPU             override requested CPU (millicores)
  --memory MEMORY       override requested memory (MB)
  --disk DISK           override requested disk (MB)
  --description DESCRIPTION
                        override free-text description
  --maxmemory-policy MAXMEMORY_POLICY
                        override Redis maxmemory-policy
cache list
usage: debesis-ccp cache list [-h] [--json] [--ca-bundle CA_BUNDLE]
                              [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
cache get
usage: debesis-ccp cache get [-h] [--json] [--ca-bundle CA_BUNDLE]
                             [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
cache delete
usage: debesis-ccp cache delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                                [--insecure] --id ID [--purge]
                                [--retention-days RETENTION_DAYS]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
  --purge               delete the data too
  --retention-days RETENTION_DAYS
                        days to retain data, where the product retains it
cache templates
usage: debesis-ccp cache templates [-h] [--json] [--ca-bundle CA_BUNDLE]
                                   [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id

messaging

usage: debesis-ccp messaging [-h] VERB ...

positional arguments:
  VERB
    create     create a messaging instance from a workload template
    redeploy   redeploy a messaging instance: copy its latest revision + apply
               only your deltas
    list       list messaging instances in an environment
    get        show one messaging instance
    delete     delete a messaging instance
    templates  list available messaging workload templates

options:
  -h, --help   show this help message and exit
messaging create
usage: debesis-ccp messaging create [-h] [--json] [--ca-bundle CA_BUNDLE]
                                    [--insecure] [--kek KEK] [--kek-stdin]
                                    --env ENV --name NAME --template TEMPLATE
                                    [--sku SKU] [--cpu CPU] [--memory MEMORY]
                                    [--disk DISK] [--description DESCRIPTION]
                                    [--password PASSWORD]
                                    [--service-id SERVICE_ID]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --name NAME           instance name
  --template TEMPLATE   workload template id
  --sku SKU             product SKU id (sets resources)
  --cpu CPU             requested CPU (millicores)
  --memory MEMORY       requested memory (MB)
  --disk DISK           requested disk (MB)
  --description DESCRIPTION
                        free-text description
  --password PASSWORD   auth password (auto-generated if omitted; 8-128 chars,
                        must not contain " \ , [ ] = whitespace or control
                        characters)
  --service-id SERVICE_ID
                        redeploy an EXISTING instance in place instead of
                        creating one
messaging redeploy
usage: debesis-ccp messaging redeploy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                      [--insecure] [--kek KEK] [--kek-stdin]
                                      --service SERVICE [--template TEMPLATE]
                                      [--sku SKU] [--cpu CPU]
                                      [--memory MEMORY] [--disk DISK]
                                      [--description DESCRIPTION]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --service SERVICE     messaging instance id
  --template TEMPLATE   override workload template id
  --sku SKU             override product SKU id
  --cpu CPU             override requested CPU (millicores)
  --memory MEMORY       override requested memory (MB)
  --disk DISK           override requested disk (MB)
  --description DESCRIPTION
                        override free-text description
messaging list
usage: debesis-ccp messaging list [-h] [--json] [--ca-bundle CA_BUNDLE]
                                  [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
messaging get
usage: debesis-ccp messaging get [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
messaging delete
usage: debesis-ccp messaging delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                                    [--insecure] --id ID [--purge]
                                    [--retention-days RETENTION_DAYS]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
  --purge               delete the data too
  --retention-days RETENTION_DAYS
                        days to retain data, where the product retains it
messaging templates
usage: debesis-ccp messaging templates [-h] [--json] [--ca-bundle CA_BUNDLE]
                                       [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
usage: debesis-ccp search [-h] VERB ...

positional arguments:
  VERB
    create     create a search instance from a workload template
    redeploy   redeploy a search instance: copy its latest revision + apply
               only your deltas
    list       list search instances in an environment
    get        show one search instance
    delete     delete a search instance
    templates  list available search workload templates

options:
  -h, --help   show this help message and exit
search create
usage: debesis-ccp search create [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] [--kek KEK] [--kek-stdin]
                                 --env ENV --name NAME --template TEMPLATE
                                 [--sku SKU] [--description DESCRIPTION]
                                 [--password PASSWORD]
                                 [--service-id SERVICE_ID]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --name NAME           instance name
  --template TEMPLATE   workload template id
  --sku SKU             product SKU id (sets resources)
  --description DESCRIPTION
                        free-text description
  --password PASSWORD   auth password (auto-generated if omitted; 8-128 chars,
                        must not contain " \ , [ ] = whitespace or control
                        characters)
  --service-id SERVICE_ID
                        redeploy an EXISTING instance in place instead of
                        creating one
search redeploy
usage: debesis-ccp search redeploy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                   [--insecure] [--kek KEK] [--kek-stdin]
                                   --service SERVICE [--template TEMPLATE]
                                   [--sku SKU] [--description DESCRIPTION]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --service SERVICE     search instance id
  --template TEMPLATE   override workload template id
  --sku SKU             override product SKU id
  --description DESCRIPTION
                        override free-text description
search list
usage: debesis-ccp search list [-h] [--json] [--ca-bundle CA_BUNDLE]
                               [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
search get
usage: debesis-ccp search get [-h] [--json] [--ca-bundle CA_BUNDLE]
                              [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
search delete
usage: debesis-ccp search delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] --id ID [--purge]
                                 [--retention-days RETENTION_DAYS]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
  --purge               delete the data too
  --retention-days RETENTION_DAYS
                        days to retain data, where the product retains it
search templates
usage: debesis-ccp search templates [-h] [--json] [--ca-bundle CA_BUNDLE]
                                    [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id

sql

usage: debesis-ccp sql [-h] VERB ...

positional arguments:
  VERB
    create     create a sql instance from a workload template
    redeploy   redeploy a sql instance onto its own retained data
               (resurrection: KEK only, no overrides)
    list       list sql instances in an environment
    get        show one sql instance
    delete     delete a sql instance
    templates  list available sql workload templates

options:
  -h, --help   show this help message and exit
sql create
usage: debesis-ccp sql create [-h] [--json] [--ca-bundle CA_BUNDLE]
                              [--insecure] [--kek KEK] [--kek-stdin] --env ENV
                              --name NAME --template TEMPLATE [--sku SKU]
                              [--cpu CPU] [--memory MEMORY] [--disk DISK]
                              [--description DESCRIPTION]
                              [--password PASSWORD] [--database DATABASE]
                              [--username USERNAME]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --name NAME           instance name
  --template TEMPLATE   workload template id
  --sku SKU             product SKU id (sets resources)
  --cpu CPU             requested CPU (millicores)
  --memory MEMORY       requested memory (MB)
  --disk DISK           requested disk (GB)
  --description DESCRIPTION
                        free-text description
  --password PASSWORD   auth password (auto-generated if omitted; 8-128 chars,
                        must not contain " \ , [ ] = whitespace or control
                        characters)
  --database DATABASE   initial database name (defaults to --name; on
                        operator-managed and document tiers it must start with
                        a letter or _ and use only letters, digits, _ and -)
  --username USERNAME   initial database username
sql redeploy
usage: debesis-ccp sql redeploy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                [--insecure] [--kek KEK] [--kek-stdin]
                                --service SERVICE

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --service SERVICE     sql instance id
sql list
usage: debesis-ccp sql list [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]
                            --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
sql get
usage: debesis-ccp sql get [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]
                           --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
sql delete
usage: debesis-ccp sql delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                              [--insecure] --id ID [--purge]
                              [--retention-days RETENTION_DAYS]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
  --purge               delete the data too
  --retention-days RETENTION_DAYS
                        days to retain data, where the product retains it
sql templates
usage: debesis-ccp sql templates [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id

document

usage: debesis-ccp document [-h] VERB ...

positional arguments:
  VERB
    create           create a document instance from a workload template
    rotate-password  rotate the password on a document instance (dispatches a
                     new deploy revision)
    open-proxy       open a 30-minute connection proxy to a document instance
                     from outside the cluster
    proxy            show the instance's open connection proxy
    close-proxy      close a connection proxy before it expires
    list             list document instances in an environment
    get              show one document instance
    delete           delete a document instance
    templates        list available document workload templates

options:
  -h, --help         show this help message and exit
document create
usage: debesis-ccp document create [-h] [--json] [--ca-bundle CA_BUNDLE]
                                   [--insecure] [--kek KEK] [--kek-stdin]
                                   --env ENV --name NAME --template TEMPLATE
                                   [--sku SKU] [--cpu CPU] [--memory MEMORY]
                                   [--disk DISK] [--description DESCRIPTION]
                                   [--password PASSWORD] [--database DATABASE]
                                   [--username USERNAME]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --name NAME           instance name
  --template TEMPLATE   workload template id
  --sku SKU             product SKU id (sets resources)
  --cpu CPU             requested CPU (millicores)
  --memory MEMORY       requested memory (MB)
  --disk DISK           requested disk (GB)
  --description DESCRIPTION
                        free-text description
  --password PASSWORD   auth password (auto-generated if omitted; 8-128 chars
                        of letters, digits and . _ ~ + = -)
  --database DATABASE   initial database name (defaults to --name; on
                        operator-managed and document tiers it must start with
                        a letter or _ and use only letters, digits, _ and -)
  --username USERNAME   initial database username
document rotate-password
usage: debesis-ccp document rotate-password [-h] [--json]
                                            [--ca-bundle CA_BUNDLE]
                                            [--insecure] [--kek KEK]
                                            [--kek-stdin] --id ID
                                            [--password PASSWORD]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --id ID               document instance id
  --password PASSWORD   new password (auto-generated if omitted; letters,
                        digits and . _ ~ + = -)
document open-proxy
usage: debesis-ccp document open-proxy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                       [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               document instance id
document proxy
usage: debesis-ccp document proxy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                  [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               document instance id
document close-proxy
usage: debesis-ccp document close-proxy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                        [--insecure] --id ID --proxy PROXY

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               document instance id
  --proxy PROXY         proxy id
document list
usage: debesis-ccp document list [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
document get
usage: debesis-ccp document get [-h] [--json] [--ca-bundle CA_BUNDLE]
                                [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
document delete
usage: debesis-ccp document delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                                   [--insecure] --id ID [--purge]
                                   [--retention-days RETENTION_DAYS]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
  --purge               delete the data too
  --retention-days RETENTION_DAYS
                        days to retain data, where the product retains it
document templates
usage: debesis-ccp document templates [-h] [--json] [--ca-bundle CA_BUNDLE]
                                      [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id

compute

usage: debesis-ccp compute [-h] VERB ...

positional arguments:
  VERB
    deploy    deploy a compute service from a JSON spec file
    list      list compute instances in an environment
    get       show one compute instance
    delete    delete a compute instance

options:
  -h, --help  show this help message and exit
compute deploy
usage: debesis-ccp compute deploy [-h] [--json] [--ca-bundle CA_BUNDLE]
                                  [--insecure] [--kek KEK] [--kek-stdin]
                                  --from-file FILE [--image-tag IMAGE_TAG]
                                  [--service-id SERVICE_ID]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --from-file FILE      path to a JSON deploy spec (the PUT /compute body)
  --image-tag IMAGE_TAG
                        override image.tag in the spec
  --service-id SERVICE_ID
                        set serviceId → redeploy an existing service
compute list
usage: debesis-ccp compute list [-h] [--json] [--ca-bundle CA_BUNDLE]
                                [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
compute get
usage: debesis-ccp compute get [-h] [--json] [--ca-bundle CA_BUNDLE]
                               [--insecure] --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
compute delete
usage: debesis-ccp compute delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                                  [--insecure] --id ID [--purge]
                                  [--retention-days RETENTION_DAYS]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --id ID               instance id
  --purge               delete the data too
  --retention-days RETENTION_DAYS
                        days to retain data, where the product retains it

secret

usage: debesis-ccp secret [-h] VERB ...

positional arguments:
  VERB
    list      list secrets in an environment
    get       show one secret's metadata (never its value)
    set       create a secret
    update    update a secret's value and/or description
    reveal    print a secret's plaintext value (needs secret:access)
    delete    delete a secret

options:
  -h, --help  show this help message and exit
secret list
usage: debesis-ccp secret list [-h] [--json] [--ca-bundle CA_BUNDLE]
                               [--insecure] --env ENV

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
secret get
usage: debesis-ccp secret get [-h] [--json] [--ca-bundle CA_BUNDLE]
                              [--insecure] --env ENV --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
  --id ID               secret id
secret set
usage: debesis-ccp secret set [-h] [--json] [--ca-bundle CA_BUNDLE]
                              [--insecure] [--kek KEK] [--kek-stdin] --env ENV
                              --name NAME [--value VALUE] [--value-stdin]
                              [--description DESCRIPTION]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --name NAME           secret name (alphanumeric with _.-)
  --value VALUE         secret value (prefer --value-stdin to keep it out of
                        shell history)
  --value-stdin         read the secret value from stdin
  --description DESCRIPTION
                        free-text description
secret update
usage: debesis-ccp secret update [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] [--kek KEK] [--kek-stdin]
                                 --env ENV --id ID [--value VALUE]
                                 [--value-stdin] [--description DESCRIPTION]

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --id ID               secret id
  --value VALUE         new secret value
  --value-stdin         read the new value from stdin
  --description DESCRIPTION
                        new description
secret reveal
usage: debesis-ccp secret reveal [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] [--kek KEK] [--kek-stdin]
                                 --env ENV --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --kek KEK             customer KEK, base64 AES-256, for CMEK ops — visible
                        in /proc and shell history; prefer --kek-stdin or
                        $CCP_API_KEK (default: $CCP_API_KEK)
  --kek-stdin           read the customer KEK from stdin (keeps key material
                        off the process argv)
  --env ENV             environment id
  --id ID               secret id
secret delete
usage: debesis-ccp secret delete [-h] [--json] [--ca-bundle CA_BUNDLE]
                                 [--insecure] --env ENV --id ID

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --env ENV             environment id
  --id ID               secret id

api

usage: debesis-ccp api [-h] [--json] [--ca-bundle CA_BUNDLE] [--insecure]
                       [--data DATA] [--query KEY=VALUE] [--header KEY=VALUE]
                       METHOD PATH

positional arguments:
  METHOD                HTTP method (GET/POST/PUT/PATCH/DELETE)
  PATH                  absolute API path, e.g. /api/v1/organizations

options:
  -h, --help            show this help message and exit
  --json                machine-readable JSON output (default: table)
  --ca-bundle CA_BUNDLE
                        PEM the server's TLS cert chains to (default:
                        $CCP_API_CA_BUNDLE)
  --insecure            skip TLS verification — DEV ONLY (default:
                        $CCP_API_INSECURE)
  --data DATA           request body: inline JSON, @file, or - for stdin
  --query KEY=VALUE     append a query param (repeatable)
  --header KEY=VALUE    add a request header (repeatable)

The escape hatch

Section titled “The escape hatch”

debesis-ccp api METHOD PATH calls any endpoint directly, including ones no curated command covers yet. Use it when you need something the verbs above do not reach — it takes --data (inline, @file, or - for stdin), --query and --header, and prints raw output.