| admin tenant create | Creates one tenant. | AdminService.CreateTenant | --name (required) |
| admin tenant get | Returns one tenant by id. | AdminService.GetTenant | --id (required) |
| admin tenant list | Returns tenants in pages. | AdminService.ListTenants | --page-size, --page-token |
| admin tenant update | Changes the display name or the state of one tenant. | AdminService.UpdateTenant | --id (required), --name, --state |
| admin tenant delete | Removes one tenant and every record it owns. | AdminService.DeleteTenant | --id (required) |
| admin trust add | Creates or replaces one trust entry. | AdminService.UpsertTrustEntry | --did, --x509-subject, --name (required), --role (required), --status, --credential-type, --service-endpoint |
| admin trust get | Returns one trust entry by entity identifier. | AdminService.GetTrustEntry | --did, --x509-subject |
| admin trust list | Returns trust entries in pages. | AdminService.ListTrustEntries | --role, --page-size, --page-token |
| admin trust remove | Removes one trust entry. | AdminService.DeleteTrustEntry | --did, --x509-subject |
| admin onboard | Registers one OIDC provider. | AdminService.CreateAuthProvider | --issuer (required), --name, --client-id, --client-secret-env, --dynamic, --initial-access-token, --roles-claim-path |
| admin onboard-provider | Registers one OIDC provider from its issuer URL. | AdminService.OnboardProvider | --issuer-url (required), --client-id, --client-secret-env, --dynamic |
| admin provider get | Returns one provider by id. | AdminService.GetAuthProvider | --id (required) |
| admin provider list | Returns providers in pages. | AdminService.ListAuthProviders | --page-size, --page-token |
| admin provider update | Changes one provider. | AdminService.UpdateAuthProvider | --id (required), --name, --enabled |
| admin provider remove | Removes one provider. | AdminService.DeleteAuthProvider | --id (required) |
| admin apikey create | Creates one machine API key. | AdminService.CreateApiKey | --name (required), --tenant (required), --role (required), --expires |
| admin apikey list | Returns API keys without their secret values. | AdminService.ListApiKeys | --tenant, --page-size |
| admin apikey revoke | Disables one API key at once. | AdminService.RevokeApiKey | --id (required) |
| admin health | Returns the health of every service in the deployment. | AdminService.GetServiceHealth | None |
| admin audit | Returns audit records that match a filter, newest first. | AdminService.QueryAuditLog | --actor, --action, --from, --to, --page-size |
| admin bind | Binds the first super admin with the bootstrap token. | AdminService.OnboardAdmin | --bootstrap-token (required), --provider |
| admin help | Returns the command tree with descriptions. | AdminService.ListCommands | None |