Command line

This page is a short reference of the microb2b command. The pages it links to explain each topic in more detail.

microb2b standalone runs MicroB2B. The other commands are tools for the administrator. They work on the database directly, so they need the same database settings as MicroB2B: DB_TYPE and DB_URL. They do not need MicroB2B to be running, and you do not need to sign in.

Run them on the server, as the user MicroB2B runs as, with the same environment file. In a container, use docker exec microb2b /bin/microb2b ....

Every command accepts --help, which lists its options.

standalone

microb2b standalone

Runs MicroB2B: the web UI, the REST API, and every enabled receiver, sender and other part, in one process. See install.

users

Manages the users of the web UI. Use it to create the first user, or to get back in when nobody can sign in. See users and account recovery.

Command	What it does
`microb2b users create <name> [--display-name "<name>"]`	Create a user and print their setup link
`microb2b users list`	List the users
`microb2b users reset-password <name>`	Clear the password, keep the authenticator app, print a setup link
`microb2b users reset-totp <name>`	Clear the authenticator app and recovery codes, print a setup link
`microb2b users reset <name>`	Clear password, authenticator app and recovery codes, print a setup link
`microb2b users password-login <name> on\|off [--force]`	Turn password sign-in on or off. On prints a setup link when the user needs one
`microb2b users disable <name> [--force]`	Disable a user and end their sessions
`microb2b users enable <name>`	Enable a user
`microb2b users delete <name> [--yes] [--force]`	Delete a user. Asks first, unless you give `--yes`
`microb2b users sign-out <name>`	End every session of a user

MicroB2B refuses to disable, delete or turn off password sign-in for the last user who can sign in. --force does it anyway.

Set PUBLIC_URL to get whole setup links. Without it, the command prints only the path.

service-accounts

Manages service accounts and their API tokens, for scripts and other systems that use the REST API. See service accounts.

Command	What it does
`microb2b service-accounts create <name> [--description "<text>"]`	Create a local service account, which uses API tokens
`microb2b service-accounts create <name> --issuer <url> --subject <sub>`	Create a federated service account, for an identity provider’s tokens
`microb2b service-accounts list`	List the service accounts
`microb2b service-accounts disable <name>`	Disable an account. All its tokens are refused
`microb2b service-accounts enable <name>`	Enable an account again
`microb2b service-accounts delete <name>`	Delete an account and revoke its tokens
`microb2b service-accounts token create <account> --label <label> [--expires-in-days <n>]`	Make an API token and print it. Default lifetime 90 days
`microb2b service-accounts token list`	List the API tokens
`microb2b service-accounts token revoke <id>`	Revoke a token, by the id the list shows

A token is shown only once, when you make it. Store it right away. Whoever has it can use the REST API as an administrator.

secrets

microb2b secrets rekey

Seals every stored secret and private key again with the current SECRETS_KEY. You run it when you replace the master key. It needs SECRETS_KEY and SECRETS_PREVIOUS_KEYS, and can run while MicroB2B runs. See secrets.

audit

Command	What it does
`microb2b audit verify`	Check the audit log in the database. Needs `AUDIT_KEY`
`microb2b audit verify --file <file> [--after-id <N> --after-hash <hash>]`	Check an export file
`microb2b audit export [--out <file>] [--after-id <N>]`	Write the audit log as JSON lines

See audit log.

Who is recorded

Changes made with users and service-accounts appear in the audit log. The actor is cli: followed by the operating system user who ran the command, such as cli:root.

Environment variables REST API basics