The zen CLI

zen is the command-line interface. It forwards to a configured server or a local installation, so every command maps to a REST call you could make directly.

Flows

# Run a flow with parameters
zen run-flow hello -p message="Hi there"

# Run against a specific environment
zen run-flow product-sync --env staging

# Read a run's logs (supports live tailing)
zen logs <run-id>

# Validate an entity file before it reaches runtime
zen validate config/connections/foo.connection.yaml

Secrets

There is no zen secrets verb — secrets are managed through REST or MCP, not the CLI:

# REST — set (or rotate) a secret, same path overwrites
curl -X POST http://localhost:5000/api/v1/platform/entities/secret \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"path":"prod/db","value":{"connection-string":"Server=prod-db;Database=warehouse;…"}}'

See Secrets for the MCP equivalent (create-entity/update-entity on entity: secret).

Config & API keys

zen config set api-key <key>

API key rotation goes through rotate-api-key / delete-api-key (the old key keeps working until deleted) — see Roles & API Keys.

Service lifecycle (systemd / Windows)

zen service install \
  --dir /opt/zenvara --port 5000 \
  --service-user zenvara --data-dir /var/lib/zenvara
zen service start
zen service status

# IIS variant
zen iis install --dir C:\Services\Zenvara --port 5000

Application binary

# Fetch the latest release for your platform (signature-verified) to a directory
zen app fetch --dir /opt/zenvara

# Pin a specific release instead
zen app fetch --version 3.0.0 --dir /opt/zenvara

# Upgrade in place — same no-args-needed default, or pin a version
zen app update
zen app update --version 3.0.0

# Roll back to the previous artifact
zen app rollback

--url still works as an escape hatch for a corporate mirror or air-gapped network (zen app fetch --url <url> --dir <dir>), but is no longer required — omit it and zen derives the GitHub-Release URL for your platform.

Backups

There is no zen backup verb — backups are managed through REST or MCP:

# REST — ad-hoc backup of selected categories (generic entity surface)
curl -X POST http://localhost:5000/api/v1/platform/entities/backup \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"categories":["flows","environments","secrets"]}'

# REST — list existing backups
curl http://localhost:5000/api/v1/platform/entities/backup -H "Authorization: Bearer $TOKEN"

# REST — restore a specific backup (bespoke verb)
curl -X POST http://localhost:5000/api/v1/platform/backups/<backup-id>/restore \
  -H "Authorization: Bearer $TOKEN"

The MCP equivalents are create-entity/list-entities (entity: backup) and restore-backup. See Backups & Restore.

Config versioning

There is no zen versions verb — reverting a config change goes through REST or MCP:

# REST — revert a config change (Git versioning enabled)
curl -X POST http://localhost:5000/api/v1/live/versions/<entity-type>/<name>/revert \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"commitHash":"<ref>"}'

The MCP equivalent is the revert-entity tool. See Upgrades & Rollback.

Quick reference

Task	Command
Run a flow	`zen run-flow <name> -p k=v`
Tail logs	`zen logs <run-id>`
Validate a file	`zen validate <path>`
Set/rotate a secret	REST `POST /api/v1/platform/entities/secret` (no `zen` verb)
Install the service	`zen service install …`
Upgrade the binary	`zen app update` (or `--version <ver>` to pin)
Roll back the binary	`zen app rollback`
Roll back config	REST `POST /api/v1/{branch}/versions/{type}/{name}/revert` (no `zen` verb)
Back up	REST `POST /api/v1/platform/entities/backup` (no `zen` verb)