org

Organization management commands for NDCLI. These commands allow you to create, manage, and configure organizations and their members.

Commands

Command	Description
`org list`	List organizations
`org describe`	Show organization details
`org quota`	Show plan limits, usage and plan features
`org create`	Create a new organization
`org delete`	Delete an organization
`org set-default-ou`	Set the default OU
`org account`	Manage organization accounts
`org invite`	Manage organization invitations

org list

List organizations you have access to.

ndcli org list [flags]

Flags

Flag	Type	Default	Description
`--name`	string		Filter by name (regex pattern)
`--role`	string		Filter by your role: `RO`, `RW`, `SU`
`--status`	string		Filter by status: `ENABLED`, `DISABLED`, `INVITED`, `DECLINED`
`--sort-by`	string	`name:asc`	Sort field and direction
`--page`	int	`1`	Page number
`--per-page`	int	`30`	Items per page

Roles

Role	Code	Description
Read-Only	`RO`	Can view resources
Read-Write	`RW`	Can view and modify resources
Superuser	`SU`	Full administrative access

Examples

ndcli org list

ndcli org list --role SU

ndcli org list --name "prod.*"

org describe

Show detailed information about an organization.

ndcli org describe [name]

Arguments

Argument	Required	Description
`name`	No	Organization name (uses default if not specified)

Output

Shows:

Organization name and display name
Description
Status
Default OU
Creation date
Device count
Member count

Examples

ndcli org describe

ndcli org describe my-company

ndcli org describe my-company -f json

org quota

Show an organization’s plan limits and usage, and the features its plan includes.

ndcli org quota <org>

Arguments

Argument	Required	Description
`org`	Yes	Organization name. It isn’t taken from your default organization

Output

Shows:

The plan
A table of resources (devices, users, VPN networks and snippets) with their limit, how much is used and how much is available
Features, each shown as enabled or disabled: Backup, Remote Admin and Firmware Tracks

With -f json, the output has a firmware_tracks_enabled key, beside backup_enabled and remoteadmin_enabled. Firmware tracks are on every plan.

Examples

ndcli org quota my-company

ndcli org quota my-company -f json

org create

Create a new organization.

ndcli org create [name] [flags]

Arguments

Argument	Required	Description
`name`	Yes	Organization name (URL-safe identifier)

Flags

Flag	Type	Description
`--display-name`	string	Human-readable display name
`--description`	string	Organization description

Examples

ndcli org create acme-corp

ndcli org create acme-corp \
  --display-name "ACME Corporation" \
  --description "Production firewall infrastructure"

Notes

Organization names must be unique and URL-safe
You become the superuser (SU) of organizations you create
A read-only personal access token is refused (403, TOKEN_READ_ONLY), and so is a token restricted to an organization (403, TOKEN_ORG_MISMATCH), whatever the name. A read-write token that isn’t restricted can create one.

org delete

Delete an organization and everything in it, permanently. ndcli asks you to confirm first.

ndcli org delete [name]

Arguments

Argument	Required	Description
`name`	Yes	Organization name to delete

Examples

ndcli org delete old-organization

Notes

Only a Superuser signed in interactively can delete an organization. A member below Superuser, and every personal access token (a token never acts as Superuser), is refused with 403 ACCESS_DENIED.
While the organization’s subscription can still bill, the delete is refused with 409 SUBSCRIPTION_NOT_CANCELED: cancel the subscription in Billing first. A subscription set to cancel at the end of its period still counts until it has ended, and the message gives that date.
While the organization has OUs other than its default OU, the delete is refused with 409 HAS_DEPENDENCIES, which lists them. Delete those OUs first.

org set-default-ou

Set the default organizational unit for new devices in the organization.

ndcli org set-default-ou [ou-name]

Arguments

Argument	Required	Description
`ou-name`	Yes	Name of the OU to set as default

Examples

ndcli org set-default-ou staging

Notes

New devices will be automatically assigned to this OU when approved
The OU must exist in the organization

org account

Manage organization accounts (members).

org account list

List all accounts (members) in the organization.

ndcli org account list

Output

Shows for each account:

Email address
Display name
Role (RO, RW, SU)
Status (ENABLED, DISABLED)

Examples

ndcli org account list
ndcli org account list -f json

org account role

Set the role for a user account.

ndcli org account role [email] [role]

Arguments

Argument	Required	Description
`email`	Yes	User email address
`role`	Yes	Role to assign

Valid Roles

Role	Aliases	Description
`SU`	`superuser`	Full administrative access
`RW`	`readwrite`	Can view and modify resources
`RO`	`readonly`	Can only view resources

Examples

ndcli org account role user@example.com SU

ndcli org account role user@example.com readonly

org account enable

Enable a disabled account.

ndcli org account enable [email]

Examples

ndcli org account enable user@example.com

org account disable

Disable an account, optionally removing it permanently.

ndcli org account disable [email] [flags]

Flags

Flag	Type	Default	Description
`--remove`	bool	`false`	Permanently remove the account

Examples

ndcli org account disable user@example.com

ndcli org account disable user@example.com --remove

org invite

Manage organization invitations.

org invite list

List pending invitations for the organization (sent invitations) or for yourself (received invitations). With a personal access token the sent list is always empty, because a token never carries Superuser clearance, and a token restricted to one organization lists only that organization’s invitations.

ndcli org invite list

Examples

ndcli org invite list

org invite send

Send an invitation to join the organization.

ndcli org invite send [email] [flags]

Arguments

Argument	Required	Description
`email`	Yes	Email address to invite

Flags

Flag	Type	Default	Description
`--role`	string	`RO`	Role to assign: `SU`, `RW`, `RO`

Examples

ndcli org invite send newuser@example.com

ndcli org invite send admin@example.com --role RW

org invite accept

Accept an invitation to join an organization.

ndcli org invite accept [org-name]

Arguments

Argument	Required	Description
`org-name`	Yes	Name of the organization to join

Examples

ndcli org invite accept acme-corp

A read-only personal access token is refused (403, TOKEN_READ_ONLY), and so is a token restricted to another organization (TOKEN_ORG_MISMATCH).

org invite decline

Decline an invitation to join an organization.

ndcli org invite decline [org-name]

Arguments

Argument	Required	Description
`org-name`	Yes	Name of the organization

Examples

ndcli org invite decline some-org

The same token limits as org invite accept apply.

org invite revoke

Revoke a pending invitation (requires superuser privileges).

ndcli org invite revoke [email]

Arguments

Argument	Required	Description
`email`	Yes	Email address of the invitee

Examples

ndcli org invite revoke cancelled-user@example.com