support

Support ticket commands for NDCLI. A ticket is a conversation between your organization and NetDefense Support: open one, follow the thread, reply, and close it when you’re done. The same tickets are in the web app’s Support area, which also describes ticket statuses and email notifications.

Every member of an organization can use these commands, whatever their role, and so can a personal access token, read-only ones included. They work on your default organization; add -o <organization> for another one. ndcli support needs ndcli 1.29.0 or later.

Commands

Command	Description
`support list`	List the organization’s tickets
`support show`	Show a ticket and its messages
`support create`	Open a new ticket
`support update`	Change a ticket’s subject, priority, category or devices
`support reply`	Post a reply visible to NetDefense Support
`support note`	Post an internal note visible only to your organization
`support close`	Close a ticket
`support reopen`	Reopen a closed ticket
`support messages`	List a ticket’s messages
`support participant add`	Add an organization member to a ticket
`support participant remove`	Remove a participant from a ticket
`support attachment upload`	Upload a file and print its attachment UUID
`support attachment delete`	Delete an upload that isn’t attached to a message yet
`support download`	Download a ticket attachment

Messages are plain text, up to 64 KiB each (counted in bytes, so text in non-Latin scripts reaches the limit sooner). A message carries at most 10 attachments of up to 25 MiB each, of any file type.

support list

List the organization’s tickets, most recent activity first. The list holds every ticket in the organization, not only the ones you take part in.

ndcli support list [flags]

Flags

Flag	Type	Default	Description
`--status`	string		Filter by status: `OPEN`, `PENDING`, `CLOSED`
`--priority`	string		Filter by priority: `LOW`, `NORMAL`, `HIGH`, `URGENT`
`--category`	string		Filter by category: `BUG`, `QUESTION`, `FEATURE_REQUEST`, `BILLING`, `OTHER`
`--participant`	string		Only tickets with this participant: `me` or an email address
`--device`	string		Only tickets related to this device UUID
`-q`, `--q`	string		Only tickets whose subject contains this text (up to 100 characters)
`--sort-by`	string	`last_activity_at:desc`	`FIELD:asc` or `FIELD:desc` over `last_activity_at`, `created_at`, `updated_at`, `priority`, `status`, `subject`. A field without a direction sorts descending
`--page`	int	`1`	Page number
`--per-page`	int	`50`	Items per page, up to 100

Status, priority and category values are case-insensitive.

Examples

# Tickets waiting for your reply
ndcli support list --status PENDING

# Tickets you take part in
ndcli support list --participant me

# Subjects that mention backups, oldest activity first
ndcli support list -q backup --sort-by last_activity_at:asc

╭──────────┬─────────────────────────────────────────────────────┬─────────┬──────────┬──────────┬─────────────┬───────────────╮
│ CODE     │ SUBJECT                                             │ STATUS  │ PRIORITY │ CATEGORY │ CREATED BY  │ LAST ACTIVITY │
├──────────┼─────────────────────────────────────────────────────┼─────────┼──────────┼──────────┼─────────────┼───────────────┤
│ Kq7Xb2Lm │ Sync fails on fw-branch-01 after the 26.1.11 update │ PENDING │ HIGH     │ BUG      │ Alex Rivera │ 2h            │
│ R4tN9pWd │ Can a template carry two software policies?         │ OPEN    │ NORMAL   │ QUESTION │ Sam Chen    │ 1d            │
│ aZ3fH8yQ │ Invoice shows the wrong device count                │ CLOSED  │ LOW      │ BILLING  │ Alex Rivera │ 5d            │
╰──────────┴─────────────────────────────────────────────────────┴─────────┴──────────┴──────────┴─────────────┴───────────────╯

Total: 3 ticket(s)

PENDING means NetDefense Support replied and is waiting for you. See Ticket status.

support show

Show a ticket’s details and its message thread, oldest first.

ndcli support show [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code, as shown by `support list`

Flags

Flag	Type	Default	Description
`--no-messages`	bool	`false`	Print the ticket details only, without the thread

Examples

ndcli support show Kq7Xb2Lm

Kq7Xb2Lm  Sync fails on fw-branch-01 after the 26.1.11 update

  Status:          PENDING
  Priority:        HIGH
  Category:        BUG
  Created by:      Alex Rivera
  Created:         2026-10-20 09:14:03
  Last activity:   2026-10-21 16:42:10
  Web:             https://app.netdefense.io/organizations/acme/tickets/Kq7Xb2Lm
  Participants:    alex@example.com (creator), sam@example.com
  Devices:         fw-branch-01 (3f8a2c1e-7b4d-4e9a-9c2f-1d5e6a7b8c90)

Messages

  #1  Alex Rivera  (response)  2026-10-20 09:14:03
    Since the 26.1.11 update, every sync of fw-branch-01 ends FAILED with
    "service restart timed out". The other devices sync fine. Agent log attached.
    ↳ 9b2e4d71-5c3a-4f8e-a1d6-7e0f2b9c4a53  ndagent.log  148.2 KiB  text/plain

  #2  Sam Chen  (internal note)  2026-10-20 09:54:03
    Branch office is closed on Friday; schedule any reboot for Saturday.

  #3  NetDefense Support  (response)  2026-10-21 16:42:10
    Thanks for the log. Please run `ndcli device health fw-branch-01` and reply
    with the output.

Notes

Web: opens the ticket in the web app.
Internal notes are labelled (internal note). Only your organization sees them.
A ↳ line is an attachment: its UUID, filename, size and type. Download it with support download.
The thread shows the first 100 messages. A longer one ends with a line pointing to support messages and its --page flag.

support create

Open a new ticket with its first message.

ndcli support create [flags]

Flags

Flag	Type	Default	Description
`--subject`	string		Ticket subject: one line, up to 255 characters. Required
`--message`	string		Message body
`--message-file`	string		Read the message body from a file, or `-` for stdin
`--priority`	string	`NORMAL`	`LOW`, `NORMAL`, `HIGH` or `URGENT`
`--category`	string	`OTHER`	`BUG`, `QUESTION`, `FEATURE_REQUEST`, `BILLING` or `OTHER`
`--device`	string		Related device UUID. Repeatable, up to 20
`--participant`	string		Email of an organization member to add as a participant. Repeatable
`--attach`	string		Local file to upload and attach. Repeatable
`--attachment`	string		UUID of a file uploaded earlier with `support attachment upload`. Repeatable

Examples

ndcli support create \
  --subject "Sync fails on fw-branch-01 after the 26.1.11 update" \
  --category BUG --priority HIGH \
  --device 3f8a2c1e-7b4d-4e9a-9c2f-1d5e6a7b8c90 \
  --message-file report.txt \
  --attach ndagent.log

# Take the message from another command's output
ndcli device health fw-branch-01 | ndcli support create --subject "Health of fw-branch-01" --message-file -

Notes

A message is required: pass --message or --message-file, not both.
ndcli device describe <device> shows a device’s UUID.
You become the ticket’s creator and first participant. --participant adds others: each must be an enabled member of the organization, and a ticket has at most 25 participants, you included. Participants get email notifications.
--attach and --attachment together take at most 10 files. --attach uploads the files before the ticket is created, and deletes them again if it can’t be.
The output is the new ticket, with its code. With -f json it is one JSON object, with the ticket under ticket.

support update

Change a ticket’s subject, priority, category or related devices.

ndcli support update [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code

Flags

Flag	Type	Default	Description
`--subject`	string		New subject
`--priority`	string		`LOW`, `NORMAL`, `HIGH` or `URGENT`
`--category`	string		`BUG`, `QUESTION`, `FEATURE_REQUEST`, `BILLING` or `OTHER`
`--device`	string		Related device UUID. Repeatable, up to 20; replaces the whole list
`--clear-devices`	bool	`false`	Remove every related device

Examples

ndcli support update Kq7Xb2Lm --priority URGENT

# The ticket now relates to these two devices, and no others
ndcli support update Kq7Xb2Lm \
  --device 3f8a2c1e-7b4d-4e9a-9c2f-1d5e6a7b8c90 \
  --device 0c6e1d2f-8a3b-4c5d-9e7f-2a1b3c4d5e6f

Notes

Only what you pass changes, and at least one flag is required.
--device replaces the ticket’s device list, so name every device it should keep. --clear-devices can’t be combined with --device.
Works on a closed ticket too. An update sends no email and doesn’t count as activity, so the ticket’s last activity stays as it was.

support reply

Post a reply that NetDefense Support sees.

ndcli support reply [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code

Flags

Flag	Type	Description
`--message`	string	Message body
`--message-file`	string	Read the message body from a file, or `-` for stdin
`--attach`	string	Local file to upload and attach. Repeatable
`--attachment`	string	UUID of a file uploaded earlier. Repeatable

Examples

ndcli support reply aZ3fH8yQ --message "The count is right again after this month's invoice. Thanks!"

✓ Reply posted on ticket aZ3fH8yQ; it is now OPEN

Notes

A message is required, and the attachment rules of support create apply.
A reply to a closed ticket reopens it, as in the example. The confirmation always shows the status the ticket has now.
The other participants get an email.

support note

Post an internal note. Your organization sees it; NetDefense Support never does.

ndcli support note [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code

Flags

Same as support reply: --message, --message-file, --attach and --attachment.

Examples

ndcli support note Kq7Xb2Lm --message "Branch office is closed on Friday; schedule any reboot for Saturday."

Notes

A note doesn’t change the ticket’s status.
The other participants get an email.

support close

Close a ticket.

ndcli support close [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code

Flags

Flag	Type	Default	Description
`--message`	string		Optional closing message
`--message-file`	string		Read the message from a file, or `-` for stdin

Examples

ndcli support close Kq7Xb2Lm --message "Fixed by the agent update. Thanks!"

✓ Ticket Kq7Xb2Lm is now CLOSED

Notes

A message is posted as a reply, which NetDefense Support sees, just before the ticket closes, and the other participants’ email carries it.
A closed ticket can’t be closed again: the command fails with TICKET_INVALID_TRANSITION.
A later reply, from your organization or from NetDefense Support, reopens the ticket, and so does support reopen.

support reopen

Reopen a closed ticket.

ndcli support reopen [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code

Flags

Flag	Type	Default	Description
`--message`	string		Optional message, posted as a reply before the ticket reopens
`--message-file`	string		Read the message from a file, or `-` for stdin

Examples

ndcli support reopen Kq7Xb2Lm --message "The sync failures are back since this morning."

Notes

Only a closed ticket can be reopened. On an open or pending one the command fails with TICKET_INVALID_TRANSITION.

support messages

List a ticket’s messages, a page at a time. Use it for threads longer than the 100 messages support show prints.

ndcli support messages [code] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code

Flags

Flag	Type	Default	Description
`--order`	string	`asc`	`asc` (oldest first) or `desc` (newest first)
`--page`	int	`1`	Page number
`--per-page`	int	`50`	Items per page, up to 100

Examples

# The ten newest messages
ndcli support messages Kq7Xb2Lm --order desc --per-page 10

support participant add

Add an organization member to a ticket. They get an email saying so, and the ticket’s notifications from then on.

ndcli support participant add [code] [email]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code
`email`	Yes	Email address of an enabled member of the organization

Examples

ndcli support participant add Kq7Xb2Lm sam@example.com

Notes

An address that isn’t an enabled member of the organization is refused with TICKET_PARTICIPANT_NOT_ELIGIBLE.
Adding someone who already takes part changes nothing and sends no second email.
A ticket has at most 25 participants, its creator included.
The output is the ticket’s participant list.

support participant remove

Remove a participant from a ticket. They stop getting its emails.

ndcli support participant remove [code] [email] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code
`email`	Yes	Email address of the participant to remove

Flags

Flag	Type	Default	Description
`--force`	bool	`false`	Skip the confirmation prompt

Examples

ndcli support participant remove Kq7Xb2Lm sam@example.com

Notes

Asks for confirmation unless you pass --force.
The ticket’s creator can’t be removed. You can remove yourself.
A removed participant can still read the ticket, like every member of the organization.

support attachment upload

Upload a file and print its attachment UUID, for --attachment on support create, support reply or support note.

ndcli support attachment upload [path]

Arguments

Argument	Required	Description
`path`	Yes	Local file, up to 25 MiB

Examples

ndcli support attachment upload config-diff.txt

✓ Attachment uploaded
  UUID:     c41f8a2e-0d6b-4b73-9e15-8a2d3f7c6b10
  Filename: config-diff.txt
  Type:     text/plain
  Size:     4.1 KiB
  SHA-256:  5f2b8c0e9a41d7c36e8f1b2a4d9c0e7f3a6b5c8d1e2f4a7b9c0d3e6f8a1b2c4d
  Unbound — reference this uuid in a ticket create or reply within 24 hours.

Notes

An upload that no message uses within 24 hours is deleted.
You can hold at most 20 such unused uploads in an organization; attach or delete some before uploading more.
--attach on support create, support reply and support note uploads and attaches in one step, which is usually simpler.

support attachment delete

Delete an upload that isn’t attached to a message yet.

ndcli support attachment delete [uuid] [flags]

Arguments

Argument	Required	Description
`uuid`	Yes	UUID printed by `support attachment upload`

Flags

Flag	Type	Default	Description
`--force`	bool	`false`	Skip the confirmation prompt

Notes

Asks for confirmation unless you pass --force.
You can delete only your own uploads.
Once a file is attached to a message, it stays with that message: deleting it fails with TICKET_ATTACHMENT_ALREADY_BOUND.

support download

Download an attachment from a ticket.

ndcli support download [code] [attachment-uuid] [flags]

Arguments

Argument	Required	Description
`code`	Yes	Ticket code
`attachment-uuid`	Yes	Attachment UUID, from the `↳` lines of `support show`

Flags

Flag	Type	Default	Description
`--dest`	string	the attachment’s filename, in the current directory	Destination file or directory
`--overwrite`	bool	`false`	Replace an existing file at the destination

Examples

ndcli support download Kq7Xb2Lm 9b2e4d71-5c3a-4f8e-a1d6-7e0f2b9c4a53 --dest ~/Downloads/

Notes

The file’s SHA-256 is checked against the ticket before the file appears at the destination.
An existing file is never replaced unless you pass --overwrite.

MCP tools

The commands have tools in the MCP server: ndcli.support.list, ndcli.support.get (the ticket and, by default, its thread), ndcli.support.create, ndcli.support.update, ndcli.support.close, ndcli.support.reopen, ndcli.support.messages, ndcli.support.reply, ndcli.support.note, ndcli.support.participant_add, ndcli.support.participant_remove, ndcli.support.attachment_upload, ndcli.support.attachment_delete and ndcli.support.attachment_download.

ndcli.support.create, ndcli.support.reply and ndcli.support.note take attach_paths, local files to upload and attach in the same call.
ndcli.support.update, ndcli.support.participant_remove and ndcli.support.attachment_delete change nothing until they’re called with confirm=true, and return a preview without it. The device list given to ndcli.support.update replaces the whole list.
Files are read from, and downloads written to, the machine that runs the MCP server.