Variable management commands for NDCLI. Variables are key-value pairs that can be defined at different scopes and referenced in snippets and templates using a ${variable_name} syntax.
Command alias: var. Along with net for network, this is one of only two command aliases in NDCLI.
A variable’s value comes from the first scope that defines it, in the order Device > Template > OU > Organization:
Scope Description deviceApplies to a single device, and wins over every other scope templateApplies only to that template’s snippets, on every device the template reaches ouApplies to all devices in an Organizational Unit orgApplies to all devices in the organization
A template’s value reaches only that template’s snippets, so other snippets on the same device still get the OU or organization value.
Each value records whether a Superuser saved it. A snippet that grants administrator rights only reaches a device when the values it uses were saved by a Superuser — see Variables that need a Superuser . To record that on an existing value, a Superuser signed in with ndcli auth login runs set at the same scope with the current value:
ndcli variable org set backup_role --value operators
ndcli variable ou set production backup_role --value operators
ndcli variable org set svc_backup_password --value-stdin < ./svc-backup-password.txt
A secret’s value can’t be read back, so pass it again with --value-stdin. A set with only --description doesn’t record it, and a value saved under NDCLI_TOKEN never counts as a Superuser’s.
The interactive prompt reads a single line. A value that spans lines, such as a PEM certificate or the private key of a certificate snippet , has to come in through --value-stdin, at every scope:
ndcli variable org create fw_wildcard_key --secret --value-stdin < ./fw-wildcard.key
ndcli variable device set fw-hq-01 fw_key --value-stdin < ./fw-hq-01.key
Show all variables with their definitions across all scopes. Useful for understanding which variables are defined and where they come from.
ndcli variable overview [flags]
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable overview --name " dns.* "
ndcli var overview -f json
List all variables defined at the organization level.
ndcli variable org list [flags]
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable org list --name " ntp.* "
Show details of a specific organization-level variable.
ndcli variable org describe [variable]
Argument Required Description variableYes Variable name
ndcli variable org describe ntp_server
Create a new organization-level variable.
ndcli variable org create [name] [value] [flags]
Argument Required Description nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --secretbool falseMark as secret — use for passwords, API keys, and pre-shared keys referenced from snippet content; value is redacted in API responses and can never be read back, only replaced --value-stdinbool falseRead the value from stdin instead of the value argument. Use this for secrets — a value passed as an argument lands in shell history and is visible to other users on the host via ps. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable org create ntp_server 192.168.1.1
ndcli variable org create ntp_server 192.168.1.1 --description " Primary NTP server "
ndcli variable org create api_key --secret --value-stdin < ./api-key.txt
Update an existing organization-level variable.
ndcli variable org set [variable] [flags]
Argument Required Description variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Use this to rotate a secret’s value without it appearing in shell history. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo), rather than erroring immediately — the same fallback create uses.
ndcli variable org set ntp_server --value 10.0.0.1
ndcli variable org set ntp_server --description " Updated NTP server "
ndcli variable org set api_key --value-stdin < ./new-api-key.txt
Delete an organization-level variable.
ndcli variable org delete [variable] [flags]
Argument Required Description variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable org delete old_variable
List all variables defined for an Organizational Unit.
ndcli variable ou list [OU] [flags]
Argument Required Description OUYes Organizational Unit name
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable ou list production
Show details of a specific OU-level variable.
ndcli variable ou describe [OU] [variable]
Argument Required Description OUYes Organizational Unit name variableYes Variable name
ndcli variable ou describe production dns_server
Create a variable at the OU level.
ndcli variable ou create [OU] [name] [value] [flags]
Argument Required Description OUYes Organizational Unit name nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --value-stdinbool falseRead the value from stdin instead of the value argument. Use this for an override of a secret bind-password variable, or any other value that shouldn’t land in shell history. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable ou create production dns_server 10.10.0.53
ndcli variable ou create staging dns_server 10.20.0.53 --description " Staging DNS "
ndcli variable ou create production ldap_bind_password --value-stdin < ./bindpw.txt
Update an OU-level variable.
ndcli variable ou set [OU] [variable] [flags]
Argument Required Description OUYes Organizational Unit name variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo).
ndcli variable ou set production dns_server --value 10.10.1.53
ndcli variable ou set production ldap_bind_password --value-stdin < ./new-bindpw.txt
Delete an OU-level variable.
ndcli variable ou delete [OU] [variable] [flags]
Argument Required Description OUYes Organizational Unit name variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable ou delete production old_var
List all variables defined for a template.
ndcli variable template list [template] [flags]
Argument Required Description templateYes Template name
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable template list base-config
Show details of a specific template-level variable.
ndcli variable template describe [template] [variable]
Argument Required Description templateYes Template name variableYes Variable name
ndcli variable template describe base-config timezone
Create a variable at the template level.
ndcli variable template create [template] [name] [value] [flags]
Argument Required Description templateYes Template name nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --value-stdinbool falseRead the value from stdin instead of the value argument. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable template create base-config timezone UTC
ndcli variable template create base-config timezone " America/New_York " --description " Default timezone "
ndcli variable template create base-config ldap_bind_password --value-stdin < ./bindpw.txt
Update a template-level variable.
ndcli variable template set [template] [variable] [flags]
Argument Required Description templateYes Template name variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo).
ndcli variable template set base-config timezone --value " Europe/London "
ndcli variable template set base-config ldap_bind_password --value-stdin < ./new-bindpw.txt
Delete a template-level variable.
ndcli variable template delete [template] [variable] [flags]
Argument Required Description templateYes Template name variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable template delete base-config old_var
List all variables defined for a specific device.
ndcli variable device list [device] [flags]
Argument Required Description deviceYes Device name
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable device list my-firewall
Show details of a specific device-level variable.
ndcli variable device describe [device] [variable]
Argument Required Description deviceYes Device name variableYes Variable name
ndcli variable device describe my-firewall wan_ip
Create a variable at the device level.
ndcli variable device create [device] [name] [value] [flags]
Argument Required Description deviceYes Device name nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --value-stdinbool falseRead the value from stdin instead of the value argument. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable device create my-firewall wan_ip 203.0.113.1
ndcli variable device create my-firewall wan_ip 203.0.113.1 --description " WAN IP address "
ndcli variable device create my-firewall ldap_bind_password --value-stdin < ./bindpw.txt
Update a device-level variable.
ndcli variable device set [device] [variable] [flags]
Argument Required Description deviceYes Device name variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo).
ndcli variable device set my-firewall wan_ip --value 203.0.113.2
ndcli variable device set my-firewall ldap_bind_password --value-stdin < ./new-bindpw.txt
Delete a device-level variable.
ndcli variable device delete [device] [variable] [flags]
Argument Required Description deviceYes Device name variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable device delete my-firewall old_var