Variable management commands for NDCLI. Variables are key-value pairs that can be defined at different scopes and referenced in snippets and templates using a ${variable_name} syntax.
Command alias: var. Along with net for network, this is one of only two command aliases in NDCLI.
Variables are resolved from the most specific scope to the most general:
Scope Description deviceApplies to a single device ouApplies to all devices in an Organizational Unit templateApplies to all devices using a template orgApplies to all devices in the organization
When the same variable name is defined at multiple scopes, the most specific scope wins.
Each value records whether a Superuser saved it. A snippet that grants administrator rights only reaches a device when the values it uses were saved by a Superuser — see Variables that need a Superuser . To record that on an existing value, a Superuser signed in with ndcli auth login runs set at the same scope with the current value:
ndcli variable org set backup_role --value operators
ndcli variable ou set production backup_role --value operators
ndcli variable org set svc_backup_password --value-stdin < ./svc-backup-password.txt
A secret’s value can’t be read back, so pass it again with --value-stdin. A set with only --description doesn’t record it, and a value saved under NDCLI_TOKEN never counts as a Superuser’s.
The interactive prompt reads a single line. A value that spans lines, such as a PEM certificate or the private key of a certificate snippet , has to come in through --value-stdin, at every scope:
ndcli variable org create fw_wildcard_key --secret --value-stdin < ./fw-wildcard.key
ndcli variable device set fw-hq-01 fw_key --value-stdin < ./fw-hq-01.key
Show all variables with their definitions across all scopes. Useful for understanding which variables are defined and where they come from.
ndcli variable overview [flags]
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable overview --name " dns.* "
ndcli var overview -f json
List all variables defined at the organization level.
ndcli variable org list [flags]
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable org list --name " ntp.* "
Show details of a specific organization-level variable.
ndcli variable org describe [variable]
Argument Required Description variableYes Variable name
ndcli variable org describe ntp_server
Create a new organization-level variable.
ndcli variable org create [name] [value] [flags]
Argument Required Description nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --secretbool falseMark as secret — use for passwords, API keys, and pre-shared keys referenced from snippet content; value is redacted in API responses and can never be read back, only replaced --value-stdinbool falseRead the value from stdin instead of the value argument. Use this for secrets — a value passed as an argument lands in shell history and is visible to other users on the host via ps. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable org create ntp_server 192.168.1.1
ndcli variable org create ntp_server 192.168.1.1 --description " Primary NTP server "
ndcli variable org create api_key --secret --value-stdin < ./api-key.txt
Update an existing organization-level variable.
ndcli variable org set [variable] [flags]
Argument Required Description variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Use this to rotate a secret’s value without it appearing in shell history. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo), rather than erroring immediately — the same fallback create uses.
ndcli variable org set ntp_server --value 10.0.0.1
ndcli variable org set ntp_server --description " Updated NTP server "
ndcli variable org set api_key --value-stdin < ./new-api-key.txt
Delete an organization-level variable.
ndcli variable org delete [variable] [flags]
Argument Required Description variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable org delete old_variable
List all variables defined for an Organizational Unit.
ndcli variable ou list [OU] [flags]
Argument Required Description OUYes Organizational Unit name
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable ou list production
Show details of a specific OU-level variable.
ndcli variable ou describe [OU] [variable]
Argument Required Description OUYes Organizational Unit name variableYes Variable name
ndcli variable ou describe production dns_server
Create a variable at the OU level.
ndcli variable ou create [OU] [name] [value] [flags]
Argument Required Description OUYes Organizational Unit name nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --value-stdinbool falseRead the value from stdin instead of the value argument. Use this for an override of a secret bind-password variable, or any other value that shouldn’t land in shell history. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable ou create production dns_server 10.10.0.53
ndcli variable ou create staging dns_server 10.20.0.53 --description " Staging DNS "
ndcli variable ou create production ldap_bind_password --value-stdin < ./bindpw.txt
Update an OU-level variable.
ndcli variable ou set [OU] [variable] [flags]
Argument Required Description OUYes Organizational Unit name variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo).
ndcli variable ou set production dns_server --value 10.10.1.53
ndcli variable ou set production ldap_bind_password --value-stdin < ./new-bindpw.txt
Delete an OU-level variable.
ndcli variable ou delete [OU] [variable] [flags]
Argument Required Description OUYes Organizational Unit name variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable ou delete production old_var
List all variables defined for a template.
ndcli variable template list [template] [flags]
Argument Required Description templateYes Template name
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable template list base-config
Show details of a specific template-level variable.
ndcli variable template describe [template] [variable]
Argument Required Description templateYes Template name variableYes Variable name
ndcli variable template describe base-config timezone
Create a variable at the template level.
ndcli variable template create [template] [name] [value] [flags]
Argument Required Description templateYes Template name nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --value-stdinbool falseRead the value from stdin instead of the value argument. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable template create base-config timezone UTC
ndcli variable template create base-config timezone " America/New_York " --description " Default timezone "
ndcli variable template create base-config ldap_bind_password --value-stdin < ./bindpw.txt
Update a template-level variable.
ndcli variable template set [template] [variable] [flags]
Argument Required Description templateYes Template name variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo).
ndcli variable template set base-config timezone --value " Europe/London "
ndcli variable template set base-config ldap_bind_password --value-stdin < ./new-bindpw.txt
Delete a template-level variable.
ndcli variable template delete [template] [variable] [flags]
Argument Required Description templateYes Template name variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable template delete base-config old_var
List all variables defined for a specific device.
ndcli variable device list [device] [flags]
Argument Required Description deviceYes Device name
Flag Type Default Description --namestring Filter by name pattern (regex) --pageint 1Page number --per-pageint 50Items per page
ndcli variable device list my-firewall
Show details of a specific device-level variable.
ndcli variable device describe [device] [variable]
Argument Required Description deviceYes Device name variableYes Variable name
ndcli variable device describe my-firewall wan_ip
Create a variable at the device level.
ndcli variable device create [device] [name] [value] [flags]
Argument Required Description deviceYes Device name nameYes Variable name valueNo Variable value. Omit it — along with --value-stdin — to be prompted interactively instead; input is not echoed.
Flag Type Default Description --descriptionstring Human-readable description --value-stdinbool falseRead the value from stdin instead of the value argument. Exactly one trailing newline is trimmed. Cannot be combined with a positional value argument.
ndcli variable device create my-firewall wan_ip 203.0.113.1
ndcli variable device create my-firewall wan_ip 203.0.113.1 --description " WAN IP address "
ndcli variable device create my-firewall ldap_bind_password --value-stdin < ./bindpw.txt
Update a device-level variable.
ndcli variable device set [device] [variable] [flags]
Argument Required Description deviceYes Device name variableYes Variable name
Flag Type Default Description --valuestring New value --value-stdinbool falseRead the new value from stdin instead of --value. Exactly one trailing newline is trimmed. Mutually exclusive with --value. --descriptionstring New description
Passing none of --value, --value-stdin, or --description prompts interactively for a new value on a terminal (no echo).
ndcli variable device set my-firewall wan_ip --value 203.0.113.2
ndcli variable device set my-firewall ldap_bind_password --value-stdin < ./new-bindpw.txt
Delete a device-level variable.
ndcli variable device delete [device] [variable] [flags]
Argument Required Description deviceYes Device name variableYes Variable name
Flag Type Default Description -y, --yesbool falseSkip confirmation prompt
ndcli variable device delete my-firewall old_var