# CLI

> openwaf-cloud ctl manages zones, DNS records, edge settings, rules and certificates from the command line, with simulation and confirmation on every change.

`openwaf-cloud ctl` is OpenWAF's command-line client. It talks only to the public API with an API token, so it has exactly the permissions of that token and goes through the same validation, versioning and audit log as the dashboard. It is built for scripted, repeatable operations: every change takes a reason, is simulated first and shows its diff, and can wait until every edge node has applied it.

```sh
export OPENWAF_API_URL=https://dash.openwaf.dev
export OPENWAF_TOKEN_FILE=~/.config/openwaf/token
openwaf-cloud ctl zones list
openwaf-cloud ctl zones set example.com waf_level=high --reason "Raise WAF level" --wait
```

- [Get started](https://developers.openwaf.dev/cli/get-started/): get the CLI, give it a token and run your first command.
- [Changes: simulation and confirmation](https://developers.openwaf.dev/cli/changes/): `--reason`, `--dry-run`, `--yes` and `--wait`.
- [Arguments, output and exit codes](https://developers.openwaf.dev/cli/output-and-exit-codes/): `key=value` arguments, `--json` and what each exit code means.
- [Environment and global options](https://developers.openwaf.dev/cli/reference/options/): `OPENWAF_API_URL`, `OPENWAF_TOKEN`, `OPENWAF_TOKEN_FILE`, `OPENWAF_ORG`.
- [zones](https://developers.openwaf.dev/cli/reference/zones/): add, inspect, configure, merge, revert and delete zones.
- [records](https://developers.openwaf.dev/cli/reference/records/): DNS records, including BIND imports.


## Commands

| Command family | What it covers |
|---|---|
| [`zones`](https://developers.openwaf.dev/cli/reference/zones/) | Zones, their edge settings, history, diffs, reverts, propagation and merges. |
| [`records`](https://developers.openwaf.dev/cli/reference/records/) | DNS records. |
| [`rules`](https://developers.openwaf.dev/cli/reference/rules/) | Edge rules: IP, country, WAF exceptions and simple rate limits. |
| [`ratelimit`](https://developers.openwaf.dev/cli/reference/ratelimit/) | Per-path rate limiting rules of a zone or a name. |
| [`certs`](https://developers.openwaf.dev/cli/reference/certs/) | Edge certificates and the certificate status of each site. |
| [`origin-certs` and `origin-tls`](https://developers.openwaf.dev/cli/reference/origin-certs/) | Origin certificates from the OpenWAF Origin CA and TLS to the origin. |
| [`cache`](https://developers.openwaf.dev/cli/reference/cache/) | Cache purges. |
| [`ai`](https://developers.openwaf.dev/cli/reference/ai/) | AI agents and crawlers, MCP Shield, the AI bot catalog and agent readiness. |
| [`rum`](https://developers.openwaf.dev/cli/reference/rum/) | Real user monitoring (Core Web Vitals). |
| [`dns`](https://developers.openwaf.dev/cli/reference/dns/) | What the edge DNS answers for a delegated zone. |
| [`audit`](https://developers.openwaf.dev/cli/reference/audit/) | The organisation's audit log. |
| [`clients`](https://developers.openwaf.dev/cli/reference/clients/) | An agency's end clients. |
| [`brand`](https://developers.openwaf.dev/cli/reference/brand/) | The organisation's brand. |
| [`whitelabel`](https://developers.openwaf.dev/cli/reference/whitelabel/) | Your own dashboard domain and name servers. |

> **Note: Messages in Spanish**
>
> The CLI prints its help, tables and messages in Spanish. Commands, options, keys and the JSON of `--json` are the same whatever your language, and this reference translates every message you need.