Skip to content
Weik.ioDocs
2026.2
Try Weik.io

Platform administration

Weik.io 2026.2

Change the installation's settings, certificates, platform secrets and telemetry forwarding, and search the installation.

On this page

These commands change the installation as a whole and need a platform administrator: its settings, the certificates of its hostnames, the platform’s own secrets and telemetry forwarding. Settings are one document, which weikio settings get prints and weikio settings set changes over the API.

The operations that run on a hub server and never go through the API, such as init, backup, restore and doctor, are verbs of the backend image and have their own page, weikio-backend.

Commands on this page#

Command What it does
weikio search Find projects, integrations, APIs and other things by name.
weikio platform breakglass Show the open break-glass window.
weikio platform secret set Set a platform secret from a hidden prompt, a pipe or --from-file.
weikio platform secret list List platform secrets, without values.
weikio platform secret delete Delete a platform secret.
weikio forwarding get Print the telemetry forwarding document as a file you can apply.
weikio forwarding status Show the forwarder’s revision, where each signal goes, and what each exporter sent and dropped in the last hour.
weikio forwarding delete Delete the telemetry forwarding document and stop forwarding telemetry and audit records.
weikio forwarding audit-from Choose the first audit record the forwarder sends.
weikio platform authority get Get the platform authority’s certificate and its SHA-256 fingerprint.
weikio get certificates List certificates.
weikio describe certificate Show a certificate with its proof, failed checks and last error.
weikio certificates renew Renew a certificate: a gateway hostname, a hub address, or with --client an API’s upstream client certificate.
weikio certificates dns add Add a DNS connection and test it.
weikio certificates dns set Change a DNS connection and test it again.
weikio certificates dns test Test a DNS connection.
weikio certificates dns remove Remove a DNS connection, after listing the certificates proved through it.
weikio certificates dns persist Print a DNS record that lets the platform order certificates for names under the zone without a DNS connection.
weikio certificates authority add Add a certificate authority.
weikio certificates authority set Change a certificate authority.
weikio certificates authority remove Remove a certificate authority.
weikio settings get Show the installation’s settings.
weikio settings set Change the installation’s settings.

The flags every command accepts, such as --env, --project, -o and --context, are on the CLI reference page and are left out of the tables below.

Find projects, integrations, APIs and other things by name. Two to a hundred characters, best match first.

Terminal
weikio search <text>
Argument or flag What it does
<text> Two to a hundred characters of the name to find.

Who can run it: any API key. You see what you may read.

API: GET /api/v1/search?q=.

weikio platform breakglass#

Show the open break-glass window. A break-glass window is opened on a hub server with weikio-backend breakglass enable, and this command shows the open window.

Terminal
weikio platform breakglass

Who can run it: a platform administrator.

API: GET /api/v1/break-glass.

weikio platform secret set#

Set a platform secret from a hidden prompt, a pipe or --from-file. The value comes from a hidden prompt, a pipe or --from-file, and is never printed again.

Terminal
weikio platform secret set <name> [--from-file PATH] [--reason S]
Argument or flag What it does
<name> The secret’s name.
--from-file <from-file> File to read the value from, instead of standard input.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: PUT /api/v1/platform/secrets/{name}.

weikio platform secret list#

List platform secrets, without values.

Terminal
weikio platform secret list

Who can run it: a platform administrator.

API: GET /api/v1/platform/secrets.

weikio platform secret delete#

Delete a platform secret.

Terminal
weikio platform secret delete <name> [--yes] [--reason S]
Argument or flag What it does
<name> The secret’s name.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: DELETE /api/v1/platform/secrets/{name}.

weikio forwarding get#

Print the telemetry forwarding document as a file you can apply.

Terminal
weikio forwarding get [--effective]
Argument or flag What it does
--effective Add the platform’s part of the collector configuration as comment lines.

Who can run it: a platform administrator.

API: GET /api/v1/forwarding[?effective=true].

Also written as weikio get forwarding.

weikio forwarding status#

Show the forwarder’s revision, where each signal goes, and what each exporter sent and dropped in the last hour. --lines adds the forwarder’s last log lines and --watch prints the status again every 5 seconds.

Terminal
weikio forwarding status [--watch] [--lines]
Argument or flag What it does
--watch Print the status again every 5 seconds until interrupted.
--lines Add each forwarder’s last log lines.

Who can run it: a platform administrator.

API: GET /api/v1/forwarding, GET /api/v1/forwarding/status.

weikio forwarding delete#

Delete the telemetry forwarding document and stop forwarding telemetry and audit records.

Terminal
weikio forwarding delete [--yes] [--reason S]
Argument or flag What it does
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: DELETE /api/v1/forwarding.

Also written as weikio delete forwarding.

weikio forwarding audit-from#

Choose the first audit record the forwarder sends. Use it to send the audit log from an earlier record, for example to a destination you just added.

Terminal
weikio forwarding audit-from <time|now> [--yes] [--reason S]
Argument or flag What it does
<time> The time to send audit records from, such as 2026-09-01 or 24h, or now to skip the records that wait.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: GET /api/v1/forwarding, POST /api/v1/forwarding/audit-from[?dryRun=true].

weikio platform authority get#

Get the platform authority’s certificate and its SHA-256 fingerprint.

Terminal
weikio platform authority get [--to FILE] [--format pem|der]
Argument or flag What it does
--to <file> File to write the certificate to, by default standard output for pem.
--format <format> Format: pem, or der for a .crt file Windows opens, by default pem.

Who can run it: any valid API key.

API: GET /api/v1/settings/install/authority.

weikio get certificates#

List certificates.

Terminal
weikio get certificates

Who can run it: a grant with read in the gateway’s environment for a gateway hostname, and a platform administrator for the rest.

API: GET /api/v1/certificates.

Also written as weikio get certificate.

weikio describe certificate#

Show a certificate with its proof, failed checks and last error.

Terminal
weikio describe certificate <name> [--env E]
Argument or flag What it does
<name> A hostname, project/api for a client certificate, or ‘platform authority’.

Who can run it: a grant with read in the gateway’s environment for a gateway hostname, and a platform administrator for the rest.

API: GET /api/v1/certificates.

Also written as weikio describe certificates.

weikio certificates renew#

Renew a certificate: a gateway hostname, a hub address, or with --client an API’s upstream client certificate. Renewal is automatic, so use it after you fix what made a renewal fail, or to replace a certificate early.

Terminal
weikio certificates renew <hostname>
Argument or flag What it does
<hostname> A gateway hostname or hub address.
--client <client> Renew an API’s upstream client certificate, as project/api, in the --env environment.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: GET /api/v1/certificates, POST /api/v1/gateways/{name}/certificates/renew?hostname=, POST /api/v1/settings/install/certificates/renew?hostname=, POST /api/v1/environments/{environment}/projects/{project}/apis/{api}/client-certificate/renew.

weikio certificates dns add#

Add a DNS connection and test it.

Terminal
weikio certificates dns add <name> --provider cloudflare|hetzner|azure|rfc2136 --zone Z [--zone Z ...] --secret S [--azure-tenant T --azure-client C --azure-object-id O --azure-subscription S --azure-resource-group G] [--server HOST[:PORT] --key-name K]
Argument or flag What it does
<name> The DNS connection.
--provider <provider> The zone’s DNS provider: cloudflare, hetzner, azure or rfc2136.
--zone <zone> A zone, such as example.com, repeated for each zone.
--secret <secret> The platform secret with the provider’s token or key. For azure, the secret with its sign-in key.
--azure-tenant <azure-tenant> The app registration’s directory (tenant) id.
--azure-client <azure-client> The app registration’s application (client) id.
--azure-object-id <azure-object-id> The app registration’s object id.
--azure-subscription <azure-subscription> The Azure subscription with the zone.
--azure-resource-group <azure-resource-group> The resource group with the zone.
--server <server> For rfc2136, the name server that accepts the zone’s updates, with an optional port.
--key-name <key-name> For rfc2136, the TSIG key name.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: GET /api/v1/settings/install/certificates/dns/{name}, PUT /api/v1/settings/install/certificates/dns/{name}.

weikio certificates dns set#

Change a DNS connection and test it again.

Terminal
weikio certificates dns set <name> [flags]
Argument or flag What it does
<name> The DNS connection.
--provider <provider> The zone’s DNS provider: cloudflare, hetzner, azure or rfc2136.
--zone <zone> A zone, such as example.com, repeated for each zone.
--secret <secret> The platform secret with the provider’s token or key. For azure, the secret with its sign-in key.
--azure-tenant <azure-tenant> The app registration’s directory (tenant) id.
--azure-client <azure-client> The app registration’s application (client) id.
--azure-object-id <azure-object-id> The app registration’s object id.
--azure-subscription <azure-subscription> The Azure subscription with the zone.
--azure-resource-group <azure-resource-group> The resource group with the zone.
--server <server> For rfc2136, the name server that accepts the zone’s updates, with an optional port.
--key-name <key-name> For rfc2136, the TSIG key name.
--reason <reason> Reason for the change, stored with the audit record.

weikio certificates dns test#

Test a DNS connection.

Terminal
weikio certificates dns test <name> [flags]
Argument or flag What it does
<name> The DNS connection.
--reason <reason> Reason for the change, stored with the audit record.

weikio certificates dns remove#

Remove a DNS connection, after listing the certificates proved through it.

Terminal
weikio certificates dns remove <name> [flags]
Argument or flag What it does
<name> The DNS connection.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

weikio certificates dns persist#

Print a DNS record that lets the platform order certificates for names under the zone without a DNS connection. Add the printed record to the zone once, and the platform can order certificates for every name under it from the public authority without a DNS connection.

Terminal
weikio certificates dns persist <zone>
Argument or flag What it does
<zone> The zone the record goes into, such as example.com.

Who can run it: a platform administrator.

API: GET /api/v1/settings/install.

weikio certificates authority add#

Add a certificate authority.

Terminal
weikio certificates authority add <name> --acme URL --names SUFFIX,... [--eab-key-id K --eab-secret S] [--trust ca.pem ...] [--orders backend|site] [--client-certificates]
Argument or flag What it does
<name> The certificate authority.
--acme <acme> The authority’s ACME directory URL.
--names <names> Name suffixes, such as corp.example, comma separated or repeated.
--eab-key-id <eab-key-id> Key id of the authority’s external account binding (EAB).
--eab-secret <eab-secret> The platform secret with the EAB key.
--trust <trust> PEM file with a CA certificate to trust, repeated for each file.
--orders <orders> Who orders from the authority: backend (the hub reaches it) or site (only the sites do).
--client-certificates Let the authority sign the client certificates APIM presents to upstreams.
--no-client-certificates Sign no client certificates.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

weikio certificates authority set#

Change a certificate authority.

Terminal
weikio certificates authority set <name> [flags]
Argument or flag What it does
<name> The certificate authority.
--acme <acme> The authority’s ACME directory URL.
--names <names> Name suffixes, such as corp.example, comma separated or repeated.
--eab-key-id <eab-key-id> Key id of the authority’s external account binding (EAB).
--eab-secret <eab-secret> The platform secret with the EAB key.
--trust <trust> PEM file with a CA certificate to trust, repeated for each file.
--orders <orders> Who orders from the authority: backend (the hub reaches it) or site (only the sites do).
--client-certificates Let the authority sign the client certificates APIM presents to upstreams.
--no-client-certificates Sign no client certificates.
--reason <reason> Reason for the change, stored with the audit record.

weikio certificates authority remove#

Remove a certificate authority.

Terminal
weikio certificates authority remove <name> [flags]
Argument or flag What it does
<name> The certificate authority.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

weikio settings get#

Show the installation’s settings.

Terminal
weikio settings get

Who can run it: a platform administrator.

API: GET /api/v1/settings/install, GET /api/v1/agents.

Also written as weikio get settings.

weikio settings set#

Change the installation’s settings. Fields you don’t set keep their values, and --dry-run shows the change without writing it.

Terminal
weikio settings set [--public-base-url URL] [--local-accounts enabled|breakGlassOnly] [--bundle-keep-versions N] [--bundle-max-age D|--no-bundle-max-age] [--default-camel-version V] [--hub-certificate NAME=CHAIN.pem,KEY.pem ...] [--remove-hub-certificate NAME ...] [--launch-property KEY=VALUE ...] [--launch-jvm-option FLAG ...] [--no-launch-defaults] [--backup-every INTERVAL] [--backup-keep N] [--backup-copy-to ADDRESS|--no-backup-copy] [--two-factor-required=true|false] [--allowed-networks RANGE,...|--no-allowed-networks] [--dry-run] [-y]
Argument or flag What it does
--public-base-url <public-base-url> The address the platform is reached at.
--local-accounts <local-accounts> Who can sign in with a local account: enabled or breakGlassOnly.
--bundle-keep-versions <bundle-keep-versions> How many built versions of each integration to keep.
--bundle-max-age <bundle-max-age> How long a built version is kept, such as 30d.
--no-bundle-max-age Remove the age limit on built versions.
--default-camel-version <default-camel-version> The Camel version for integrations that don’t set one.
--backup-every <backup-every> How often to take a backup archive, from 1h to 365d, such as 6h.
--backup-keep <backup-keep> How many backup archives to keep on the server.
--backup-copy-to <backup-copy-to> Where to copy each backup archive, such as s3://acme-backups/weikio.
--no-backup-copy Keep backup archives only on the server.
--two-factor-required Whether a platform administrator’s password sign-in needs a code from an authenticator app.
--allowed-networks <allowed-networks> The address ranges that can reach the hub addresses, comma separated, such as 203.0.113.7/32.
--no-allowed-networks Remove the allowed networks, so every address can reach the hub.
--hub-certificate <hub-certificate> A certificate for the hub addresses, as NAME=CHAIN.pem,KEY.pem, repeated for each certificate.
--remove-hub-certificate <remove-hub-certificate> The name of an uploaded hub certificate to remove, repeated for each certificate.
--launch-property <launch-property> A Camel setting every deployment starts with, as KEY=VALUE, such as camel.main.shutdownTimeout=90. Added to the installation’s list (a deployment’s own setting of it wins), repeated as needed.
--launch-jvm-option <launch-jvm-option> A Java option every deployment starts with, before its own options, such as -Xmx512m. The options given replace the installation’s list, repeated as needed.
--no-launch-defaults Remove the installation’s launch defaults. The --launch-property and --launch-jvm-option flags of the same command then start from none.
--dry-run Print what would happen and change nothing.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: PUT /api/v1/settings/install, GET /api/v1/agents, PUT|DELETE /api/v1/settings/install/certificates/hub-certificates/{certificate}.

Exit codes#

The commands on this page exit with the codes in the exit code table: 0 on success, 1 when the hub refuses a change, 2 for a usage error, 3 when the key is missing or not allowed, 4 when something isn’t found, 5 for a conflicting change, 6 when the hub can’t be reached and 8 when a document isn’t valid. weikio certificates dns persist exits 4 while the installation has no account at the public authority yet.

See also#