CLI Reference

The outpost CLI provides operational tooling for inspecting, validating, and managing a running Arbitex Outpost. Commands fall into two categories:

• Local commands read configuration and files from disk — no admin API or key required.
• Remote commands query the admin API on port 8301 and require an admin key.

All subcommands support a --json flag that emits machine-readable JSON instead of styled ANSI text.

---

Installation

The CLI ships with the arbitex-outpost Python package:

pip install arbitex-outpost

After installation, the outpost entry point is available on your PATH:

outpost --help

Or invoke the module directly:

python -m outpost.cli --help

---

Authentication

Remote commands communicate with the local admin API (port 8301) and require an admin key. Provide it via the --admin-key flag or the OUTPOST_EMERGENCY_ADMIN_KEY environment variable.

# Flag
outpost status --admin-key sk-admin-...

# Environment variable (preferred for scripting)
export OUTPOST_EMERGENCY_ADMIN_KEY=<sk-admin-...>
outpost status

Caution

The admin key grants full access to all admin API operations including the emergency kill switch and provider overrides. Use environment variables or a secrets manager — never pass it inline in logged scripts or store it in world-readable files.

---

Command tree

outpost
├── status              [--json] [--local] [--admin-port PORT] [--admin-key KEY]
├── validate-config     [--json] [--strict]
├── config
│   ├── validate        [--json] [--strict]
│   └── reload          [--json] [--admin-port PORT] [--admin-key KEY] [--dry-run]
├── policy-show         [--json]
├── benchmark-run       [--json] [--timeout SECS]
├── update
│   ├── check           [--json] [--admin-port PORT] [--admin-key KEY]
│   ├── apply           [--json] [--admin-port PORT] [--admin-key KEY]
│   └── verify          --bundle FILE [--sig FILE] [--signing-key KEY] [--json]
├── diagnostics         [--json] [--output-file FILE] [--no-redact]
├── health
│   └── export          [--output FILE] [--json]
├── audit
│   ├── export          [--format FMT] [--from DATE] [--to DATE] [--type TYPE]
│   │                   [--output FILE] [--verify] [--limit N] [--count]
│   │                   [--audit-path DIR] [--hmac-key KEY] [--json]
│   └── verify          [--audit-path DIR] [--hmac-key KEY] [--json]
├── certs
│   ├── status          [--json]
│   └── verify          [--json]
├── runbook             [--output FILE] [--json]
└── alerts
    ├── export          [--output FILE]
    └── test            [--json] [--admin-port PORT] [--admin-key KEY]

---

outpost status

Displays the current operational status of a running Outpost. By default, queries three admin API endpoints; with --local, reads from config and filesystem instead.

outpost status [--json] [--local] [--admin-port PORT] [--admin-key KEY]

Flag	Default	Description
--admin-port	8301	Admin API port to connect to
--admin-key	$OUTPOST_EMERGENCY_ADMIN_KEY	Admin API key (not required with --local)
--local	—	Read from config/filesystem without contacting the admin API
--json	—	Emit machine-readable JSON

Remote mode (default)

Queries GET /admin/api/status, GET /admin/api/sync-status, and GET /admin/api/audit-queue/status.

Human output

Outpost Status
--------------
Version:          0.19.2
Uptime:           3h 42m 15s
Degradation mode: No
Policy sync age:  45s ago

Circuit Breakers:
  policy_sync     CLOSED
  heartbeat       CLOSED
  audit_sync      CLOSED

Audit Queue:
  Depth:          0
  Disk usage:     0 B

JSON output

{
  "version": "0.19.2",
  "uptime_seconds": 13335,
  "degradation_mode": false,
  "policy_sync_age_seconds": 45,
  "circuit_breakers": {
    "policy_sync": "CLOSED",
    "heartbeat": "CLOSED",
    "audit_sync": "CLOSED"
  },
  "audit_queue_depth": 0,
  "disk_usage_bytes": 0
}

Local mode (--local)

Reads settings from the environment and inspects local files without requiring a running admin API. Useful for pre-flight checks and air-gap environments.

{
  "version": "0.19.2",
  "dlp_tiers": {
    "tier1_regex": true,
    "tier2_ner": true,
    "tier3_deberta": false,
    "tier4_credint": true
  },
  "geoip": {
    "city_db_loaded": true,
    "anon_db_loaded": false
  },
  "heartbeat_config": {
    "platform_management_url": "https://api.arbitex.ai",
    "outpost_id": "prod-outpost-01",
    "org_id": "org-uuid"
  },
  "config_validation_summary": {
    "passed": 4,
    "warned": 1,
    "failed": 0,
    "skipped": 1,
    "overall": "pass"
  },
  "policy_bundle_present": true
}

Error conditions

Error	Cause
Admin API authentication failed (HTTP 401)	Invalid or missing admin key
Cannot connect to admin API	Outpost not running, wrong port, or firewall blocking loopback

---

outpost validate-config

Loads OutpostSettings from the environment and runs the startup validation suite. Use this to verify configuration before starting the Outpost or after changing environment variables.

outpost validate-config [--json] [--strict]

Flag	Default	Description
--json	—	Emit JSON array of check results
--strict	—	Treat warnings as failures (exit 1 on any warn or fail)

This command reads from the local environment only — no admin API contact.

Human output

[PASS] mTLS certificates     Certificate files present and readable
[PASS] Policy cache path     /var/lib/arbitex/policy is writable
[WARN] GeoIP MMDB            GEOIP_MMDB_PATH not set — IP enrichment disabled
[SKIP] CredInt bloom filter  CREDINT_ENABLED=false — skipping

Result: 1 warning(s), 0 failure(s)

JSON output

[
  {
    "name": "mTLS certificates",
    "status": "pass",
    "message": "Certificate files present and readable"
  },
  {
    "name": "Policy cache path",
    "status": "pass",
    "message": "/var/lib/arbitex/policy is writable"
  },
  {
    "name": "GeoIP MMDB",
    "status": "warn",
    "message": "GEOIP_MMDB_PATH not set — IP enrichment disabled"
  },
  {
    "name": "CredInt bloom filter",
    "status": "skip",
    "message": "CREDINT_ENABLED=false — skipping"
  }
]

Check status values: "pass", "fail", "warn", "skip".

Exit codes

Code	Meaning
0	All checks passed or were skipped
1	One or more checks failed (or warnings in --strict mode)
2	Warnings but no failures (non-strict mode only)

---

outpost config validate

Alias for outpost validate-config. Same flags and behavior.

outpost config validate [--json] [--strict]

---

outpost config reload

Triggers a live configuration hot-reload via the admin API. Equivalent to sending SIGHUP to the Outpost process, but callable over HTTP. Returns the list of changed keys and any restart-required keys.

outpost config reload [--json] [--admin-port PORT] [--admin-key KEY] [--dry-run]

Flag	Default	Description
--admin-port	8301	Admin API port
--admin-key	$OUTPOST_EMERGENCY_ADMIN_KEY	Required
--dry-run	—	Compute diff and run validators without applying changes
--json	—	Emit machine-readable JSON

API called: POST /admin/api/config/reload (with ?dry_run=true when --dry-run is set).

Reload

Config Hot-Reload
=================
Status:               OK
Changed keys (1):
  log_level: 'info' → 'debug'

Dry run

Config Hot-Reload (DRY RUN)
===========================
Status:               OK
Dry run:              yes — no changes applied
Would change (1):
  log_level: 'info' → 'debug'

JSON

{
  "status": "ok",
  "changed_keys": ["log_level"],
  "restart_required_keys": [],
  "validation_errors": []
}

Reloadable settings

These settings take effect immediately without a restart:

Setting	Description
log_level	Log verbosity (debug, info, warning, error, critical)
dlp_enabled	Enable or disable the DLP pipeline
dlp_ner_enabled	Enable or disable NER-tier DLP scanning
dlp_deberta_enabled	Enable or disable DeBERTa-tier DLP scanning
credint_enabled	Enable or disable Credential Intelligence scanning
budget_enforcement_enabled	Enable or disable budget enforcement
debug	Enable or disable debug mode

Restart-required settings

These are detected during reload but not applied. A warning is logged and the old value continues in use:

Setting	Description
outpost_id	Outpost identifier
org_id	Organization identifier
platform_management_url	Platform management API URL
outpost_cert_path	mTLS client certificate path
outpost_key_path	mTLS private key path
outpost_ca_path	mTLS CA certificate path
admin_port	Admin API listen port
outpost_api_key	Outpost API key for incoming requests

Exit codes

Code	Meaning
0	Reload succeeded (or dry run completed)
1	Reload rejected (validation errors) or unexpected API response

---

outpost policy-show

Reads the cached policy bundle from disk and displays a summary. The bundle is read from {policy_cache_path}/policy_bundle.json.

outpost policy-show [--json]

This command reads from disk only — no admin API contact.

Human output

Policy Bundle
-------------
Version:         v2026.03.12-4
Rules:           47
Providers:       3
Active:          anthropic, openai, azure-openai
Bundle size:     142.3 KB
Last modified:   2026-03-12T08:52:00Z

JSON output

{
  "version": "v2026.03.12-4",
  "rules_count": 47,
  "providers_count": 3,
  "active_providers": ["anthropic", "openai", "azure-openai"],
  "bundle_size_bytes": 145715,
  "last_modified": "2026-03-12T08:52:00Z"
}

Error conditions

Error	Exit code	Cause
Policy bundle not found at {path}	1	File does not exist at the configured cache path
Policy bundle contains invalid JSON	1	File is corrupt or truncated

---

outpost benchmark-run

Runs the Outpost benchmark test suite using pytest. Useful for measuring DLP pipeline throughput and latency after configuration changes or hardware upgrades.

outpost benchmark-run [--json] [--timeout SECS]

Flag	Default	Description
--timeout	120	Maximum seconds to wait for benchmarks to complete
--json	—	Capture output and return as JSON instead of streaming

Without --json, pytest output streams directly to the terminal. With --json, output is captured and returned:

{
  "returncode": 0,
  "output": "============================= test session starts ====...\n12 passed in 18.43s"
}

If the benchmarks exceed the timeout, exit code is 1 with an error message (or {"returncode": 1, "output": "Benchmark timed out after 120s"} in JSON mode).

---

outpost update check

Checks for available software updates via the admin API.

outpost update check [--json] [--admin-port PORT] [--admin-key KEY]

Flag	Default	Description
--admin-port	8301	Admin API port
--admin-key	$OUTPOST_EMERGENCY_ADMIN_KEY	Required
--json	—	Emit machine-readable JSON

API called: POST /admin/updates/check

Human output

Software Update Check
=====================
Status:               available
Current version:      0.19.2
Latest version:       0.20.0

Update available: 0.19.2 -> 0.20.0
Run 'outpost update apply' to download and stage the update.

JSON output

{
  "status": "available",
  "current_version": "0.19.2",
  "latest_version": "0.20.0",
  "release_notes": "...",
  "error": null
}

Status values: "available", "idle", "staged".

Exit codes

Code	Meaning
0	Check succeeded
1	API returned an error

---

outpost update apply

Downloads, verifies (Ed25519 signature), and stages a software update. Does not restart the process — the operator must restart the container to apply.

outpost update apply [--json] [--admin-port PORT] [--admin-key KEY]

Flag	Default	Description
--admin-port	8301	Admin API port
--admin-key	$OUTPOST_EMERGENCY_ADMIN_KEY	Required
--json	—	Emit machine-readable JSON

API called: POST /admin/updates/download

Human output

Software Update Apply
=====================
Status:               staged
Staged version:       0.20.0
Signature verified:   Yes
Extracted path:       /var/lib/arbitex/stage/outpost-0.20.0

Update staged successfully.
Restart the outpost container to apply the update.

JSON output

{
  "status": "staged",
  "staged_version": "0.20.0",
  "extracted_path": "/var/lib/arbitex/stage/outpost-0.20.0",
  "signature_verified": true,
  "error": null
}

Exit codes

Code	Meaning
0	Update staged successfully
1	Signature verification failed or other error

---

outpost update verify

Verifies a bundle tarball offline without extracting or staging it. Performs Ed25519 signature verification and manifest.json checksum validation. No admin API contact — safe for air-gap environments.

outpost update verify --bundle FILE [--sig FILE] [--signing-key KEY] [--json]

Flag	Required	Default	Description
--bundle FILE	yes	—	Path to .tar.gz bundle
--sig FILE	no	<bundle>.sig (auto-detected)	Path to detached .sig file
--signing-key KEY	no	$SOFTWARE_UPDATE_ED25519_KEY	Base64-encoded Ed25519 public key
--json	no	—	Emit machine-readable JSON

Human output

Update Bundle Verification
==========================
Bundle:                   /opt/updates/outpost-0.20.0.tar.gz
Version:                  0.20.0
Method:                   ed25519
Signature verified:       Yes
Manifest verified:        Yes

Verification PASSED — bundle is valid.

JSON output

{
  "version": "0.20.0",
  "method": "ed25519",
  "signature_verified": true,
  "manifest_verified": true,
  "passed": true,
  "error": null
}

Exit codes

Code	Meaning
0	Verification passed
1	Bundle not found or verification failed

---

outpost diagnostics

Comprehensive offline diagnostic dump. Reads from config and filesystem — no admin API contact. Collects system info, config summary, DLP tier status, GeoIP database status, heartbeat config, connectivity check, config validation results, TLS certificate chain info, runtime metrics snapshot, and component health.

outpost diagnostics [--json] [--output-file FILE] [--no-redact]

Flag	Default	Description
--json	—	Emit structured JSON
--output-file FILE	—	Write JSON to file (in both human and JSON mode)
--no-redact	—	Include API keys and secrets without masking (default: redacted)

Caution

The --no-redact flag exposes API keys, HMAC keys, and other secrets. Only use it in secure environments and never commit the output to version control.

JSON output top-level keys

Key	Description
system	OS, Python version, hostname, CPU count, memory
config	Current OutpostSettings summary (redacted by default)
dlp_tiers	Boolean status for each DLP tier
geoip	GeoIP database load status and paths
heartbeat	Platform URL, outpost ID, org ID
connectivity	Platform reachability check result
config_validation	Full validation suite results
tls	Certificate chain info and expiry
metrics	Runtime metrics snapshot
health	Component health status

Exit codes

Code	Meaning
0	Diagnostics collected (always succeeds on content)
1	Import error or settings failure

---

outpost health export

Generates a portable JSON health report — a superset of diagnostics output with report_version and generated_at timestamp. Writes to file by default, or to stdout with --json.

outpost health export [--output FILE] [--json]

Flag	Default	Description
--output FILE / -o	outpost-health-report.json	Output file path
--json	—	Print to stdout instead of file

The report includes all data from outpost diagnostics plus:

{
  "report_version": "1.0",
  "generated_at": "2026-03-15T14:30:00Z",
  "system": { "..." },
  "config": { "..." },
  "dlp_tiers": { "..." },
  "...": "..."
}

Exit codes

Code	Meaning
0	Report written or printed
1	Failed to write output file

---

outpost audit export

Exports HMAC-chained audit trail entries from the local JSONL buffer. Supports date range filtering, event type filtering (with glob wildcards), count limiting, and count-only mode.

outpost audit export [--format FMT] [--from DATE] [--to DATE] [--type TYPE]
                     [--output FILE] [--verify] [--limit N] [--count]
                     [--audit-path DIR] [--hmac-key KEY] [--json]

Flag	Default	Description
--format / -f	json	Output format: json, csv, jsonl
--from DATE	—	Lower bound date filter (ISO 8601, inclusive)
--since DATE	—	Alias for --from
--to DATE	—	Upper bound date filter (ISO 8601, inclusive)
--until DATE	—	Alias for --to
--type TYPE	—	Event type filter; supports glob (e.g. dlp.*, 6003)
--output FILE / -o	stdout	Output file path
--verify	—	Run HMAC chain verification before export; adds chain_valid to output
--limit N	—	Limit to first N matching entries
--count	—	Print only the count of matching entries (no export data)
--audit-path DIR	$AUDIT_BUFFER_PATH or audit_buffer	Audit buffer directory
--hmac-key KEY	$AUDIT_HMAC_KEY	HMAC key matching the running outpost (required)
--json	—	Emit summary metadata JSON instead of streaming entries

Examples

Export last 24 hours of DLP events as CSV:

outpost audit export \
  --from "2026-03-14T00:00:00Z" \
  --type "dlp.*" \
  --format csv \
  --output /tmp/dlp-events.csv \
  --hmac-key "$AUDIT_HMAC_KEY"

Count audit entries with chain verification:

outpost audit export --count --verify --hmac-key "$AUDIT_HMAC_KEY"

JSON summary output (with --json)

{
  "count": 142,
  "total_read": 150,
  "skipped_malformed": 0,
  "format": "json",
  "output_path": "/tmp/audit.json",
  "chain_valid": true
}

Exit codes

Code	Meaning
0	Export succeeded
1	Invalid arguments, I/O error, or missing HMAC key

---

outpost audit verify

Re-computes the HMAC for every entry in the audit JSONL and verifies the chain is intact. Reports chain validity, total entries, and first break position.

outpost audit verify [--audit-path DIR] [--hmac-key KEY] [--json]

Flag	Default	Description
--audit-path DIR	$AUDIT_BUFFER_PATH or audit_buffer	Audit buffer directory
--hmac-key KEY	$AUDIT_HMAC_KEY	HMAC key (required)
--json	—	Emit machine-readable JSON

Human output

Audit Chain Verification
========================
Status:               VALID
Total entries:        1402

JSON output

{
  "valid": true,
  "total_entries": 1402,
  "first_break_at": null,
  "errors": []
}

Exit codes

Code	Meaning
0	Chain is valid
1	Chain is broken or verification failed

---

outpost certs status

Reads the mTLS certificate and CA files from the configured paths, reports subject, issuer, expiry, days remaining, and warning level. Fully offline.

outpost certs status [--json]

Warning thresholds

Days remaining	Level
> 30	— (no warning)
15–30	INFO
8–14	WARNING
2–7	WARNING
0–1	CRITICAL
expired	CRITICAL

Human output

Certificate Status
==================
[OK]       mtls    /certs/outpost.pem   CN=outpost-prod-1   expires 2026-12-01 (261 days)
[OK]       ca      /certs/ca.pem        CN=Arbitex CA        expires 2027-06-01 (443 days)

JSON output

[
  {
    "cert_type": "mtls",
    "path": "/certs/outpost.pem",
    "subject": "CN=outpost-prod-1",
    "issuer": "CN=Arbitex Intermediate CA",
    "not_before": "2025-01-01T00:00:00+00:00",
    "not_after": "2026-01-01T00:00:00+00:00",
    "serial_number": "4a3f...",
    "days_remaining": 290,
    "is_expired": false,
    "warning_level": null
  }
]

Exit codes

Code	Meaning
0	All certificates valid
1	Any certificate is critical or expired

---

outpost certs verify

Verifies the mTLS certificate chain (leaf to CA): checks issuer/subject match and validity windows. This is a structural check — use openssl verify for full cryptographic PKI validation.

outpost certs verify [--json]

Valid chain

{
  "valid": true,
  "chain_length": 2,
  "errors": [],
  "details": [
    {
      "cert": "leaf",
      "path": "/certs/outpost.pem",
      "subject": "CN=outpost-prod-1",
      "issuer": "CN=Arbitex CA"
    },
    {
      "cert": "ca",
      "path": "/certs/ca.pem",
      "subject": "CN=Arbitex CA",
      "issuer": "CN=Arbitex CA"
    }
  ],
  "leaf_path": "/certs/outpost.pem",
  "ca_path": "/certs/ca.pem"
}

Broken chain

{
  "valid": false,
  "chain_length": 2,
  "errors": ["Leaf issuer 'CN=Unknown CA' does not match CA subject 'CN=Arbitex CA'"],
  "details": ["..."]
}

Exit codes

Code	Meaning
0	Chain valid
1	Chain invalid

---

outpost runbook

Generates a Markdown operations runbook from current configuration. Covers config summary, certificates, circuit breakers, DLP pipeline, heartbeat settings, and disk usage.

outpost runbook [--output FILE] [--json]

Flag	Default	Description
--output FILE / -o	stdout	Output file path
--json	—	Emit structured JSON instead of Markdown

This command reads from the local environment only — no admin API contact.

# Generate runbook for ops team
outpost runbook -o /docs/outpost-runbook.md

# Pipe into a documentation system
outpost runbook | confluence-upload --page "Outpost Runbook"

Exit code is always 0 unless there is an import error.

---

outpost alerts export

Writes the default Prometheus/Alertmanager alert rules YAML template to stdout or a file. Covers DLP latency, circuit breaker state, config reload failures, heartbeat staleness, certificate expiry, and disk usage.

outpost alerts export [--output FILE]

Flag	Default	Description
--output FILE / -o	stdout	Output file path

# Export alert rules to Prometheus config directory
outpost alerts export -o /etc/prometheus/rules/outpost.yml

Note

This command does not support --json — it outputs YAML alert rules directly.

Exit codes

Code	Meaning
0	Rules written or printed
1	Template file not found

---

outpost alerts test

Fetches live Prometheus metrics from the running Outpost’s /metrics endpoint and evaluates each default alert rule against current values. Reports which alerts are firing, OK, or have no data.

outpost alerts test [--json] [--admin-port PORT] [--admin-key KEY]

Flag	Default	Description
--admin-port	8301	Admin API port
--admin-key	$OUTPOST_EMERGENCY_ADMIN_KEY	Required
--json	—	Emit JSON array

Human output

Alert Rule Evaluation
=====================
[OK]      OutpostDLPLatencyHigh         0.042s (threshold: 0.5s)
[OK]      OutpostCircuitBreakerOpen     0 open (threshold: 1)
[FIRING]  OutpostCertExpirySoon         12 days (threshold: 14 days)
[OK]      OutpostHeartbeatStale         45s (threshold: 300s)
[OK]      OutpostDiskUsageHigh          23% (threshold: 80%)

JSON output

[
  {
    "alert_name": "OutpostDLPLatencyHigh",
    "status": "ok",
    "description": "DLP pipeline p99 latency exceeds threshold",
    "current_value": 0.042,
    "threshold": 0.5,
    "labels": {}
  },
  {
    "alert_name": "OutpostCertExpirySoon",
    "status": "firing",
    "description": "mTLS certificate expires within 14 days",
    "current_value": 12,
    "threshold": 14,
    "labels": {}
  }
]

Exit codes

Code	Meaning
0	No alerts firing
1	One or more alerts firing, or connection error

---

Graceful shutdown (SIGTERM)

The Outpost handles SIGTERM (and SIGINT / Ctrl+C) through the FastAPI lifespan context manager. The shutdown sequence avoids data loss and notifies the platform.

Shutdown sequence

1. Final heartbeat — sent to the platform with shutting_down: true so it routes traffic away immediately.
2. Audit buffer flush — all buffered audit events are flushed, bounded by SHUTDOWN_TIMEOUT (default 30s).
3. Background task cancellation — tasks cancelled in order: audit sync, cert rotation, heartbeat, SIEM DLQ retry, SIEM direct sink, CredInt CDN refresh, policy sync, metrics update, prompt hold expiry.
4. DLP pipeline resources released.
5. Shutdown complete — final log with elapsed time.

# SIGTERM (standard — used by Docker, Kubernetes, systemd)
kill -TERM $(pgrep -f "outpost")

# SIGINT (Ctrl+C — same handler)
kill -INT $(pgrep -f "outpost")

Tip

Set Kubernetes terminationGracePeriodSeconds or Docker stop timeout to at least SHUTDOWN_TIMEOUT + 10 seconds to give the audit flush time to complete.

---

Config hot-reload (SIGHUP)

Sending SIGHUP to the Outpost process triggers a config hot-reload without restarting. Alternatively, use outpost config reload via the admin API.

kill -HUP $(pgrep -f "outpost")

See outpost config reload for the list of reloadable and restart-required settings.

Note

SIGHUP is not available on Windows. Use a process restart or outpost config reload on Windows.

---

Exit code reference

Command	0	1	2
status	Success	Connection/auth error	—
validate-config	All pass/skip	Any fail (or warn in strict)	Warnings, no failures
config reload	Reload ok	Rejected/error	—
policy-show	Bundle read	Bundle missing/invalid	—
benchmark-run	pytest pass	pytest fail or timeout	—
update check	Success	API error	—
update apply	Staged	Verify failed/error	—
update verify	Passed	Not found/failed	—
diagnostics	Success	Import error	—
health export	Success	Write error	—
audit export	Success	Bad args/I/O/missing key	—
audit verify	Chain valid	Chain broken	—
certs status	All OK	Critical/expired	—
certs verify	Chain valid	Chain invalid	—
runbook	Success	Import error	—
alerts export	Success	Template not found	—
alerts test	No alerts firing	Alerts firing/error	—

---

Monitoring integration

Use --json output with jq for lightweight monitoring scripts.

Check circuit breakers

outpost status --json | jq '
  .circuit_breakers | to_entries |
  map(select(.value != "CLOSED")) |
  if length > 0 then
    "ALERT: open circuit breakers: \([.[].key] | join(", "))"
  else
    "OK: all circuit breakers closed"
  end
'

Alert on policy sync staleness

outpost status --json | jq '
  if .policy_sync_age_seconds > 300 then
    "WARN: policy sync age \(.policy_sync_age_seconds)s exceeds 5m"
  else
    "OK: policy sync age \(.policy_sync_age_seconds)s"
  end
'

Validate config in CI

outpost validate-config --strict --json | jq '
  map(select(.status == "fail")) |
  if length > 0 then
    error("config failures: \([.[].name] | join(", "))")
  else
    "Config validation passed"
  end
'

Nagios/Icinga plugin

#!/bin/bash
set -euo pipefail

STATUS=$(outpost status --json 2>/dev/null) || {
  echo "CRITICAL: Cannot connect to outpost admin API"
  exit 2
}

OPEN=$(echo "$STATUS" | jq '[.circuit_breakers | to_entries[] | select(.value == "OPEN")] | length')
DEGRADE=$(echo "$STATUS" | jq '.degradation_mode')
SYNC_AGE=$(echo "$STATUS" | jq '.policy_sync_age_seconds')

if [ "$OPEN" -gt 0 ] || [ "$DEGRADE" = "true" ]; then
  echo "CRITICAL: circuit_breakers_open=$OPEN degradation=$DEGRADE sync_age=${SYNC_AGE}s"
  exit 2
elif [ "$SYNC_AGE" -gt 300 ]; then
  echo "WARNING: policy sync age ${SYNC_AGE}s"
  exit 1
else
  echo "OK: outpost healthy sync_age=${SYNC_AGE}s"
  exit 0
fi

---

See also

• Outpost Admin API reference — full HTTP API that remote CLI commands query
• Configuration Reference — every environment variable for Platform, Cloud, and Outpost
• Deployment Guide — Docker Compose, Kubernetes, and environment setup
• Outpost Architecture — port layout, admin network isolation, and background tasks
• DLP Pipeline Reference — DLP tier configuration affected by hot-reload settings