Skip to main content
Reference
Every helix command, grouped the same way as helix --help. Scope shows whether a command works with local instances, Helix Cloud, or both. Cloud commands authenticate only with the WorkOS session created by helix auth login. They never accept or store application database keys or service credentials.

​
Getting started

​
Instances and queries

​
Helix Cloud

​
CLI utilities

​
Global options

These flags work with every command.

​
Output

  • stdout carries only the command’s result: tables, detail views, query results, one-time tokens, or the --json payload. It is always safe to pipe.
  • stderr carries everything else: progress sessions, spinners, warnings, hints, and errors.
  • Destructive Cloud commands (project delete, database delete, database key revoke, service-credential revoke) ask for confirmation in a terminal. Without one, or with --json, they fail before any request unless you pass -y/--yes. They never act on an “only candidate” they were not told about: the target must be named, linked in helix.toml, or picked in a terminal.
  • Commands whose output is a live terminal session have no JSON result and refuse --json: chef, start --foreground, local logs, and skills install / skills list.
With --json, a failed command prints one JSON object on stderr and exits with status 1, or 2 for invalid arguments. Only message is always present:

​
Cloud resource resolution

Cloud commands never require raw IDs. Workspace, project, cluster, and database arguments are optional and accept an ID, slug, or display name, matched in that order (names are case-insensitive). Databases also accept tenant:<id> and cluster:<id>. Application keys and service credentials are passed by ID or name. An omitted resource resolves to:
  1. the project or databases linked in helix.toml;
  2. the only candidate, announced on stderr (for example Using project <name>);
  3. an interactive picker, in a terminal and without --json;
  4. otherwise, an error that lists the candidates and how to pass one.
A name you pass that matches more than one resource is always an error listing the matches, even in a terminal; pickers only fill in arguments you left out. A resource passed by ID or as tenant:<id> / cluster:<id> must belong to any --project / --workspace you also pass, so helix database delete tenant:<id> --project <other> fails instead of acting outside that project. --json output is the server’s JSON, field for field. Where the human view shows a resolved owner (for example the workspace of a project found in a listing), --json does not add it. There is no global or persisted workspace or project selection. A group run without a subcommand lists its resources, so helix project is the same as helix project list. Lists follow API pagination.

​
Removed and unsupported commands

push, sync, config, auth create-key, workspace switch, and project update are not commands. compile, check, and deploy were removed; running them prints a pointer to the current workflow. --format and --compact were replaced by --json; the inline request body of helix query and helix api is now --body. --workspace-id, --project-id, and --cluster-id were replaced by the resolution above, and helix logs --range by plain --start/--end. Cloud resource lifecycle is exposed only where documented above.