CLI

List Environments

cred ls environment

Get Environment Details

cred get environment <environmentName>

Create Environment

cred add environment <environmentName> [--readmeFile <path>] [--replication <count>] [-y]

Options:

• --readmeFile <path>: Path to README file to include
• --replication <count>: Replication count for the environment's packages (must be at least 1)

Update Environment

cred update environment <environmentName> [--replication <count>] [--git-modeling <true|false>] [--git-repository-owner <owner> --git-repository-name <name> --git-base-branch <branch>] [-y]

Options:

• --replication <count>: Replication count for the environment's packages
• --git-modeling <true|false>: Enroll (or un-enroll) the environment for git-backed modeling drafts
• --git-repository-owner, --git-repository-name, --git-base-branch: The repository drafts commit to. All three or none; pass "" to all three to unset

Delete Environment

cred rm environment <environmentName> [-y]

Set Default Environment

cred set environment <environmentName>

List Packages

cred ls package

Get Package Details

Show which version is latest, its indexing status, and whether new versions become latest automatically:

cred get package <packageName>

Delete Package

cred rm package <packageName> [-y]

Update Package

cred update package <packageName> [options]

Options:

• --version <versionId>: Set which version is latest/pinned
• --description <text>: Update package description
• --replication <count>: Set replication count (must be at least 1)

Publish New Version

Run from your package directory:

cred publish [--dry-run] [--set-latest] [--replication <count>] [--json] [-y]

Options:

• --dry-run: List the files that would be uploaded and the ones left out, and upload nothing. Doesn't need you to be signed in
• --set-latest: Make this version latest right away, before its indexes and materialized tables are built. Without it, a package that promotes automatically (the default) makes the version latest once they are built
• --replication <count>: The number of replicas to create. Ignored in CLI 0.0.104 and earlier; set it with cred update package instead
• --json: Print one JSON document: the version's link, whether it became latest, and the files left out

The command names the organization and environment it is publishing to before it uploads. When it finishes, it prints a link to the version and says whether it is latest now or will become latest once built.

publisher.json must have a name and a version. A version can't be replaced: to publish again, raise version. The package can be at most 50 MiB, and the CLI checks this before uploading.

The upload leaves out credentials and local setup, and the command lists what it left out:

• publisher.config.json, .env files, keys and certificates (*.pem, *.key, SSH keys), and other common credential files
• .git/, node_modules/, and the files cred init writes (.credible/, .mcp.json, CLAUDE.md, AGENTS.md, .claude/, .agents/, .cursor/)

To leave out more, add a .credignore file beside publisher.json, with one path or glob per line:

# Lines starting with # are comments
notes.md
tests/
/docs

notes.md and tests/ match at any depth; /docs matches only at the top of the package. Matching ignores case. A ! line can't bring back a file the CLI leaves out. Only the .credignore at the top of the package is read, and it isn't uploaded. Run cred publish --dry-run to check the result.

List Package Versions

cred ls version <packageName>

Get Version Details

Show whether a version has finished building, how far its indexing has got, and whether it is waiting to become latest:

cred get version <packageName> <versionId>

buildStatus is BUILDING while the version is being built. It ends as READY, FAILED, or UNSUPPORTED (the version's persisted sources use a database that can't be materialized, such as DuckDB, so they are queried live).

Archive Version

cred archive <packageName> <versionId> [-y]

Unarchive Version

cred unarchive <packageName> <versionId> [-y]

List Connections

cred ls connection

Create Connection

cred add connection <connectionFileName> [--include-tables <tables>] [--exclude-tables <tables>] [--skip-indexing] [-y]

Options:

• --include-tables <tables>: Comma-separated list of tables to index for AI-assisted modeling, as {dataset/schema}.{table} (use * for all tables in a schema, e.g., sales.*,finance.orders)
• --exclude-tables <tables>: Comma-separated list of tables to exclude from indexing (same format); mutually exclusive with --include-tables
• --skip-indexing: Disable automatic indexing for this connection; cannot be combined with the table flags

The connectionFileName should be a JSON file containing an array of connection objects. The connection name is a field within the JSON, not a command-line argument.

Command Syntax:

cred add connection <connectionFileName>

JSON File Structure:

Each connection has:

• name: The connection name (required)
• type: Connection type (postgres, bigquery, snowflake, trino, databricks, mysql, duckdb, motherduck, ducklake)
• Connection-specific configuration based on type

BigQuery Example:

[
  {
    "name": "my-bigquery-connection",
    "type": "bigquery",
    "bigqueryConnection": {
      "defaultProjectId": "my-project",
      "billingProjectId": "billing-project",
      "location": "us-central1",
      "serviceAccountKeyJson": "{\"type\":\"service_account\",\"project_id\":\"...\"}",
      "maximumBytesBilled": "1000000",
      "queryTimeoutMilliseconds": "30000"
    }
  }
]

Note: For BigQuery, the serviceAccountKeyJson field contains the entire JSON content as a string (not a file path).

PostgreSQL Example:

[
  {
    "name": "my-postgres-connection",
    "type": "postgres",
    "postgresConnection": {
      "host": "localhost",
      "port": 5432,
      "databaseName": "mydb",
      "userName": "myuser",
      "password": "mypassword"
    }
  }
]

Alternatively, you can use a connection string:

[
  {
    "name": "my-postgres-connection",
    "type": "postgres",
    "postgresConnection": {
      "connectionString": "postgresql://user:password@localhost:5432/mydb"
    }
  }
]

Snowflake Example:

[
  {
    "name": "my-snowflake-connection",
    "type": "snowflake",
    "snowflakeConnection": {
      "account": "myaccount.us-east-1",
      "username": "myuser",
      "password": "mypassword",
      "warehouse": "COMPUTE_WH",
      "database": "MYDB",
      "schema": "PUBLIC",
      "responseTimeoutMilliseconds": 60000
    }
  }
]

Databricks Example (Personal Access Token):

[
  {
    "name": "my-databricks-connection",
    "type": "databricks",
    "databricksConnection": {
      "host": "dbc-xxxxxxxx-xxxx.cloud.databricks.com",
      "path": "/sql/1.0/warehouses/abcdef1234567890",
      "token": "dapiXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
      "defaultCatalog": "main",
      "defaultSchema": "default"
    }
  }
]

Alternatively, authenticate with an OAuth M2M service principal:

[
  {
    "name": "my-databricks-connection",
    "type": "databricks",
    "databricksConnection": {
      "host": "dbc-xxxxxxxx-xxxx.cloud.databricks.com",
      "path": "/sql/1.0/warehouses/abcdef1234567890",
      "oauthClientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "oauthClientSecret": "doseXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
      "defaultCatalog": "main",
      "defaultSchema": "default"
    }
  }
]

See the Databricks connection reference for details on creating a SQL warehouse and credentials.

cred add connection refuses a name the environment already has. To change an existing connection, use cred update connection.

Update Connection

Change some fields of existing connections, for example to rotate a password or key:

cred update connection <connectionFileName> [-y]

The file has the same shape as for cred add connection. Each entry names a connection and holds only the fields that change; everything else is kept, including inside nested objects. For example, to change only a Snowflake password:

[
  {
    "name": "my-snowflake-connection",
    "snowflakeConnection": { "password": "new-password" }
  }
]

For each connection, the command names the fields it will change and asks before sending them; -y skips the question. It exits with code 1 if any entry fails.

Delete Connection

cred rm connection <connectionName> [-y]

List Groups

cred ls group

Get Group Details

cred get group <groupName>

Create Group

cred add group <groupName> [-d <description>] [-y]

Options:

• -d, --description: Description for the group
• -y, --yes: Skip confirmation

Delete Group

cred rm group <groupName> [-y]

Create Group Access Token

cred add group-access-token <groupName> <tokenName> [-e <expiresAt>] [-j]

Arguments:

• <groupName>: The name of the group
• <tokenName>: Name for the API key/token

Options:

• -e, --expires-at <expiresAt>: Token expiration date in ISO 8601 format (e.g., 2027-12-31T23:59:59Z); defaults to no practical expiration
• -j, --json-output: Output only JSON, for use in scripts

Example:

cred add group-access-token ai-agents-group production-token

The command prints the API key once. Requests made with it act with the group's permissions.

List Group Access Tokens

cred ls group-access-token <groupName>

Delete Group Access Token

cred rm group-access-token <groupName> <tokenName> [-y]

Add Member to Group

cred add member <groupName> <memberType> <memberName> <role>

Arguments:

• <groupName>: The name of the group
• <memberType>: Type of member (user or group)
• <memberName>: Name of the user or group to add
• <role>: Member role (admin or member)

Examples:

# Add a user as admin
cred add member engineering-team user john.doe@example.com admin

# Add a nested group as member
cred add member engineering-team group data-analysts member

Remove Member from Group

cred rm member <groupName> <memberType> <memberName>

Arguments:

• <groupName>: The name of the group
• <memberType>: Type of member (user or group)
• <memberName>: Name of the user or group to remove

Example:

cred rm member engineering-team user john.doe@example.com

Grant a Permission

cred add permission <userGroupId> <role> [--environment <environmentName>] [--package <packageName>] [--notifyPeople] [-y]

Arguments:

• <userGroupId>: Who to grant it to — user:{email}, group:{groupName}, or user:* for public access
• <role>: The role to grant. Valid roles depend on the scope — organization: admin, modeler, member; environment: admin, modeler, viewer; package: viewer

Options:

• --environment <environmentName>: Grant on this environment instead of the organization
• --package <packageName>: Grant on this package; uses --environment, or the current environment
• --notifyPeople: Email the person about the new access (environment and package grants)
• -y, --yes: Skip confirmation

With no scope option the grant applies to the organization. Creating environments requires the organization admin role.

Examples:

# Organization role, so the group's access tokens can create environments
cred add permission group:ci-bot admin

# Environment role
cred add permission group:data-analysts modeler --environment analytics

# Package role
cred add permission user:john.doe@example.com viewer --environment analytics --package sales

List Permissions

cred ls permissions [--environment <environmentName>] [--package <packageName>]

Get a Permission

cred get permission <userGroupId> [--environment <environmentName>] [--package <packageName>]

Revoke a Permission

cred rm permission <userGroupId> [--environment <environmentName>] [--package <packageName>] [-y]

The scope options identify which grant to revoke: with none, the organization grant is removed and any environment or package grants stay in place.

These commands monitor and manage the materialized tables and search indexes the Credible service builds for a published package version.

List Materializations

List the materializations of a package version, with status and any failure reason:

cred ls materialization <packageName> <versionId>

Get Materialization Details

Status, physical table and connection, serving build, and freshness/staleness:

cred get materialization <packageName> <versionId> <materializationId>

List Indexes

List the dimensional search indexes of a package version, with status, any failure reason, and freshness:

cred ls index <packageName> <versionId>

Get Index Details

Status, row count, last indexed time, and freshness/staleness:

cred get index <packageName> <versionId> <indexId>

List Runs

List a package's build/refresh runs, most recent first. Runs are package-scoped and cover both materialized sources and dimensional indexes:

cred ls run <packageName> [versionId] [--source <sourceName>] [--dimension <dimension>]

Options:

• [versionId]: Filter to the runs a specific version initiated (e.g., 0.1.21); omit to list every run in the package
• --source <sourceName>: Only list runs targeting this persisted source
• --dimension <dimension>: Only list runs targeting this indexed dimension

Get Run Details

Includes the run's build-plan graph — per-unit state, physical table names, and row counts:

cred get run <packageName> <runId>

Trigger a Run

Trigger an on-demand rebuild/refresh for a package version. Defaults to a full run (all sources and indexes):

cred rerun <packageName> <versionId> [--source <sourceName>] [--dimension <dimension>] [-y]

Options:

• --source <sourceName>: Scope the run to a single persisted source
• --dimension <dimension>: Scope the run to a single indexed dimension
• --model-file <modelFilePath>: Disambiguate a source/dimension defined in more than one model file
• --include-upstream: Also force-rebuild the target's upstream persisted dependencies (only meaningful with --source/--dimension)

Cancel a Run

Cancel an in-flight run:

cred cancel-run <packageName> <runId> [-y]