CLI Reference

On this page

The craig command-line interface provides full access to all CRAIG service APIs. It is modeled after the OpenStack CLI: every operation available in the REST API or Web UI is also available from the command line.

The CLI requires a running CRAIG deployment (devstack or production) to connect to. See the project overview for setup instructions.

Building

# Build the CLI binary
cargo build -p craig-cli

# The binary is at target/debug/craig (or target/release/craig with --release)
# Optionally install it to ~/.cargo/bin/
cargo install --path services/craig-cli

Configuration

The CLI uses profile-based configuration stored in ~/.config/craig/profiles.toml. On first run, a default profile is auto-created with devstack URLs:

[default]
oidc_internal_url = "http://localhost:8180"
keycloak_realm = "craig"
keycloak_client_id = "craig-api"
rules_url = "http://localhost:8001"
cases_url = "http://localhost:8002"
placement_url = "http://localhost:8003"
exchange_url = "http://localhost:8004"
financial_url = "http://localhost:8005"
reporting_url = "http://localhost:8006"
security_url = "http://localhost:8007"
intake_url = "http://localhost:8008"

All URL fields are required; there are no serde defaults. If you add a new field to the profile schema (e.g., when another service is introduced), every profile must include it or the CLI will fail to load.

Multiple Profiles

Add additional profiles for different environments:

[default]
oidc_internal_url = "http://localhost:8180"
keycloak_realm = "craig"
keycloak_client_id = "craig-api"
rules_url = "http://localhost:8001"
cases_url = "http://localhost:8002"
placement_url = "http://localhost:8003"
exchange_url = "http://localhost:8004"
financial_url = "http://localhost:8005"
reporting_url = "http://localhost:8006"
security_url = "http://localhost:8007"
intake_url = "http://localhost:8008"

[staging]
oidc_internal_url = "https://auth.staging.example.com"
keycloak_realm = "craig"
keycloak_client_id = "craig-api"
rules_url = "https://rules.staging.example.com"
cases_url = "https://cases.staging.example.com"
placement_url = "https://placement.staging.example.com"
exchange_url = "https://exchange.staging.example.com"
financial_url = "https://financial.staging.example.com"
reporting_url = "https://reporting.staging.example.com"
security_url = "https://security.staging.example.com"
intake_url = "https://intake.staging.example.com"

Select a profile with --profile or the CRAIG_PROFILE environment variable:

craig --profile staging rules list
# or
export CRAIG_PROFILE=staging
craig rules list

Authentication

All commands except login, token, and completion require authentication. The CLI uses Keycloak’s Resource Owner Password Credentials (ROPC) grant.

# Interactive (prompts for username and password, no echo)
craig login

# Non-interactive — pipe the password to stdin (never a literal --password;
# a value on the command line is visible in `ps` and shell history)
printf '%s' "$CRAIG_PASSWORD" | craig login --username admin --password -

# Non-interactive — or read it from the CRAIG_PASSWORD environment variable
CRAIG_PASSWORD=secret craig login --username admin
A literal --password <value> still works but the CLI prints a warning: the value is visible in ps, /proc/<pid>/cmdline, and shell history. Prefer --password - (stdin) or the interactive prompt, which avoid process-visible exposure entirely; CRAIG_PASSWORD is better than argv but is still readable via /proc/<pid>/environ by the same user.

Tokens are cached per profile at ~/.config/craig/tokens/<profile>.json and automatically checked for expiry (with a 30-second buffer) on each command. If a token is expired or missing, the CLI exits with a message to re-run craig login.

Token cache permissions

The cached access token is a live credential (it carries the full role set against every service until expiry), so the CLI keeps the cache owner-only (#770):

  • Unix: the token file is created 0600 (no world-readable window, even transiently) and tokens/ is created 0700; a looser pre-existing cache or directory from an older CLI is tightened in place on the next craig login.

  • Windows / non-POSIX: there are no POSIX mode bits; the config root resolves to the per-user profile area (%APPDATA%-style), which the OS ACL-protects per user. That per-user ACL is the platform posture — no additional CLI-side control is applied.

To inspect the cached token:

craig token show

Global Options

Option Description

--profile <name>

Configuration profile to use (default: default). Can also be set via CRAIG_PROFILE env var.

--format <format>

Output format: table (default) or json.

--help

Print help for any command or subcommand.

--version

Print the CLI version.

Output Formats

Table (default)

List commands display columnar tables. Detail commands (get, create) display vertical key-value tables.

$ craig rules list
╭──────────────────────────────────────┬────────────────────────┬─────────────┬────────┬──────────────────────╮
│ id                                   │ name                   │ description │ active │ created_at           │
├──────────────────────────────────────┼────────────────────────┼─────────────┼────────┼──────────────────────┤
│ 01942a3b-1234-7000-8000-000000000001 │ georgia-safety         │ ...         │ true   │ 2025-03-15T14:30:00Z │
╰──────────────────────────────────────┴────────────────────────┴─────────────┴────────┴──────────────────────╯

JSON

Raw API response, pretty-printed. Useful for scripting and piping to jq.

craig --format json rules list
craig --format json case get <id> | jq '.county'

Input Handling

All create and update commands use named --flag arguments, just like the OpenStack CLI. Required fields must be provided; optional fields can be omitted.

craig person create --first-name Jane --last-name Doe --dob 1990-05-15 --gender female
craig case update <id> --status closed --closure-reason "goals met"

Complex JSON fields

Some fields accept structured JSON (e.g., --content, --threats, --findings, --auth-config). These support three input modes:

# Inline JSON
craig rules create --name my-rule --version 1.0.0 --content '{"nodes": [], "edges": []}'

# File input (@ prefix)
craig rules create --name my-rule --version 1.0.0 --content @ruleset.json

# Stdin (-)
cat ruleset.json | craig rules create --name my-rule --version 1.0.0 --content -

Command Reference

login

Authenticate with Keycloak and cache the token.

craig login
printf '%s' "$CRAIG_PASSWORD" | craig login --username admin --password -
CRAIG_PASSWORD=secret craig login --username admin

token

craig token show    # Display cached token info (username, expiry, profile)

rules

Manage rule sets and evaluate rules against the Rules Engine service.

craig rules list [--page N] [--per-page N]
craig rules get <id>
craig rules create --name TEXT --version TEXT --content JSON [--description TEXT]
craig rules update <id> [--name TEXT] [--version TEXT] [--content JSON] [--description TEXT]
craig rules delete <id>
craig rules import <id> --file PATH       # Import JDM content into a rule set
craig rules export <id>                    # Export rule set as JDM JSON
craig rules evaluate <name> --input JSON   # Evaluate input against a named rule set

Examples:

# List all rule sets
craig rules list

# Create a rule set from a JDM file
craig rules create --name georgia-safety-assessment --version 1.0.0 --content @rulesets/georgia/safety-assessment.json

# Import a JDM decision graph
craig rules import <id> --file rulesets/georgia/safety-assessment.json

# Evaluate a safety assessment
craig rules evaluate georgia-safety-assessment --input @safety-context.json

# Export a rule set for backup or transfer
craig --format json rules export <id> > backup.json

person

Search and manage person records in the Case Management service.

craig person search [--name TEXT] [--dob YYYY-MM-DD] [--ssn NNNN] [--page N] [--per-page N]
craig person get <id>
craig person create --first-name TEXT --last-name TEXT [--dob DATE] [--gender TEXT] [--race TEXT] [--ethnicity TEXT] [--ssn NNNN] [--icwa-eligible] [--tribal-affiliation TEXT]
craig person update <id> [--first-name TEXT] [--last-name TEXT] [--dob DATE] [--gender TEXT] [--icwa-eligible true|false] ...

Examples:

# Search by name
craig person search --name smith

# Create a person
craig person create --first-name Jane --last-name Doe --dob 1990-05-15 --gender female

# Update a person
craig person update <id> --last-name Smith --icwa-eligible true

referral

Manage referrals and allegations.

craig referral list [--admin-unit TEXT] [--page N] [--per-page N]
craig referral get <id>
craig referral create --reporter-type TEXT --admin-unit TEXT --priority TEXT [--reporter-name TEXT] [--reporter-phone TEXT] [--screened-in] [--icwa-flag]
craig referral allegation <referral-id> --victim-id ID --abuse-type TEXT [--perpetrator-id ID] [--description TEXT]

Examples:

# List referrals for a county
craig referral list --admin-unit Fulton

# Create a referral
craig referral create --reporter-type mandatory --admin-unit Fulton --priority 24-hour

# Add an allegation
craig referral allegation <referral-id> --victim-id <person-id> --abuse-type neglect --description "Child found unsupervised"

investigation

Manage investigations and submit safety assessments.

craig investigation list [--worker TEXT] [--status TEXT] [--page N] [--per-page N]
craig investigation get <id>
craig investigation create --referral-id ID --assigned-worker TEXT --assignment-area TEXT --response-due-at TIMESTAMP
craig investigation update <id> [--status TEXT] [--disposition TEXT] [--first-contact-at TIMESTAMP]
craig investigation safety-assessment <id> --threats JSON --protective-capacities JSON [--worker-override TEXT] [--worker-override-reason TEXT]

Examples:

# List open investigations
craig investigation list --status open

# Create an investigation
craig investigation create --referral-id <id> --assigned-worker jsmith --assignment-area Fulton --response-due-at 2025-03-20T17:00:00Z

# Submit a safety assessment (threats/capacities accept @file)
craig investigation safety-assessment <id> --threats @threats.json --protective-capacities @capacities.json

case

Manage cases, household members, contacts, and court orders.

craig case list [--admin-unit TEXT] [--worker TEXT] [--status TEXT] [--page N] [--per-page N]
craig case get <id>
craig case create --admin-unit TEXT --assigned-worker TEXT [--investigation-id ID] [--supervisor TEXT] [--icwa-flag]
craig case update <id> [--status TEXT] [--stage TEXT] [--assigned-worker TEXT] [--icwa-flag true|false] [--closure-reason TEXT]
craig case household <id>
craig case add-household <id> --person-id ID --role TEXT [--primary-caregiver]
craig case contacts <id> [--page N] [--per-page N]
craig case add-contact <id> --contact-type TEXT --contact-with TEXT --occurred-at TIMESTAMP [--duration-minutes N] [--narrative TEXT]
craig case court-orders <id> [--page N] [--per-page N]
craig case add-court-order <id> --order-type TEXT --order-date DATE [--court-name TEXT] [--judge TEXT] [--findings JSON]

Examples:

# List open cases in Fulton county
craig case list --admin-unit Fulton --status open

# Create a case from a substantiated investigation
craig case create --admin-unit Fulton --assigned-worker jsmith --investigation-id <id>

# Add a household member
craig case add-household <case-id> --person-id <id> --role mother --primary-caregiver

# Record a contact
craig case add-contact <case-id> --contact-type home_visit --contact-with "Jane Doe" --occurred-at 2025-03-15T14:00:00Z

plan

Manage case plans, approval workflow, and tasks.

craig plan list <case-id> [--page N] [--per-page N]
craig plan create <case-id> --permanency-goal TEXT [--strengths TEXT] [--needs TEXT] [--review-due-at TIMESTAMP]
craig plan update <plan-id> [--permanency-goal TEXT] [--status TEXT] [--strengths TEXT] [--needs TEXT]
craig plan approve <plan-id>
craig plan add-task <plan-id> --description TEXT --responsible TEXT [--due-at TIMESTAMP]
craig plan update-task <task-id> [--status TEXT] [--completed-at TIMESTAMP]

Examples:

# Create a case plan
craig plan create <case-id> --permanency-goal reunification --strengths "Strong family support"

# Add a task to a plan
craig plan add-task <plan-id> --description "Complete parenting classes" --responsible parent --due-at 2025-06-15T00:00:00Z

# Approve a plan (requires supervisor role)
craig plan approve <plan-id>

home

Manage foster homes and training records in the Placement service.

craig home list [--admin-unit TEXT] [--status TEXT] [--license-type TEXT] [--capacity BOOL] [--page N] [--per-page N]
craig home get <id>
craig home create --name TEXT --address TEXT --admin-unit TEXT --license-type TEXT --max-capacity N [--phone TEXT] [--accepts-sibling-groups] [--icwa-compliant] ...
craig home update <id> [--name TEXT] [--license-status TEXT] [--max-capacity N] [--accepts-sibling-groups true|false] ...
craig home training <id> --training-type TEXT --completed-at DATE --hours N [--expires-at DATE] [--verified-by TEXT]

Examples:

# List foster homes with available capacity in Fulton county
craig home list --admin-unit Fulton --capacity true

# Create a foster home
craig home create --name "Smith Family Home" --address "123 Main St" --admin-unit Fulton --license-type foster --max-capacity 4 --accepts-sibling-groups

# Record training completion
craig home training <home-id> --training-type CPR --completed-at 2025-03-10 --hours 4

placement

Manage placements, history, and matching.

craig placement list [--case-id ID] [--child-id ID] [--home-id ID] [--status TEXT] [--page N] [--per-page N]
craig placement get <id>
craig placement create --case-id ID --child-id ID --placement-type TEXT --started-at TIMESTAMP [--foster-home-id ID] [--status TEXT] ...
craig placement update <id> [--status TEXT] [--ended-at TIMESTAMP] [--end-reason TEXT] [--ctw-finding true|false] [--reasonable-efforts true|false] ...
craig placement history <child-id>
craig placement match --child-id <id> [--child-age N] [--icwa] [--siblings N] [--page N] [--per-page N]

Examples:

# Find matching foster homes for a child
craig placement match --child-id <id> --child-age 8

# Find ICWA-compliant placements
craig placement match --child-id <id> --icwa

# View placement history for a child
craig placement history <child-id>

kinship

Manage kinship evaluations.

craig kinship list --case-id <id>
craig kinship create --case-id ID --child-id ID --relative-name TEXT --relationship TEXT [--evaluated] [--approved true|false]

Examples:

# List kinship options for a case
craig kinship list --case-id <id>

# Record a kinship evaluation
craig kinship create --case-id <id> --child-id <id> --relative-name "Mary Johnson" --relationship grandmother --evaluated --approved true

exchange

Manage exchange partners and transactions in the Data Exchange service.

craig exchange list-partners [--partner-type TEXT] [--active BOOL] [--page N] [--per-page N]
craig exchange create-partner --partner-name TEXT --partner-type TEXT --direction TEXT [--endpoint-url TEXT] [--auth-type TEXT] [--auth-config JSON] [--exchange-format TEXT]
craig exchange update-partner <id> [--partner-name TEXT] [--active true|false] [--auth-config JSON] ...
craig exchange test-partner <id>
craig exchange send --partner-id ID --exchange-type TEXT [--payload JSON] [--record-count N]
craig exchange list-transactions [--partner-id ID] [--status TEXT] [--direction TEXT] [--page N] [--per-page N]
craig exchange get-transaction <id>
craig exchange retry-transaction <id>

Examples:

# List active exchange partners
craig exchange list-partners --active true

# Create a partner
craig exchange create-partner --partner-name "GA DFCS" --partner-type cwca --direction bidirectional

# Test connectivity to a partner
craig exchange test-partner <id>

# Send an outbound data exchange
craig exchange send --partner-id <id> --exchange-type case_data --payload @payload.json

# List failed transactions
craig exchange list-transactions --status failed

agreement

Manage data sharing agreements.

craig agreement list [--partner-id ID] [--status TEXT] [--page N] [--per-page N]
craig agreement create --partner-id ID --agreement-title TEXT --effective-date DATE [--expiration-date DATE] [--data-elements JSON] [--legal-authority TEXT]
craig agreement update <id> [--status TEXT] [--agreement-title TEXT] [--expiration-date DATE] [--approved-by TEXT]

Examples:

# List active agreements
craig agreement list --status active

# Create a data sharing agreement
craig agreement create --partner-id <id> --agreement-title "GA-FL Data Exchange" --effective-date 2025-01-01

# Activate an agreement
craig agreement update <id> --status active

icpc

Manage ICPC (Interstate Compact on the Placement of Children) requests, home studies, and attachments.

craig icpc list [--direction TEXT] [--status TEXT] [--overdue BOOL] [--page N] [--per-page N]
craig icpc create --case-id ID --child-id ID --direction TEXT --sending-state XX --receiving-state XX --request-type TEXT
craig icpc get <id>
craig icpc update <id> --status TEXT
craig icpc home-study <id> [--home-safety pass|fail|pending] [--background-checks pass|fail|pending] [--coordinator-decision TEXT] ...
craig icpc get-home-study <id>
craig icpc attach <id> --attachment-type TEXT --file PATH
craig icpc list-attachments <id>

Examples:

# List outbound ICPC requests
craig icpc list --direction outbound

# List overdue requests
craig icpc list --overdue true

# Create an ICPC request
craig icpc create --case-id <id> --child-id <id> --direction outbound --sending-state GA --receiving-state FL --request-type foster_care

# Submit a home study assessment
craig icpc home-study <id> --home-safety pass --background-checks pass --coordinator-decision approve

# Attach a document
craig icpc attach <id> --attachment-type court_order --file ./order.pdf

financial

Manage payments, rate tables, and claims in the Financial service.

craig financial list-payments [--case-id ID] [--status TEXT] [--ive-eligible BOOL] [--page N] [--per-page N]
craig financial get-payment <id>
craig financial calculate-payment --case-id ID --child-id ID --placement-id ID --foster-home-id ID --payment-type TEXT --period-start DATE --period-end DATE
craig financial approve-payment <id>
craig financial issue-payment <id>
craig financial clear-payment <id>
craig financial list-rates [--jurisdiction TEXT] [--payment-type TEXT] [--page N] [--per-page N]
craig financial create-rate --jurisdiction TEXT --payment-type TEXT --age-min N --age-max N --daily-rate TEXT --effective-date DATE [--end-date DATE]

Examples:

# List pending payments
craig financial list-payments --status pending

# Approve a payment (supervisor+ only)
craig financial approve-payment <id>

# Record disbursement, then reconciliation clearance (supervisor+ only)
craig financial issue-payment <id>
craig financial clear-payment <id>

# Create a rate table entry (admin only)
craig financial create-rate --jurisdiction georgia --payment-type foster_care_maintenance --age-min 0 --age-max 5 --daily-rate 18.00 --effective-date 2026-01-01

# Calculate a payment preview
craig financial calculate-payment --case-id <id> --child-id <id> --placement-id <id> --foster-home-id <id> --payment-type foster_care_maintenance --period-start 2026-03-01 --period-end 2026-03-31

adjustment

Manage payment adjustments.

craig adjustment create --payment-id ID --reason TEXT --amount TEXT
craig adjustment approve <id>

Examples:

# Create a payment adjustment
craig adjustment create --payment-id <id> --reason "Clothing allowance" --amount 125.00

# Approve an adjustment (supervisor+ only)
craig adjustment approve <id>

claim

Manage federal fiscal claiming records.

craig claim list [--status TEXT] [--claiming-period TEXT] [--page N] [--per-page N]
craig claim get <id>
craig claim generate --claiming-period TEXT --payment-type TEXT
craig claim submit <id>

Examples:

# List all claiming records
craig claim list

# Generate a claim for a quarter
craig claim generate --claiming-period "2026-Q1" --payment-type foster_care_maintenance

# Submit a claim for federal reimbursement (admin only)
craig claim submit <id>

reporting

Data quality monitoring and federal reporting (AFCARS/NCANDS).

craig reporting quality-dashboard
craig reporting list-issues [--source-service TEXT] [--issue-type TEXT] [--severity TEXT] [--resolved BOOL] [--page N] [--per-page N]
craig reporting resolve-issue <id>
craig reporting generate-afcars --reporting-period TEXT
craig reporting list-afcars [--status TEXT] [--page N] [--per-page N]
craig reporting get-afcars <id>
craig reporting approve-afcars <id>
craig reporting transmit-afcars <id>
craig reporting generate-ncands --reporting-year N
craig reporting list-ncands [--status TEXT] [--page N] [--per-page N]
craig reporting approve-ncands <id>
craig reporting transmit-ncands <id>

Examples:

# View the data quality dashboard (supervisor+ only)
craig reporting quality-dashboard

# List unresolved critical issues
craig reporting list-issues --severity critical --resolved false

# Resolve a data quality issue
craig reporting resolve-issue <id>

# Generate an AFCARS submission for a quarter (admin only)
craig reporting generate-afcars --reporting-period "2026-Q1"

# Approve and transmit an AFCARS submission
craig reporting approve-afcars <id>
craig reporting transmit-afcars <id>

# Generate and submit NCANDS for a fiscal year
craig reporting generate-ncands --reporting-year 2025
craig reporting approve-ncands <id>
craig reporting transmit-ncands <id>

security

Audit log, security reviews, and compliance management in the Security service.

craig security audit [--user-id ID] [--service TEXT] [--action TEXT] [--resource-type TEXT] [--resource-id ID] [--from TIMESTAMP] [--to TIMESTAMP] [--page N] [--per-page N]
craig security audit-by-user <user-id>
craig security audit-by-resource <resource-type> <resource-id>
craig security list-reviews [--review-type TEXT] [--status TEXT] [--page N] [--per-page N]
craig security create-review --review-type TEXT --scheduled-date DATE --reviewer TEXT
craig security update-review <id> --status TEXT [--completed-date DATE]
Subcommand Description

audit

Query the audit log with optional filters (user, service, action, resource, time range).

audit-by-user

Get all audit entries for a specific user.

audit-by-resource

Get audit entries for a specific resource (by type and ID).

list-reviews

List security reviews, optionally filtered by type or status.

create-review

Create a new security review (biennial, incident, or ad_hoc).

update-review

Update a security review’s status and optionally set the completion date.

Examples:

# Query audit log for a specific user
craig security audit --user-id <id>

# Query audit entries for a time range
craig security audit --from 2026-01-01T00:00:00Z --to 2026-03-01T00:00:00Z

# View all audit activity for a case
craig security audit-by-resource case <case-id>

# List overdue security reviews
craig security list-reviews --status overdue

# Schedule a biennial security review
craig security create-review --review-type biennial --scheduled-date 2026-06-01 --reviewer "Jane Doe"

# Mark a review as completed
craig security update-review <id> --status completed --completed-date 2026-06-15

archive

The archive-then-prune surface of craig-security (#1129 / ADR-058). run and purge are DESTRUCTIVE and prompt for confirmation unless --yes; both refuse with a typed 403 naming the consent knob when the deployment has not enabled the archiver (CRAIG_SECURITYRETENTION_ARCHIVEENABLED).

craig archive list [--source-service TEXT] [--page N] [--per-page N]
craig archive run [--yes]
craig archive purge [--limit N] [--yes]
Subcommand Description

list

List archive-ledger records (one row per archived batch: object keys, sha256, id/time range, retention state).

run

Run ONE bounded archive pass: audit-class rows past the hot window are copied to the object store and then DELETED from the hot tables. The response reports per-table counts and more — re-run until more is false. Attributed to the calling operator in every ledger row.

purge

PERMANENTLY destroy expired archives (data + manifest objects) whose DFCS-named retention date has passed with no legal hold — until DFCS names a schedule every row has retention_until = NULL and purge refuses it. Bounded per call (--limit, 1..=100); re-run while more is true.

Examples:

# List all archive-ledger records
craig archive list

# List archives from the rules service (fleet bookkeeping rows)
craig archive list --source-service craig-rules

# Run one bounded archive pass (admin only; deletes hot rows after archiving)
craig archive run

# Destroy up to 25 expired archives without prompting (scripted use)
craig archive purge --limit 25 --yes

nist

NIST SP 800-53 security control mapping and compliance tracking in the Security service.

craig nist list [--control-family TEXT] [--implementation-status TEXT] [--page N] [--per-page N]
craig nist update <control-id> --status TEXT [--notes TEXT] [--last-assessed DATE] [--assessed-by TEXT]
Subcommand Description

list

List NIST SP 800-53 controls, optionally filtered by control family or implementation status.

update

Update a NIST control’s implementation status, notes, and assessment metadata.

Examples:

# List all NIST controls
craig nist list

# List controls in the Access Control (AC) family
craig nist list --control-family AC

# List controls that are only partially implemented
craig nist list --implementation-status partial

# Mark a control as fully implemented
craig nist update AC-2 --status implemented --last-assessed 2026-03-01 --assessed-by "Jane Doe"

# Update a control with implementation notes
craig nist update AU-3 --status partial --notes "Audit logging implemented for cases and placements; financial service pending"

intake

Public-intake lifecycle commands (Phase 12). Covers listing screened reports, viewing a report by confirmation code, converting a screened-in report into a formal referral, and managing partner API keys + signer keys (for JWS-signed partner submissions).

# List reports awaiting screening
craig intake list --status pending

# Show one report by confirmation code
craig intake show RPT-20260420-A7E2

# Convert a screened-in report into a referral
craig intake convert RPT-20260420-A7E2 --admin-unit Fulton --priority 24_hour

# Partner API key management
craig intake keys list
craig intake keys create --partner-name "Hospital Consortium" --contact-email ops@example.com

Subcommands: list, show, convert, screen-out, keys list|create|revoke, signer-keys list|approve|revoke. See craig intake --help for the full tree.

alerts / detection / changes (Security)

Phase 8 breach-detection and security-change-monitoring commands.

# List open security alerts
craig alerts list --status open

# Acknowledge an alert
craig alerts ack <alert-id> --notes "False positive — rule tuning underway"

# List and trigger detection rules
craig detection list
craig detection run

# Major-changes monitoring (7 CFR § 272.15 equivalent)
craig changes list
craig changes create --type worker_assignment --description "..." --scope "admin_unit:Fulton"

education / health (Placement child records)

Phase 4 expansion commands for tracking a child’s educational enrollment and health visits (stored under craig-placement).

# Educational enrollment
craig education list --child-id <uuid>
craig education create --child-id <uuid> --school-name "Fulton Elementary" --grade-level "3" --enrollment-date 2026-08-15

# Health visits and overdue-appointment tracking
craig health list --child-id <uuid>
craig health overdue   # children with next_due_date in the past
craig health create --child-id <uuid> --visit-type well_child --provider-name "Dr. Smith" --visit-date 2026-04-01

admin-unit

Administrative-unit CRUD for jurisdictional reference data (replaces the earlier --county flags across several subcommands with a generalized --admin-unit; CRAIG supports counties, tribal regions, boroughs, parishes, etc.).

craig admin-unit list --state GA
craig admin-unit create --name "Apache County" --state AZ --unit-type county --fips-code "001"

completion

Generate shell completion scripts.

# Bash
craig completion bash > ~/.local/share/bash-completion/completions/craig

# Zsh
craig completion zsh > ~/.zfunc/_craig

# Fish
craig completion fish > ~/.config/fish/completions/craig.fish

# PowerShell
craig completion powershell > _craig.ps1

After generating completions, restart your shell or source the file.

Scripting Examples

Evaluate all rule sets

# List rule set IDs and evaluate each one
for id in $(craig --format json rules list | jq -r '.data[].id'); do
  echo "=== $id ==="
  craig rules export "$id" | jq '.name'
done

Create a referral and investigate

# Create a referral
REF=$(craig --format json referral create \
  --reporter-type mandatory --admin-unit Fulton --priority 24-hour | jq -r '.id')

# Create an investigation from the referral
INV=$(craig --format json investigation create \
  --referral-id "$REF" --assigned-worker jsmith \
  --assignment-area Fulton --response-due-at 2025-03-20T17:00:00Z | jq -r '.id')

# Submit safety assessment
craig investigation safety-assessment "$INV" \
  --threats @threats.json --protective-capacities @capacities.json

Export all rule sets as backup

mkdir -p backup/rulesets
for id in $(craig --format json rules list | jq -r '.data[].id'); do
  name=$(craig --format json rules get "$id" | jq -r '.name')
  craig rules export "$id" > "backup/rulesets/${name}.json"
  echo "Exported $name"
done
Edit this page · latest