Command Tasks

Run privileged administrative tasks in the Team Server container:

endura task <task_name> [name:value ...]

Tasks bypass web/API authorization. Restrict shell/container access and use the service’s configuration and database credentials.

# Docker Compose
docker compose exec endura-team-server endura task system_check

# Podman Compose
podman compose exec endura-team-server endura task system_check

# Kubernetes
kubectl exec deployment/endura-team-server -- endura task system_check

List cataloged tasks, arguments, and destructive flags:

endura task task_catalog

Output

Every normal response is one JSON object with schemaVersion, task, status, count, data, and warnings.

Lists default to page 1, at most 200 records. Set page/size (1–200), or use all:true format:jsonl for one object per line without the envelope.

endura task pipeline_list page:2 size:50
endura task pipeline_list all:true format:jsonl

Input and Safety

Use key:value for nonsecrets, positive integer IDs, and comma-separated ID lists. Booleans accept case-insensitive true/1/yes or false/0/no. Invalid values, IDs, enums, and unknown arguments fail.

Integration creation/updates and policy authoring read JSON through input:<path> or stdin with input:-. Keep credentials in protected files/stdin, never process arguments or history.

Destructive tasks preview by default: deletion/revocation, assignment replacement, sync stopping, schema refresh, and pruning. Review, then repeat with confirm:true.

endura task build_delete id:42
endura task build_delete id:42 confirm:true

CI/CD Integration Tasks

Each supported provider has the same eight-task family. Substitute one of these provider prefixes for <provider>: bamboo, github, gitlab, jenkins, koji, or teamcity.

Sync modes are all (default), pipelines, or builds. Optional id selects integration IDs; omission selects all for that provider. Required trigger is manual or scheduled.

Sync blocks until completion/failure. Any integration ending API inactive (UI Error) produces a partial per-instance report and nonzero exit.

Create JSON includes the provider URL and credentials. Update JSON replaces mutable credentials and provider filters, but not the URL. Field names are camelCase:

Koji authentication accepts anonymous or clientCertificate. Client-certificate authentication requires both clientCert and caCert PEM values.

{
  "url": "https://github.com",
  "token": "github_pat_REDACTED",
  "organizations": ["example-org"]
}

endura task github_create input:/run/secrets/github.json
endura task github_sync id:1,4 mode:builds trigger:manual
endura task github_stop id:4
endura task github_stop id:4 confirm:true

The matching provider guides describe credential permissions and provider-specific behavior.

Observed Resource Tasks

Observed resources have get/list/delete tasks; creation comes from discovery or Sensors.

Deletes can cascade to dependent observations. Always inspect the preview before confirming.

Runtime Sensor Tasks

Capture tokens when sensor_create or a confirmed sensor_rotate_token returns them. Team Server does not display the token again.

User Tasks

user_update replaces supplied scope dimensions; omitted ones remain unchanged. Clear pipeline/deployment scope by omitting its list and passing all_*:false. The final Administrator is protected.

endura task user_get email:operator@example.com
endura task user_update \
  id:5 pipelines:1,2 deployments:3 policies:7 all_pipelines:false

Personal Access Token Tasks

These local tasks act for a selected user. HTTP token mutations instead require interactive sign-in; authorized PAT requests can read owner metadata.

permission accepts read, write, or read_write. expires_in_days must be from 1 through 365. Use the permissions described in Personal Access Tokens.

Policy Tasks

Create and update input is camelCase. Creation requires name, description, content, version, ownerId, and the author’s user email in author; variables is optional. Update requires name, description, content, version, a commit message, and author. policy_validate accepts content and an optional policyId, which makes that policy’s saved variables available during compilation.

Policy inputs reject unknown fields. See Security Policies for valid policy content and variable definitions.

Email Tasks

email_create input requires name, host, port, security, fromAddress, and recipients. security accepts tls for implicit TLS or startTls for required STARTTLS. Optional username and password must be supplied together; fromName is optional. It also accepts notifyViolations, includeObserved, allPipelines, pipelineIds, allDeployments, and deploymentIds.

email_update input requires name, fromAddress, and recipients, and accepts fromName plus the notification and scope fields. email_update_connection requires host, port, and security; supply both username and a new write-only password for authenticated SMTP, or omit both for an unauthenticated relay.

Omitted optional notification fields reset to their defaults: violation notifications and both all* scopes enabled, observed outcomes disabled, and empty ID lists. An empty recipients array mutes automatic delivery. Use Email Notifications for SMTP security, outbound policy, recipient behavior, and browser-based message testing.

Slack Tasks

slack_create input requires name, clientId, and clientSecret. slack_connect input requires accessToken, teamId, and teamName.

slack_update input requires name and channels, and accepts notifyViolations, notifyHere, includeObserved, allPipelines, pipelineIds, allDeployments, and deploymentIds. Omitted optional update fields reset to their defaults: violation notifications and both all* scopes enabled, mentions and observed outcomes disabled, and empty ID lists.

Use Slack Notifications for the browser OAuth workflow, scopes, channel selection, and notification behavior.

Microsoft Teams Tasks

teams_create input requires name, tenantId, appId, and clientSecret. teams_rotate_secret input requires clientSecret. teams_update input requires name and channels; each channel is an object with teamId and channelId. The update also accepts notifyViolations, includeObserved, allPipelines, pipelineIds, allDeployments, and deploymentIds.

Omitted optional update fields reset to their defaults: violation notifications and both all* scopes enabled, observed outcomes disabled, and empty ID lists. The command tasks do not generate or install the Teams app package. Use Microsoft Teams Notifications to configure the Azure Bot, download and install the package, discover channels, and send browser-based channel tests.

Settings Tasks

Maintenance and Diagnostic Tasks

Keep the scheduled statistics_calculate, status_reconcile, and log_prune confirm:true jobs enabled. CI/CD provider schedules use <provider>_sync mode:pipelines trigger:scheduled and <provider>_sync mode:builds trigger:scheduled. See Scheduler.

Observed Data Pruning

data_prune removes selected historical observations while retaining long-lived pipeline, deployment, Runtime Sensor, policy, user, and integration roots. It is not scheduled by default.

Active builds/workloads are excluded. Each invocation deletes up to batch_size per observation type; repeat preview/apply until complete. Statistics delete all matches. Violations use their own timestamps and can be deleted while parents remain. Review retention and the preview first.

endura task data_prune resources:builds,workloads,violations older_than_days:90
endura task data_prune resources:builds,workloads,violations older_than_days:90 confirm:true
endura task data_prune resources:stats before:2026-01-01T00:00:00Z batch_size:1000 confirm:true

Fixture Data

database_seed loads path (default src/fixtures). refresh:true previews schema deletion/recreation; confirm:true applies it before loading. Production refuses the task.

endura task database_seed path:src/fixtures
endura task database_seed path:src/fixtures refresh:true
endura task database_seed path:src/fixtures refresh:true confirm:true

Use fixture data only in disposable development and test environments.