Inth CLI

Manage Inth resources from the CLI

Use inth project for consent projects, inth code-audit for repository scans, and inth inbox for findings. Resource writes take effect immediately. Use a saved sign-in or an API key accepted by the command, and check inth <command> --help for required scopes and flags.

Which command manages each resource?

Command	Operation
`org list`, `org get <id>`, `org create`	List, read, or create organizations
`region list`	List project region IDs
`project list`, `project get <id>`	Read projects, including consent settings
`project create --name <name> --region <id>`	Create a project
`project update <id>`, `project delete <id>`	Update or delete a project
`member list`, `member update <id> --role <role>`	Read members or change a role
`member remove <id>`	Remove a member
`invitation list`, `invitation create --email <email> --role <role>`	Read pending invitations or send an invitation
`invitation cancel <id>`	Cancel a pending invitation
`api-key list`, `api-key create --name <name>`	List or create organization API keys
`api-key roll <id>`, `api-key delete <id>`	Rotate or revoke a key
`billing`	Read the organization's plan and credit balance
`feedback`	Send a report about Inth to the Inth team
`code-audit repositories`	List connected repositories
`code-audit scans`	List scans, optionally with `--repository` and `--status`
`code-audit start --repository <id>`	Start a scan of the repository's production branch
`code-audit request <preparation-id> --repository <id>`	Check a delayed scan request
`code-audit get <id>`, `code-audit issues <id>`	Read a scan or its report
`code-audit unlock <id>`	Spend credits to unlock a report
`inbox list`, `inbox get <id>`	Read findings, optionally filtering the list with `--status`
`inbox update <id> --status <status> --item-version <version>`	Change a finding's status
`inbox github-issue <id>`	Create a GitHub issue for a finding

List commands return one page. --limit defaults to 50 and accepts 1 through 100. Pass the returned cursor unchanged to --cursor for the next page.

inth project list --limit 20
inth project list --limit 20 --cursor '<nextCursor>'
inth region list
inth project create --name Website --region '<region-id>' \
  --branding inth --trusted-origins '["example.com", "*.example.com"]'
inth project update prj_123 --name 'Marketing site' --branding c15t
inth project update prj_123 --data '{"description":null,"consent":{"trustedOrigins":[]}}'

Replace the example IDs with IDs returned by the API. Project writes accept --branding inth|c15t|none and a JSON array for --trusted-origins. Use --data '<JSON object>' instead of individual body options for nested fields or explicit null values.

How do I start a Code Audit scan?

Run inth code-audit start --repository <id> with an ID returned by inth code-audit repositories. Supply a stable --request-id when a start may need a manual retry.

inth code-audit repositories
inth code-audit start --repository repo_123 --request-id deploy_123
inth code-audit request prep_123 --repository repo_123
inth code-audit get scan_123
inth code-audit issues scan_123

A scan start can return starting with a preparationId and repositoryId. Check those IDs with code-audit request until the state is started or failed. Each invocation checks once. Reuse the same --request-id when retrying a start.

How do I update an Inbox finding?

Run inth inbox get <id> to read the finding, then pass the returned version to inth inbox update using --item-version.

inth inbox list
inth inbox get inbox_123
inth inbox update inbox_123 --status resolved --item-version 3

Inbox updates require the version from the latest read. Supported statuses are open, accepted, dismissed, and resolved. After a version conflict, read the item again before updating it.

How do I send feedback about Inth?

Use inth feedback for unexpected failures, misleading docs, missing capabilities, or workarounds. Reports go to the Inth team immediately. Follow the user's permission to send feedback, and exclude credentials, personal data, customer payloads, and full transcripts. Do not report routine validation errors.

inth feedback --category bug --surface cli \
  --message 'Project listing failed after sign-in' \
  --expected 'A list of projects' --actual 'HTTP 500' \
  --operation 'inth project list' --request-id '<failed-request-id>' --json

The API deduplicates identical reports from the same caller within a UTC day. Resending the same report returns the original reference with alreadySubmitted: true. Changed content or a new UTC day creates a new report. --request-id identifies the failed operation you are reporting.

Only --category and --message are required. Categories are bug, friction, docs_mismatch, feature_request, and performance. The optional --surface accepts api, mcp, cli, docs, sdk, dashboard, and other. When omitted, the API uses the transport, api, in the ticket subject. Optional flags include --expected, --actual, --reproduction, --request-id, --operation, --client-name, and --client-version.

You can instead pass the report fields with --data '<JSON object>'. Use camelCase property names such as requestId, clientName, and clientVersion. Do not combine --data with individual body flags. The server validates raw JSON bodies.

Feedback accepts a saved browser or agent sign-in, or an organization API key. It requires no product scope, organization role, or --organization selection and charges no credits. The limit is ten new reports per caller per UTC clock hour; same-day duplicate reports do not consume that quota. Feedback returns HTTP 429 errors immediately without waiting or retrying. Continue the original task if reporting fails.

Human output shows the ticket reference and whether it was already submitted. With --json, read data.data.reference and data.data.alreadySubmitted.

Which commands send messages, expose secrets, or spend credits?

Writes run without confirmation prompts. Invitations send email, key rotation replaces the old key, report unlocks spend credits and require an owner, and inbox github-issue creates a GitHub issue. Key creation and rotation print the new secret once; save it before closing the terminal. An unresolved GitHub issue send can return 409 and require server reconciliation before another attempt.