Scripting and configuration

JSON output, stable exit codes, named configurations, and environment overrides.

Output

Every command takes --format json (and yaml), and output auto-switches to JSON when stdout is not a TTY, so pipes and agents always get machine-readable output without asking. --no-input never prompts.

TOKEN=$(privasys auth print-access-token)        # pipe a bearer into curl
privasys apps list --format json | jq '.[].name'

Exit codes

Exit codes are stable so scripts and agents can branch on the failure class:

Code	Meaning
`0`	success
`1`	generic error
`3`	not authenticated
`4`	not authorized
`5`	not found

Choosing an environment

The CLI talks to production by default (https://api.developer.privasys.org). Two flags switch that per command:

Flag	Environment
(none)	Production (default)
`--test`	The Privasys test / dev environment
`--endpoint <url>`	A custom environment (self-hosted or staging)

privasys apps list                 # production
privasys apps list --test          # test/dev environment
privasys apps list --endpoint https://api.example.com   # custom

--endpoint overrides --test. Authentication always uses the production issuer (privasys.id), so only the platform endpoint changes.

Configuration

Configuration lives at ~/.privasys/config.yaml (named configurations). Global flags: --endpoint, --test, --issuer, --account, --format, --no-input, --quiet. To make an environment sticky (instead of passing a flag each time), set it in the config:

privasys config set endpoint https://api.developer.privasys.org
privasys config set account <account-id>
privasys config list

Environment overrides

Variable	Overrides
`PRIVASYS_ENDPOINT`	platform API base URL
`PRIVASYS_ISSUER`	identity provider issuer URL
`PRIVASYS_ACCOUNT`	account id to act on
`PRIVASYS_FORMAT`	output format
`PRIVASYS_SERVICE_KEY`	service-account key (unattended auth)
`PRIVASYS_ACCESS_TOKEN`	a raw bearer, bypassing stored sessions
`PRIVASYS_NO_INPUT`	never prompt