aspera-cli 4.19.0 → 4.21.1

data/README.md

@@ -1,8 +1,13 @@
 # Command Line Interface for IBM Aspera products
-<!-- markdownlint-disable MD033 MD003 MD053 -->
-<!-- cspell:ignore Serban Antipolis -->
+<!--
+Do not edit this README.md, edit docs/README.erb.md, for details, read docs/README.md
 
-[comment1]: # (Do not edit this README.md, edit docs/README.erb.md, for details, read docs/README.md)
+markdownlint-disable MD033 MD003 MD053
+cspell:ignore Serban Antipolis
+PANDOC_META_BEGIN
+subtitle: "ascli 4.21.1"
+PANDOC_META_END
+-->
 
 [![Gem Version](https://badge.fury.io/rb/aspera-cli.svg)](https://badge.fury.io/rb/aspera-cli)
 [![unit tests](https://github.com/IBM/aspera-cli/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/IBM/aspera-cli/actions)
@@ -10,9 +15,9 @@
 
 ## Introduction
 
-Version : 4.19.0
+Version : 4.21.1
 
-Laurent/2016-2024
+Laurent/2016-2025
 
 This gem provides the `ascli` CLI (Command Line Interface) to IBM Aspera software.
 
@@ -22,9 +27,9 @@ Ruby Gem: [https://rubygems.org/gems/aspera-cli](https://rubygems.org/gems/asper
 
 Ruby Doc: [https://www.rubydoc.info/gems/aspera-cli](https://www.rubydoc.info/gems/aspera-cli)
 
-Minimum required Ruby version: >= 2.6.
+Minimum required Ruby version: >= 3.1.
 
-> **Deprecation notice**: the minimum Ruby version will be 3.0 in a future version.
+> **Deprecation notice**: the minimum Ruby version will be 3.2 in a future version.
 
 [Aspera APIs on IBM developer](https://developer.ibm.com/?size=30&q=aspera&DWContentType[0]=APIs&sort=title_asc)
 [Link 2](https://developer.ibm.com/apis/catalog/?search=aspera)
@@ -37,6 +42,11 @@ A PDF version of this documentation is available here: [docs/Manual.pdf](docs/Ma
 
 Refer to [BUGS.md](BUGS.md) and [CONTRIBUTING.md](CONTRIBUTING.md).
 
+This documentation does not provide ALL the detailed description of all options and commands.
+The reason is that most commands and payloads are directly Rest API calls on the various Aspera products.
+So, to get the full description of all options and commands, refer to the official Aspera API documentation.
+(To see which API is used, set option `--log-level=debug`)
+
 ### When to use and when not to use
 
 `ascli` is designed to be used as a command line tool to:
@@ -59,13 +69,23 @@ It is designed for:
 If the need is to perform operations programmatically in languages such as: C, Go, Python, nodejs, ... then it is better to directly use [Aspera APIs](https://ibm.biz/aspera_api)
 
 - Product APIs (REST) : e.g. AoC, Faspex, node
-- Transfer SDK : with gRPC interface and language stubs (C, C++, Python, .NET/C#, java, Ruby, etc...)
+- Transfer SDK : with gRPC interface and language stubs (C, C++, Python, .NET/C#, java, Go, Ruby, Rust, etc...)
 
 Using APIs (application REST API and transfer SDK) will prove to be easier to develop and maintain.
 Code examples here: <https://github.com/laurent-martin/aspera-api-examples>
 
 For scripting and ad'hoc command line operations, `ascli` is perfect.
 
+So, which is Aspera's CLI ? `ascli` or `ascp`
+
+`ascp` is the low level Aspera command line for **transfers**.
+It is in fact the implementation of the FASP protocol.
+So, ANY Aspera transfer leads to one ascp process running on client side and another on server side.
+`ascp` can be used as a command line, but it is very low level, and practically it can be used on command line only if there is no Aspera web ap (AoC, Faspex, etc..) and ONLY to do a transfer (send/receive), not for any operation on Aspera apps (e.g. listing remote files).
+`ascp` does not provide a configuration file to store credentials or options, it does not resume automatically on transfer error.
+
+In fact, `ascli` can do everything that `ascp` does, and much more, and in an easier way.
+
 ### Notations, Shell, Examples
 
 Command line operations examples are shown using a shell such as: `bash` or `zsh`.
@@ -92,7 +112,7 @@ Once the gem is installed, `ascli` shall be accessible:
 
 ```console
 $ ascli --version
-4.19.0
+4.21.1
 ```
 
 ### First use
@@ -191,26 +211,31 @@ The direct installation is recommended and consists in installing:
 - [aspera-cli](#ruby-gem-aspera-cli) <!-- markdownlint-disable-line -->
 - [Aspera SDK (`ascp`)](#fasp-protocol-ascp)
 
-Ruby version: >= 2.6.
+Ruby version: >= 3.1.
 
-> **Deprecation notice**: the minimum Ruby version will be 3.0 in a future version.
+> **Deprecation notice**: the minimum Ruby version will be 3.2 in a future version.
 
 The following sections provide information on the various installation methods.
 
 An internet connection is required for the installation.
 If you don't have internet for the installation, refer to section [Installation without internet access](#installation-in-air-gapped-environment).
 
-A package with pre-installed Ruby, gem and ascp may also be provided.
+A package with pre-installed Ruby, gem and `ascp` may also be provided.
 
-### Ruby
+### `ascli` executable
 
-Use this method to install on the native host (e.g. your Windows, macOS or Linux system).
+**Note:** This is an Alpha feature. The binary depends on certain GLIBC version for Linux.
+
+It is planned to provide `ascli` as a single platform-dependent executable.
+[Alpha releases can be found here](https://ibm.biz/aspera-cli-exe).
+
+### Ruby
 
 A Ruby interpreter is required to run `ascli`.
 
-Required Ruby version: >= 2.6.
+Required Ruby version: >= 3.1.
 
-> **Deprecation notice**: the minimum Ruby version will be 3.0 in a future version.
+> **Deprecation notice**: the minimum Ruby version will be 3.2 in a future version.
 
 **Ruby can be installed using any method** : rpm, yum, dnf, rvm, brew, Windows installer, ... .
 
@@ -221,64 +246,8 @@ Required Ruby version: >= 2.6.
 
 For convenience, you may refer to the following sections for a proposed method for specific operating systems.
 
-#### Unix-like: RVM: Single user installation (not root)
-
-Install `rvm`.
-Follow [https://rvm.io/](https://rvm.io/).
-
-Execute the shell/curl command.
-As regular user, it installs in the user's home: `~/.rvm` .
-
-```bash
-\curl -sSL https://get.rvm.io | bash -s stable
-```
-
-Follow on-screen instructions to install keys, and then re-execute the command.
-
-Upon RVM installation, open a new terminal or initialize with:
-
-```bash
-source ~/.rvm/scripts/rvm
-```
-
-It is advised to get one of the pre-compiled Ruby version, you can list with:
-
-```bash
-rvm list --remote
-```
-
-Install the chosen pre-compiled Ruby version:
-
-```bash
-rvm install 3.2.2
-```
-
-Ruby is now installed for the user, go to [Gem installation](#ruby-gem-aspera-cli). <!-- markdownlint-disable-line -->
-
-Alternatively RVM can be installed system-wide, for this execute as `root`.
-It then installs by default in `/usr/local/rvm` for all users and creates `/etc/profile.d/rvm.sh`.
-One can install in another location with:
-
-```bash
-curl -sSL https://get.rvm.io | bash -s -- --path /usr/local
-```
-
-As root, make sure this will not collide with other application using Ruby (e.g. Faspex).
-If so, one can rename the environment script so that it is not loaded by default:
-
-```bash
-mv /etc/profile.d/rvm.sh /etc/profile.d/rvm.sh.ok
-```
-
-To activate Ruby (and ascli) later, source it:
-
-```bash
-source /etc/profile.d/rvm.sh.ok
-```
-
-```bash
-rvm version
-```
+Latest version of `ascli` requires a ruby version [at least under maintenance support](https://www.ruby-lang.org/en/downloads/branches/).
+If an older Ruby version is needed, then use an older version of `ascli` that supports it.
 
 #### Windows: Installer
 
@@ -302,15 +271,24 @@ rubyinstaller-devkit-3.2.2-1-x64.exe /silent /currentuser /noicons /dir=C:\asper
 
 #### macOS: `brew`
 
-**macOS** come with Ruby.
-Nevertheless, [Apple has deprecated it](https://developer.apple.com/documentation/macos-release-notes/macos-catalina-10_15-release-notes), and it will be removed in the future, so better not to rely on it.
+**macOS** comes with Ruby 2.6.
+It is an old unsupported version and [Apple has deprecated it](https://developer.apple.com/documentation/macos-release-notes/macos-catalina-10_15-release-notes), and it will be removed in the future.
+Do not use it.
 
-The recommended way is to either user `RVM` or use [Homebrew](https://brew.sh/).
+The recommended way is to either use [Homebrew](https://brew.sh/) or [RVM](https://rvm.io/).
 
 ```bash
 brew install ruby
 ```
 
+This installs a recent ruby suitable for `ascli`.
+
+If using `rvm`, one way to force use of openssl 3.0 is:
+
+```bash
+RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix openssl@3.0)" rvm install 3.4.0
+```
+
 #### Linux: Package
 
 If your Linux distribution provides a standard Ruby package, you can use it provided that the version supported.
@@ -364,7 +342,66 @@ One can remove all installed gems, for example to start fresh:
 gem uninstall -axI $(ls $(gem env gemdir)/gems/|sed -e 's/-[^-]*$//'|sort -u)
 ```
 
-#### Linux as simple user
+#### Unix-like: RVM: Single user installation (not root)
+
+Install `rvm`.
+Follow [https://rvm.io/](https://rvm.io/).
+
+Execute the shell/curl command.
+As regular user, it installs in the user's home: `~/.rvm` .
+
+```bash
+\curl -sSL https://get.rvm.io | bash -s stable
+```
+
+Follow on-screen instructions to install keys, and then re-execute the command.
+
+Upon RVM installation, open a new terminal or initialize with:
+
+```bash
+source ~/.rvm/scripts/rvm
+```
+
+It is advised to get one of the pre-compiled Ruby version, you can list with:
+
+```bash
+rvm list --remote
+```
+
+Install the chosen pre-compiled Ruby version:
+
+```bash
+rvm install 3.2.2
+```
+
+Ruby is now installed for the user, go to [Gem installation](#ruby-gem-aspera-cli). <!-- markdownlint-disable-line -->
+
+Alternatively RVM can be installed system-wide, for this execute as `root`.
+It then installs by default in `/usr/local/rvm` for all users and creates `/etc/profile.d/rvm.sh`.
+One can install in another location with:
+
+```bash
+curl -sSL https://get.rvm.io | bash -s -- --path /usr/local
+```
+
+As root, make sure this will not collide with other application using Ruby (e.g. Faspex).
+If so, one can rename the environment script so that it is not loaded by default:
+
+```bash
+mv /etc/profile.d/rvm.sh /etc/profile.d/rvm.sh.ok
+```
+
+To activate Ruby (and ascli) later, source it:
+
+```bash
+source /etc/profile.d/rvm.sh.ok
+```
+
+```bash
+rvm version
+```
+
+#### Linux as non-root
 
 If you don't have root access, you can install Ruby in your home directory using `rbenv` see [rbenv-installer](https://github.com/rbenv/rbenv-installer#rbenv-installer):
 
@@ -372,7 +409,7 @@ If you don't have root access, you can install Ruby in your home directory using
 curl -fsSL https://github.com/rbenv/rbenv-installer/raw/HEAD/bin/rbenv-installer | bash
 ```
 
-Then open a new terminal, or "source" the shell initialization script:
+Then open a new terminal, or `source` the shell initialization script:
 
 ```bash
 source ~/.bashrc
@@ -391,8 +428,7 @@ For example for AIX, one can look at:
 
 <https://www.ibm.com/support/pages/aix-toolbox-open-source-software-downloads-alpha#R>
 
-If your Unix does not provide a pre-built Ruby, you can get it using one of those
-[methods](https://www.ruby-lang.org/en/documentation/installation/).
+If your Unix does not provide a pre-built Ruby, you can get it using one of those [methods](https://www.ruby-lang.org/en/documentation/installation/).
 
 For instance to build from source and install in `/opt/ruby` :
 
@@ -445,16 +481,24 @@ JRUBY_OPTS=--dev ascli -v
 
 #### Optional gems
 
-Some additional gems can be installed to provide additional features:
+Some additional gems are required for some specific features, see [Gemfile.optional](Gemfile.optional):
 
-- `rmagick` : to generate thumbnails of images
-- `grpc` : to use the transfer SDK (gRPC)
-- `mimemagic` : to detect MIME type of files for `preview` command
+| name | version | comment |
+| ---- | ------- | ------- |
+| grpc | ~> 1.65 | for transferSDK |
+| mimemagic | ~> 0.4 | for preview |
+| rmagick | ~> 5.5 | for terminal view |
+| symmetric-encryption | ~> 4.6 | for file vault |
+| bigdecimal | ~> 3.1.9 | if RUBY_VERSION >= '3.4' for symmetric-encryption ? |
 
 Install like this:
 
 ```bash
-gem install rmagick grpc mimemagic
+gem install grpc -v '~> 1.65'
+gem install mimemagic -v '~> 0.4'
+gem install rmagick -v '~> 5.5'
+gem install symmetric-encryption -v '~> 4.6'
+gem install bigdecimal -v '~> 3.1.9'
 ```
 
 > **Note:** Those are not installed as part of dependencies because they involve compilation of native code.
@@ -509,24 +553,59 @@ Only two additional files are required to perform an Aspera Transfer, which are
 - `ascp`
 - `aspera-license` (in same folder, or ../etc)
 
-This can be installed either be installing an Aspera transfer software, or using an embedded command:
+This can be installed either be installing an Aspera transfer software or using an `ascli` command.
+
+#### Installation of `ascp` through `transferd`
+
+The easiest option to install `ascp` is through the use of the IBM Aspera Transfer Daemon.
+
+Supported platforms are listed in the [Release Notes](https://developer.ibm.com/apis/catalog/aspera--aspera-transfer-sdk/Release+notes) and archives can be downloaded from [Downloads](https://developer.ibm.com/apis/catalog/aspera--aspera-transfer-sdk/downloads/downloads.json).
+
+Install with:
 
 ```bash
 ascli config ascp install
 ```
 
-If a local SDK installation is preferred instead of fetching from internet: one can specify the location of the SDK file:
+or
+
+```bash
+ascli config transferd install
+```
+
+This command will retrieve the list of current archives for all platforms from: <https://ibm.biz/sdk_location> and then select the latest version for the current platform.
+In this case, the default value for option `sdk_url` is `DEF`.
+
+Available Transfer Daemon versions can be listed with: `ascli config transferd list`
+
+To install a specific version, e.g. 1.1.3:
 
 ```bash
-curl -Lso sdk.zip https://ibm.biz/aspera_transfer_sdk
+ascli config ascp install 1.1.3
 ```
 
+To get the download URL for a specific platform and version:
+
 ```bash
-ascli config ascp install --sdk-url=file:///sdk.zip
+ascli config transferd list --select=@json:'{"platform":"osx-arm64","version":"1.1.3"}' --fields=url
+```
+
+To download it, pipe to `config download`:
+
+```bash
+ascli config transferd list --select=@json:'{"platform":"osx-arm64","version":"1.1.3"}' --fields=url | ascli config download @stdin:
+```
+
+If installation from a local file preferred instead of fetching from internet: one can specify the location of the SDK file with option `sdk_url`:
+
+```bash
+ascli config ascp install --sdk-url=file:///macos-arm64-1.1.3-c6c7a2a.zip
 ```
 
 The format is: `file:///<path>`, where `<path>` can be either a relative path (not starting with `/`), or an absolute path.
 
+#### Installation of `ascp` through other component
+
 If the embedded method is not used, the following packages are also suitable:
 
 - IBM Aspera Connect Client (Free)
@@ -706,7 +785,7 @@ ascli -v
 ```
 
 ```text
-4.19.0
+4.21.1
 ```
 
 In order to keep persistency of configuration on the host, you should specify your user's configuration folder as a volume for the container.
@@ -969,7 +1048,7 @@ ascli config echo @uri:https://localhost:9092/ping --cert-stores=myserver.pem
 
 ## Command Line Interface
 
-The command line tool is: ``ascli``
+The command line tool is: `ascli`
 
 The `aspera-cli` gem provides a command line interface (CLI) which interacts with Aspera Products (mostly using REST APIs):
 
@@ -1060,6 +1139,8 @@ Hello World
 2
 ```
 
+> **Note:** Use `pp` instead of `puts` to display as ruby Array.
+
 Once the shell has dealt with the command line "special" characters for it, the shell calls Windows' `CreateProcess` with just the whole command line as a single string.
 (Unlike Unix-like systems where the command line is split into arguments by the shell.)
 
@@ -1328,7 +1409,7 @@ The tokenization of the command line is typically done by the shell, refer to th
 `ascli` handles two types of command line arguments:
 
 - **Positional Arguments** : position is significant
-- **Options** : only order is significant, but not position
+- **Options** : only order is significant, but not absolute position
 
 For example:
 
@@ -1349,11 +1430,11 @@ The value of **Options** and **Positional Arguments** is evaluated with the [Ext
 **Positional Arguments** are either:
 
 - **Commands**, typically at the beginning
-- **Command Parameters** , e.g. creation data or entity identifier
+- **Command Parameters**, mandatory arguments, e.g. creation data or entity identifier
 
 When options are removed from the command line, the remaining arguments are typically **Positional Arguments** with a pre-defined order.
 
-**Commands** are typically entity types or verbs to act on those entities.
+**Commands** are typically entity types (e.g. `users`) or verbs (e.g. `create`) to act on those entities.
 Its value is a `String` that must belong to a fixed list of values in a given context.
 
 Example:
@@ -1372,19 +1453,22 @@ Order is significant.
 The provided command must match one of the supported commands in the given context.
 If wrong, or no command is provided when expected, an error message is displayed and the list of supported commands is displayed.
 
-Some sub-commands appear after entity selection (identifier), e.g. `ascli aoc admin res node do 8669 browse /`: `browse` is a sub-command of `node`.
+Standard **Commands** are: `create`, `show`, `list`, `modify`, `delete`.
+Some entities also support additional commands.
+When those additional commands are related to an entity also reachable in another context, then those commands are located below command `do`.
+For example sub-commands appear after entity selection (identifier), e.g. `ascli aoc admin node do 1234 browse /`: `browse` is a sub-command of `node`.
 
 **Command Parameters** are typically mandatory values for a command, such as entity creation data or entity identifier.
 
 > **Note:** It could also have been designed as an option.
-But since it is mandatory and typically these data need **not** be set in a configuration file, then it is better designed as a **Command Parameter**, and not designed an additional specific option.
-The advantages of using a **Command Parameter** instead of an option for the same are that the command line is shorter (no option name, just the position) and the value is clearly mandatory.
-The disadvantage is that it is not possible to define a default value in a configuration file or environment variable like for options.
+But since it is mandatory and typically these data do not need to be set in a configuration file, it is better designed as a Command Parameter, rather than as an additional specific option.
+The advantages of using a **Command Parameter** instead of an option for the same are that the command line is shorter (no option name, just the position), the value is clearly mandatory and position clearly indicates its role.
+The disadvantage is that it is not possible to define a default value in a configuration file or environment variable using an option value.
 Nevertheless, [Extended Values](#extended-value-syntax) syntax is supported, so it is possible to retrieve a value from the configuration file (using `@preset:`) or environment variable (using `@env:`).
 
 If a **Command Parameters** begins with `-`, then either use the `@val:` syntax (see [Extended Values](#extended-value-syntax)), or use the `--` separator (see below).
 
-A few **Command Parameters** are optional, they are located at the end of the command line.
+A few **Command Parameters** are optional, they are always located at the end of the command line.
 
 #### Options
 
@@ -1464,16 +1548,33 @@ To redirect results to a file, use option `output`.
 
 Depending on action, the output will contain:
 
-- `single_object` : displayed as a 2 dimensional table: one line per attribute, first column is attribute name, and second is attribute value. Nested hashes are collapsed.
-- `object_list` : displayed as a 2 dimensional table: one line per item, one column per attribute.
-- `value_list` : a table with one column.
-- `empty` : nothing
-- `status` : a message
-- `other_struct` : a complex structure that cannot be displayed as an array
+| Result Type     | Description |
+|-----------------|-------------------|
+| `single_object` | displayed as a 2 dimensional table: one line per field, first column is field name, and second is field value. Nested hashes are collapsed. |
+| `object_list`   | displayed as a 2 dimensional table: one line per item, one column per field. |
+| `value_list`    | a table with one column. |
+| `empty`         | nothing |
+| `status`        | a message |
+| `other_struct`  | a complex structure that cannot be displayed as an array |
 
-#### Format of output
+#### Option: `format`
 
-By default, result of type single_object and object_list are displayed using format `table`.
+The style of output can be set using the `format` option:
+
+| `format` | Output formatting |
+|----------|-------------------|
+| `table`  | Text table (default) |
+| `text`   | Value as `String` |
+| `ruby`   | Ruby code |
+| `json`   | JSON code |
+| `jsonpp` | JSON pretty printed |
+| `yaml`   | YAML |
+| `csv`    | Comma Separated Values |
+| `image`  | Image URL or Image data |
+
+By default, result of type `single_object` and `object_list` are displayed using format `table`.
+
+#### Option: `table_style`
 
 The table style can be customized with option: `table_style` which expects a `Hash`, options are the ones described in gem [`terminal-table`](https://github.com/tj/terminal-table).
 
@@ -1485,28 +1586,64 @@ ascli config preset over --table-style=@ruby:'{border: :unicode_thick_edge}'
 
 > **Note:** Other border styles exist, not limited to: `:unicode`, `:unicode_round`.
 
-In a table format, when displaying **Objects** (single, or list), by default, sub object are flattened (option `flat_hash`).
-For example, object `{"user":{"id":1,"name":"toto"}}` will have attributes: `user.id` and `user.name`.
-Setting option `flat_hash` to `false` will only display one field: `user` and value is the sub `Hash`.
-When in flatten mode, it is possible to filter fields using the option `fields` using the compound field name using `.` (dot) as separator.
+#### Option: `flat_hash`: `.`-join keys
+
+This optin controls how object fields are displayed for complex objects.
+
+Effective only when `format` is `table` to display `single_object` or `object_list`.
+
+If value is `no`, then object's `field` names are only the first level keys of the `Hash` result and values that are `Hash` are displayed as such in Ruby syntax.
+
+If value is `yes` (default), then object are flattened, i.e. deep `Hash` are transformed into 1-level Hash, where keys are `.`-junction of deep keys.
+In this case, it is possible to filter fields using the option `fields` using the compound field name using `.` (dot) as separator.
+
+Example: Result of command is a list of objects with a single object:
+
+```console
+$ ascli config echo @json:'[{"user":{"id":1,"name":"toto"},"project":"blah"}]'
+╭─────────┬───────────┬─────────╮
+│ user.id │ user.name │ project │
+╞═════════╪═══════════╪═════════╡
+│ 1       │ toto      │ blah    │
+╰─────────┴───────────┴─────────╯
+
+$ ascli config echo @json:'[{"user":{"id":1,"name":"toto"},"project":"blah"}]' --flat-hash=no
+╭───────────────────────────┬─────────╮
+│ user                      │ project │
+╞═══════════════════════════╪═════════╡
+│ {"id"=>1, "name"=>"toto"} │ blah    │
+╰───────────────────────────┴─────────╯
+```
+
+#### Option: `multi_single`
+
+This option controls if object fields are displayed as columns or lines.
+
+If value is `no` (default), `object_list` are displayed with one object per line, with fields as columns (see above).
+`single_object` are displayed with one field per line (and columns are: `field`, `value`).
 
-Object lists are displayed one per line, with attributes as columns.
-Single objects (or tables with a single result) are transposed: one attribute per line.
-If transposition of single object is not desired, use option: `transpose_single` set to `no`.
+If an `object_list` has a single element, it is possible to have `ascli` display the object as a single object (one field per line instead of columns) with option: `multi_single` set to `single`.
 
-The style of output can be set using the `format` option, supporting:
+This parameter can be set as a global default with:
 
-- `table` : Text table (default)
-- `multi` : List of elements are displayed as a list of tables
-- `text` : Value as String
-- `ruby` : Ruby code
-- `json` : JSON code
-- `jsonpp` : JSON pretty printed
-- `yaml` : YAML
-- `csv` : Comma Separated Values
-- `image` : Image URL or Image data
+```bash
+ascli config preset set GLOBAL multi_single single
+```
+
+In case multiple objects are returned, it is possible to display one table per object with option `multi_single` set to `yes`.
 
-#### Verbosity of output
+```console
+$ ascli config echo @json:'[{"user":{"id":1,"name":"toto"},"project":"blash"}]' --multi-single=yes
+╭───────────┬───────╮
+│ field     │ value │
+╞═══════════╪═══════╡
+│ user.id   │ 1     │
+│ user.name │ toto  │
+│ project   │ blash │
+╰───────────┴───────╯
+```
+
+#### Option: `display`: Verbosity of output
 
 Output messages are categorized in 3 types:
 
@@ -1520,13 +1657,17 @@ The option `display` controls the level of output:
 - `data` display `data` and `error` messages
 - `error` display only error messages.
 
-By default, secrets are removed from output: option `show_secrets` defaults to `no`, unless `display` is `data`, to allows piping results.
-To hide secrets from output, set option `show_secrets` to `no`.
+#### Option: `show_secrets`: Hide or show secrets in results
+
+If value is `no` (default), then secrets are redacted from command results.
+
+If value is `yes`, then secrets shown in clear in results.
 
-#### Option: `fields`: Selection of output object properties
+If `display` is `data`, secrets are included to allows piping results.
 
-By default, a `table` output format will display one line per entry, and columns for each fields (attributes, properties).
-Depending on the command, columns may include by default all fields, or only some selected fields.
+#### Option: `fields`: Selection of output object fields
+
+Depending on the command, results may include by default all fields, or only some selected fields.
 It is possible to define specific columns to be displayed, by setting the `fields` option.
 
 The `fields` option is a list that can be either a comma separated list or an extended value `Array`.
@@ -1535,8 +1676,8 @@ Individual elements of the list can be:
 
 - **property** : add property to the current list
 - `-`**property** : remove property from the current list
-- `DEF` : default list of properties (that's the default, when not set)
-- `ALL` : all properties
+- `DEF` : default list of fields (that's the default, when not set)
+- `ALL` : all fields
 - A Ruby `RegEx` : using `@ruby:'/.../'`, or `@re:...` add those matching to the list
 
 Examples:
@@ -1544,18 +1685,18 @@ Examples:
 - `a,b,c` : the list of attributes specified as a comma separated list (overrides the all default)
 - `@json:'["a","b","c"]'` : `Array` extended value: same as above
 - `b,DEF,-a` : default property list, remove `a` and add `b` in first position
-- `@ruby:'/^server/'` : Display all properties whose name begin with `server`
+- `@ruby:'/^server/'` : Display all fields whose name begin with `server`
 
 #### Option: `select`
 
 Table output (`object_list`) can be filtered using option `select`.
 This option is either a `Hash` or `Proc`.
-The `Proc` takes as argument a line (`Hash`) in the table and is a Ruby lambda expression that returns `true` or `false`.
+The `Proc` takes as argument a line (`Hash`) in the table and is a Ruby lambda expression that shall returns `true` to select or `false` to remove an entry.
 
 Example:
 
 ```bash
-ascli aoc admin res user list --fields=name,email,ats_admin --query=@json:'{"sort":"name"}' --select=@json:'{"ats_admin":true}'
+ascli aoc admin user list --fields=name,email,ats_admin --query=@json:'{"sort":"name"}' --select=@json:'{"ats_admin":true}'
 ```
 
 ```output
@@ -1579,19 +1720,26 @@ In above example, the same result is obtained with option:
 
 The percent selector allows identification of an entity by another unique identifier other than the native identifier.
 
-When a command is executed on a single entity, the entity is identified by a unique identifier that follows the command:
-e.g. `ascli aoc admin res user show 1234` where `1234` is the user's identifier.
+Syntax: `%<field>:<value>`
 
-Some commands provide the following capability:
-If the entity can also be uniquely identified by a name, then the name can be used instead of the identifier, using the **percent selector**: `ascli aoc admin res user show %name:john` where `john` is the user name.
+When a command is executed on a single entity, the entity is identified by a unique identifier that follows the command.
+For example, in the following command, `1234` is the user's identifier:
 
-Syntax: `%<field>:<value>`
+```bash
+ascli aoc admin user show 1234
+```
 
-> **Note:** The legacy option `id` is deprecated: `--id=1234` (options have a single value and thus do not provide the possibility to identify sub-entities)
+Some commands provide the following capability:
+If the entity can also be uniquely identified by a name, then the name can be used instead of the identifier, using the **percent selector**.
+For example, if the name of the user is `john` and a field for this entity named `name` has a value `john`:
+
+```bash
+ascli aoc admin user show %name:john
+```
 
 ### Extended Value Syntax
 
-Most options and arguments are specified by a simple string (e.g. username or url).
+Most options and arguments are specified by a simple string (e.g. `username` or `url`).
 Sometime it is convenient to read a value from a file: for example read the PEM value of a private key, or a list of files.
 Some options expect a more complex value such as `Hash` or `Array`.
 
@@ -1607,31 +1755,31 @@ Decoders act like a function with its parameter on right hand side and are recog
 
 The following decoders are supported:
 
-| Decoder  | Parameter| Returns | Description |
-|----------|----------|---------|-------------|
-| `base64` | String   | String  | Decode a base64 encoded string |
-| `csvt`   | String   | Array   | Decode a titled CSV value |
-| `env`    | String   | String  | Read from a named env var name, e.g. `--password=@env:MYPASSVAR` |
-| `file`   | String   | String  | Read value from specified file (prefix `~/` is replaced with the users home folder), e.g. `--key=@file:~/.ssh/mykey` |
-| `json`   | String   | Any     | Decode JSON values (convenient to provide complex structures) |
-| `lines`  | String   | Array   | Split a string in multiple lines and return an array |
-| `list`   | String   | Array   | Split a string in multiple items taking first character as separator and return an array |
-| `none`   | None     | Nil     | A null value |
-| `path`   | String   | String  | Performs path expansion on specified path (prefix `~/` is replaced with the users home folder), e.g. `--config-file=@path:~/sample_config.yml` |
-| `preset` | String   | Hash    | Get whole option preset value by name. Sub-values can also be used using `.` as separator. e.g. `foo.bar` is `conf[foo][bar]` |
-| `extend` | String   | String  | Evaluates embedded extended value syntax in string |
-| `re`     | String   | Regexp  | Ruby Regular Expression (short for `@ruby:/.../`) |
-| `ruby`   | String   | Any     | Execute specified Ruby code |
-| `secret` | None     | String  | Ask password interactively (hides input) |
-| `stdin`  | None     | String  | Read from stdin in text mode (no value on right) |
-| `stdbin` | None     | String  | Read from stdin in binary mode (no value on right) |
-| `uri`    | String   | String  | Read value from specified URL, e.g. `--fpac=@uri:http://serv/f.pac` |
-| `val`    | String   | String  | Prevent decoders on the right to be decoded. e.g. `--key=@val:@file:foo` sets the option `key` to value `@file:foo`. |
-| `yaml`   | String   | Any     | Decode YAML |
-| `zlib`   | String   | String  | Un-compress zlib data |
+| Decoder  | Parameter| Returns  | Description |
+|----------|----------|----------|-------------|
+| `base64` | `String` | `String` | Decode a base64 encoded string |
+| `csvt`   | `String` | `Array`  | Decode a titled CSV value |
+| `env`    | `String` | `String` | Read from a named env var name, e.g. `--password=@env:MYPASSVAR` |
+| `file`   | `String` | `String` | Read value from specified file (prefix `~/` is replaced with the users home folder), e.g. `--key=@file:~/.ssh/mykey` |
+| `json`   | `String` | Any      | Decode JSON values (convenient to provide complex structures) |
+| `lines`  | `String` | `Array`  | Split a string in multiple lines and return an array |
+| `list`   | `String` | `Array`  | Split a string in multiple items taking first character as separator and return an array |
+| `none`   | None     | Nil      | A null value |
+| `path`   | `String` | `String` | Performs path expansion on specified path (prefix `~/` is replaced with the users home folder), e.g. `--config-file=@path:~/sample_config.yml` |
+| `preset` | `String` | `Hash`   | Get whole option preset value by name. Sub-values can also be used using `.` as separator. e.g. `foo.bar` is `conf[foo][bar]` |
+| `extend` | `String` | `String` | Evaluates embedded extended value syntax in string |
+| `re`     | `String` | `Regexp` | Ruby Regular Expression (short for `@ruby:/.../`) |
+| `ruby`   | `String` | Any      | Execute specified Ruby code |
+| `secret` | None     | `String` | Ask password interactively (hides input) |
+| `stdin`  | None     | `String` | Read from stdin in text mode (no value on right) |
+| `stdbin` | None     | `String` | Read from stdin in binary mode (no value on right) |
+| `uri`    | `String` | `String` | Read value from specified URL, e.g. `--fpac=@uri:http://serv/f.pac` |
+| `val`    | `String` | `String` | Prevent decoders on the right to be decoded. e.g. `--key=@val:@file:foo` sets the option `key` to value `@file:foo`. |
+| `yaml`   | `String` | Any      | Decode YAML |
+| `zlib`   | `String` | `String` | Un-compress zlib data |
 
 > **Note:** A few commands support a value of type `Proc` (lambda expression).
-For example, the **Extended Value** `@ruby:'->(i){i["attr"]}'` is a lambda expression that returns the value of attribute `attr` of the `Hash` `i`.
+For example, the **Extended Value** `@ruby:'->(i){i["attr"]}'` is a lambda expression that returns the value for key `attr` of the `Hash` `i`.
 
 To display the result of an extended value, use the `config echo` command.
 
@@ -1689,14 +1837,14 @@ ascli config echo @json:@extend:'{"hello":true,"version":"@preset:config.version
 
 ```output
 +---------+-----------+
-| key     | value     |
+| field   | value     |
 +---------+-----------+
 | hello   | true      |
 | version | 4.14.0    |
 +---------+-----------+
 ```
 
-Example: Create a `Hash` from YAML provided as **heredoc**:
+Example: Create a `Hash` from YAML provided as shell **heredoc**:
 
 ```bash
 ascli config echo @yaml:@stdin: --format=json<<EOF
@@ -1716,7 +1864,7 @@ EOF
 
 ### Configuration and Persistency Folder
 
-`ascli` configuration and other runtime files (token cache, file lists, persistency files, SDK) are stored by default in `[User's home folder]/.aspera/ascli`.
+`ascli` configuration and persistency files (token cache, file lists, persistency files) are stored by default in `[User's home folder]/.aspera/ascli`.
 
 > **Note:** `[User's home folder]` is found using Ruby's `Dir.home` (`rb_w32_home_dir`).
 It uses the `HOME` env var primarily, and on MS Windows it also looks at `%HOMEDRIVE%%HOMEPATH%` and `%USERPROFILE%`.
@@ -1745,9 +1893,9 @@ ascli config folder
 C:\Users\Kenji\.aspera\ascli
 ```
 
-When OAuth is used (AoC, Faspex4 api v4, Faspex5) `ascli` keeps a cache of generated bearer tokens in folder `persist_store` in configuration folder by default.
+When OAuth is used (AoC, Faspex5) `ascli` keeps a cache of generated bearer tokens in folder `persist_store` in configuration folder by default.
 Option `cache_tokens` (**yes**/no) allows to control if Oauth tokens are cached on file system, or generated for each request.
-The command `config flush_tokens` clears that cache.
+The command `config tokens flush` clears that cache.
 Tokens are kept on disk for a maximum of 30 minutes (`TOKEN_CACHE_EXPIRY_SEC`) and garbage collected after that.
 When a token has expired, then a new token is generated, either using a refresh_token if it is available, or by the default method.
 
@@ -1917,17 +2065,16 @@ ascp errors
 ascp info --sdk-folder=sdk_test_dir
 ascp install
 ascp install --sdk-folder=sdk_test_dir
+ascp install 1.1.3
 ascp products list
 ascp products use 'IBM Aspera Connect'
 ascp show
 ascp spec
-ascp use /usr/bin/ascp
 check_update
 coffee
 coffee --ui=text
 coffee --ui=text --image=@json:'{"text":true,"double":false}'
 coffee --ui=text --image=@json:'{"text":true}'
-detect https://faspex4.example.com/path
 detect https://faspex5.example.com/path
 detect https://node.example.com/path
 detect https://shares.example.com/path shares
@@ -1936,10 +2083,13 @@ detect https://tst.example.com/path httpgw
 detect my_org aoc
 doc
 doc transfer-parameters
+echo '<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="50" fill="#006699"/></svg>' --format=image
 echo -- --special-string
 echo @base64:SGVsbG8gV29ybGQK
 echo @csvt:@stdin:
 echo @env:USER
+echo @json:'[{"user":{"id":1,"name":"foo"},"project":"bar"}]' --multi-single=single
+echo @json:'[{"user":{"id":1,"name":"foo"},"project":"bar"}]' --multi-single=yes
 echo @lines:@stdin:
 echo @list:,1,2,3
 echo @secret:
@@ -1951,7 +2101,8 @@ echo @vault:my_preset.password
 echo @zlib:@stdin:
 echo hello
 email_test --notify-to=my_email_external
-flush_tokens
+file
+file --logger=syslog --log-level=debug
 folder
 gem name
 gem path
@@ -1967,6 +2118,7 @@ preset delete conf_name
 preset initialize conf_name @json:'{"p1":"v1","p2":"v2"}'
 preset list
 preset overview
+preset set GLOBAL version_check_days 0
 preset set conf_name param value
 preset set default shares conf_name
 preset show conf_name
@@ -1977,8 +2129,13 @@ pubkey @file:my_key
 remote_certificate chain https://node.example.com/path
 remote_certificate name https://node.example.com/path
 remote_certificate only https://node.example.com/path
+smtp_settings
+tokens flush
+transferd install
+transferd list
 vault create my_label @json:'{"password":"my_password_here","description":"my secret"}'
 vault delete my_label
+vault info
 vault list
 vault show my_label
 wizard https://console.example.com/path console
@@ -2104,7 +2261,7 @@ ascli config wizard
 #### Example of configuration for a plugin
 
 For Faspex, Shares, Node (including ATS, Aspera Transfer Service), Console,
-only username/password and url are required (either on command line, or from configuration file).
+only username/password and URL are required (either on command line, or from configuration file).
 Those can usually be provided on the command line:
 
 ```bash
@@ -2350,16 +2507,16 @@ This is available:
 - in the `thumbnail` command of `node` when using **gen4/access key** API.
 - when using the `show` command of `preview` plugin.
 - `coffee` and `image` commands of `config` plugin.
-- any displayed value which is an url to image can be displayed with option `format` set to `image`
+- any displayed value which is a URL to image can be displayed with option `format` set to `image`
 
 The following options can be specified in the option `image`:
 
 | Option     | Type    | Description |
 |------------|---------|-------------|
-| reserve    | Integer | Lines reserved to display a status |
-| text       | Bool    | Display text instead of image|
-| double     | Bool    | Display double text resolution (half characters) |
-| font_ratio | Float   | Font height/width ratio in terminal |
+| reserve    | `Integer` | Lines reserved to display a status |
+| text       | `Bool`    | Display text instead of image|
+| double     | `Bool`    | Display double text resolution (half characters) |
+| font_ratio | `Float`   | Font height/width ratio in terminal |
 
 ```bash
 ascli config image https://eudemo.asperademo.com/wallpaper.jpg --ui=text --image=@json:'{"text":true}'
@@ -2392,12 +2549,12 @@ The gem is equipped with traces, mainly for debugging and learning APIs.
 By default logging level is `warn` and the output channel is `stderr`.
 To increase debug level, use option `log_level` (e.g. using command line `--log-level=xx`, env var `ASCLI_LOG_LEVEL`, or an [Option Preset](#option-preset)).
 
-By default passwords and secrets are removed from logs.
-Use option `log_secrets` set to `yes` to reveal secrets in logs.
+By default passwords and secrets are redacted from logs.
+Set option `log_secrets` to `yes` to include secrets in logs.
 
-Available loggers: `stdout`, `stderr`, `syslog`.
+Option `logger`: `stdout`, `stderr`, `syslog`.
 
-Available levels: `debug`, `info`, `warn`, `error`.
+Option `log_level`: `debug`, `info`, `warn`, `error`.
 
 > **Note:** When using the `direct` agent (`ascp`), additional transfer logs can be activated using `ascp` options and `ascp_args`, see [`direct`](#agent-direct).
 
@@ -2439,14 +2596,18 @@ To disable the warning, use option `silent_insecure` set to `no`.
 
 HTTP connection parameters (not `ascp` wss) can be adjusted using option `http_options`:
 
-| Parameter            | Default |
-|----------------------|---------|
-| `read_timeout`       | 60      |
-| `write_timeout`      | 60      |
-| `open_timeout`       | 60      |
-| `keep_alive_timeout` | 2       |
-
-Values are in set **seconds** and can be of type either integer or float.
+| Parameter                 | Default       | Where     |
+|---------------------------|---------------|-----------|
+| `read_timeout`            | 60            | ruby      |
+| `write_timeout`           | 60            | ruby      |
+| `open_timeout`            | 60            | ruby      |
+| `keep_alive_timeout`      | 2             | ruby      |
+| `user_agent`              | `ascli`     | `ascli` |
+| `download_partial_suffix` | .http_partial | `ascli` |
+| `retry_on_error`          | 0             | `ascli` |
+| `retry_sleep`             | nil           | `ascli` |
+
+Time values are in set **seconds** and can be of type either `Integer` or `Float`.
 Default values are the ones of Ruby:
 For a full list, refer to the Ruby library: [`Net::HTTP`](https://ruby-doc.org/stdlib/libdoc/net/http/rdoc/Net/HTTP.html).
 
@@ -2455,7 +2616,7 @@ Like any other option, those can be set either on command line, or in configurat
 Example:
 
 ```bash
-ascli aoc admin res package list --http-options=@json:'{"read_timeout":10.0}'
+ascli aoc admin package list --http-options=@json:'{"read_timeout":10.0}'
 ```
 
 ### Proxy
@@ -2600,7 +2761,7 @@ ascli config ascp info
 
 ```output
 +--------------------+-----------------------------------------------------------+
-| key                | value                                                     |
+| field              | value                                                     |
 +--------------------+-----------------------------------------------------------+
 | ascp               | /Users/laurent/.aspera/ascli/sdk/ascp                     |
 ...
@@ -2717,51 +2878,53 @@ Downloaded: IBMAsperaConnectInstaller-3.11.2.63.dmg
 ### Transfer Clients: Agents
 
 Some of the actions on Aspera Applications lead to file transfers (upload and download) using the FASP protocol (`ascp`).
-
-When a transfer needs to be started, a [**transfer-spec**](#transfer-specification) has been internally prepared.
-This [**transfer-spec**](#transfer-specification) will be executed by a transfer client, here called **Transfer Agent**.
+Transfers will be executed by a transfer client, here called **Transfer Agent**.
 
 The following agents are supported and selected with option `transfer`:
 
-- [`direct`](#agent-direct) : direct execution of `ascp` (local)
-- [`trsdk`](#agent-transfer-sdk) : use of Aspera Transfer SDK (local)
-- [`connect`](#agent-connect-client) : use Connect Client (local)
-- [`alpha`](#agent-desktop-client) : use the new Desktop Client (local)
-- [`node`](#agent-node-api) : use an Aspera Transfer Node (**remote**).
-- [`httpgw`](#agent-http-gateway) : use an Aspera HTTP Gateway (**remote**)
+| `transfer`                         | location | Description of agent          |
+|------------------------------------|----------|-------------------------------|
+| [`direct`](#agent-direct)          | local    | direct execution of `ascp`    |
+| [`transferd`](#agent-transfer-sdk) | local    | Aspera Transfer Daemon        |
+| [`connect`](#agent-connect-client) | local    | Aspera Connect Client         |
+| [`alpha`](#agent-desktop-client)   | local    | Aspera for Desktop            |
+| [`node`](#agent-node-api)          | remote   | Aspera Transfer Node          |
+| [`httpgw`](#agent-http-gateway)    | remote   | Aspera HTTP Gateway           |
 
 > **Note:** All transfer operations are seen from the point of view of the agent.
-For example, a node agent executing an **upload**, or **package send** operation
-will effectively push files to the related server from the agent node.
+For example, an agent executing an **upload**, or **package send** operation will effectively push files to the related server from the system where the agent runs.
 
-`ascli` standardizes on the use of a [**transfer-spec**](#transfer-specification) instead of **native** `ascp` options to provide parameters for a transfer session, as a common method for those three Transfer Agents.
+All of above agents (including `direct`) receive transfer parameters as a [**transfer-spec**](#transfer-specification).
+Parameters in transfer-spec can be modified with option `ts`.
 
-Specific options for agents are provided with option `transfer_info`, cumulatively.
+**Specific** options for agents are provided with option `transfer_info`.
+
+> **Note:** Parameters in `transfer_info` are specific for each agent type and are described in the agents respective sections.
 
 #### Agent: Direct
 
-The `direct` agent directly executes a local `ascp`.
+The `direct` agent directly executes a local `ascp` in `ascli`.
 This is the default agent for `ascli` (option `--transfer=direct`).
-`ascli` will search locally installed Aspera products, including SDK, and use `ascp` from that component.
+`ascli` will locally search installed Aspera products, including SDK, and use `ascp` from that component.
 Refer to section [FASP](#fasp-configuration).
 
 The `transfer_info` option accepts the following optional parameters to control multi-session, Web Socket Session, Resume policy and add any argument to `ascp`:
 
 | Name                   | Type    | Description |
 |------------------------|---------|-------------|
-| `wss`                  | Bool    | Web Socket Session<br/>Enable use of web socket session in case it is available<br/>Default: true |
-| `quiet`                | Bool    | If `true`, then `ascp` progress bar is not shown.<br/>Default: `false` |
-| `trusted_certs`        | Array   | List of repositories for trusted certificates. |
-| `client_ssh_key`       | String  | SSH Keys to use for token-based transfers. One of: `dsa_rsa`, `rsa`, `per_client`. Default: `rsa` |
-| `ascp_args`            | Array   | Array of strings with native `ascp` arguments.<br/>Default: `[]` |
-| `spawn_timeout_sec`    | Float   | Multi session<br/>Verification time that `ascp` is running<br/>Default: `3` |
-| `spawn_delay_sec`      | Float   | Multi session<br/>Delay between startup of sessions<br/>Default: `2` |
-| `multi_incr_udp`       | Bool    | Multi Session<br/>Increment UDP port on multi-session<br/>If `true`, each session will have a different UDP port starting at `fasp_port` (or default 33001)<br/>Else, each session will use `fasp_port` (or `ascp` default)<br/>Default: `true` on Windows, else `false` |
-| `resume`               | Hash    | Resume parameters. See below |
-| `resume.iter_max`      | Integer | Max number of retry on error<br/>Default: `7` |
-| `resume.sleep_initial` | Integer | First Sleep before retry<br/>Default: `2` |
-| `resume.sleep_factor`  | Integer | Multiplier of sleep period between attempts<br/>Default: `2` |
-| `resume.sleep_max`     | Integer | Default: `60` |
+| `wss`                  | `Bool`    | Web Socket Session<br/>Enable use of web socket session in case it is available<br/>Default: true |
+| `quiet`                | `Bool`    | If `true`, then `ascp` progress bar is not shown.<br/>Default: `false` |
+| `trusted_certs`        | `Array`   | List of repositories for trusted certificates. |
+| `client_ssh_key`       | `String` | SSH Keys to use for token-based transfers. One of: `dsa_rsa`, `rsa`, `per_client`. Default: `rsa` |
+| `ascp_args`            | `Array`   | Array of strings with native `ascp` arguments.<br/>Default: `[]` |
+| `spawn_timeout_sec`    | `Float`   | Multi session<br/>Verification time that `ascp` is running<br/>Default: `3` |
+| `spawn_delay_sec`      | `Float`   | Multi session<br/>Delay between startup of sessions<br/>Default: `2` |
+| `multi_incr_udp`       | `Bool`    | Multi Session<br/>Increment UDP port on multi-session<br/>If `true`, each session will have a different UDP port starting at `fasp_port` (or default 33001)<br/>Else, each session will use `fasp_port` (or `ascp` default)<br/>Default: `true` on Windows, else `false` |
+| `resume`               | `Hash`    | Resume parameters. See below |
+| `resume.iter_max`      | `Integer` | Max number of retry on error<br/>Default: `7` |
+| `resume.sleep_initial` | `Integer` | First Sleep before retry<br/>Default: `2` |
+| `resume.sleep_factor`  | `Integer` | Multiplier of sleep period between attempts<br/>Default: `2` |
+| `resume.sleep_max`     | `Integer` | Default: `60` |
 
 In case of transfer interruption, the agent will **resume** a transfer up to `iter_max` time.
 Sleep between iterations is given by the following formula where `iter_index` is the current iteration index, starting at 0:
@@ -2893,12 +3056,12 @@ This is especially useful for direct node-to-node transfers.
 
 Parameters provided in option `transfer_info` are:
 
-| Name     | Type   | Description |
-|----------|--------|-------------|
-| url      | string | URL of the node API</br>Mandatory |
-| username | string | Node api user or access key</br>Mandatory |
-| password | string | Password, secret or bearer token</br>Mandatory |
-| root_id  | string | Root file id</br>Mandatory only for bearer token |
+| Nam  e     | Type   | Description                                      |
+|------------|--------|--------------------------------------------------|
+| `url`      | `String` | URL of the node API</br>Mandatory                |
+| `username` | `String` | Node api user or access key</br>Mandatory        |
+| `password` | `String` | Password, secret or bearer token</br>Mandatory   |
+| `root_id`  | `String` | Root file id</br>Mandatory only for bearer token |
 
 Like any other option, `transfer_info` can get its value from a pre-configured [Option Preset](#option-preset) :
 
@@ -2927,10 +3090,10 @@ Parameters provided in option `transfer_info` are:
 
 | Name                   | Type   | Description                           |
 |------------------------|--------|---------------------------------------|
-| url                    | string | URL of the HTTP GW</br>Mandatory      |
-| upload_chunk_size      | int    | Size in bytes of chunks for upload<br/>Default: `64000`    |
-| api_version            | string | Force use of version (`v1`, `v2`)<br/>Default: `v2`       |
-| synchronous            | bool   | Wait for each message acknowledgment<br/>Default: `false`  |
+| url                    | `String` | URL of the HTTP GW</br>Mandatory      |
+| upload_chunk_size      | `Integer`    | Size in bytes of chunks for upload<br/>Default: `64000`    |
+| api_version            | `String` | Force use of version (`v1`, `v2`)<br/>Default: `v2`       |
+| synchronous            | `Bool`   | Wait for each message acknowledgment<br/>Default: `false`  |
 
 Example:
 
@@ -2945,15 +3108,15 @@ If the application, e.g. AoC or Faspex 5, is configured to use the HTTP Gateway,
 #### Agent: Transfer SDK
 
 Another possibility is to use the Transfer SDK daemon (`asperatransferd`).
-Set option `transfer` to `trsdk`.
+Set option `transfer` to `transferd`.
 
 Options for `transfer_info` are:
 
 | Name     | Type   | Description |
 |----------|--------|-------------|
-| `url`      | string | IP address and port listened by the daemon</br>Mandatory<br/>Default: `:0` |
-| `external` | bool   | Use external daemon, do not start one.<br/>Default: `false` |
-| `keep`     | bool   | Keep the daemon running after exiting `ascli`<br/>Default: `false` |
+| `url`      | `String` | IP address and port listened by the daemon</br>Mandatory<br/>Default: `:0` |
+| `external` | `Bool`   | Use external daemon, do not start one.<br/>Default: `false` |
+| `keep`     | `Bool`   | Keep the daemon running after exiting `ascli`<br/>Default: `false` |
 
 > **Note:** If port zero is specified in the URL, then the daemon will listen on a random available port. If no address is specified, then `127.0.0.1` is used.
 
@@ -3036,91 +3199,92 @@ Columns:
 
 `ascp` argument or environment variable is provided in description.
 
-| Field | Type | D | N | C | T | H | Description |
-| ----- | ---- | - | - | - | - | - | ----------- |
-| apply_local_docroot | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Apply local docroot to source paths.<br/>(--apply-local-docroot) |
-| authentication | string | &nbsp; | &nbsp; | Y | &nbsp; | &nbsp; | value=token for SSH bypass keys, else password asked if not provided.<br/>(&lt;ignored&gt;) |
-| cipher | string | Y | Y | Y | Y | Y | In transit encryption type.<br/>Allowed values: none, aes-128, aes-192, aes-256, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-gcm, aes-192-gcm, aes-256-gcm<br/>(-c (conversion){enum}) |
-| cipher_allowed | string | Y | Y | Y | Y | Y | returned by node API. Valid literals include "aes-128" and "none".<br/>(&lt;ignored&gt;) |
-| compression | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | ascp4 only, 0 / 1?<br/>(&lt;ignored&gt;) |
-| content_protection | string | Y | Y | Y | Y | Y | Enable client-side encryption at rest. (CSEAR, content protection)<br/>Allowed values: encrypt, decrypt<br/>(--file-crypt {enum}) |
-| content_protection_password | string | Y | Y | Y | Y | Y | Specifies CSEAR password. (content protection)<br/>(env:ASPERA_SCP_FILEPASS) |
-| cookie | string | Y | Y | Y | Y | Y | Metadata for transfer specified by application<br/>(env:ASPERA_SCP_COOKIE) |
-| create_dir | bool | Y | Y | Y | Y | Y | Specifies whether to create new directories.<br/>(-d) |
-| delete_before_transfer | bool | Y | Y | Y | Y | Y | Before transfer, delete files that exist at the destination but not at the source.<br/>The source and destination arguments must be directories that have matching names.<br/>Objects on the destination that have the same name but different type or size as objects<br/>on the source are not deleted.<br/>(--delete-before-transfer) |
-| delete_source | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | Remove SRC files after transfer success<br/>(--remove-after-transfer) |
-| destination_root | string | Y | Y | Y | Y | Y | Destination root directory.<br/>(&lt;special&gt;) |
-| destination_root_id | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The file ID of the destination root directory.<br/>Required when using Bearer token auth for the destination node.<br/>(&lt;ignored&gt;) |
-| dgram_size | int | Y | Y | Y | Y | Y | UDP datagram size in bytes<br/>(-Z {int}) |
-| direction | string | Y | Y | Y | Y | Y | Direction of transfer (on client side)<br/>Allowed values: send, receive<br/>(--mode (conversion){enum}) |
-| exclude_newer_than | int | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | skip src files with mtime > arg<br/>(--exclude-newer-than {int}) |
-| exclude_older_than | int | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | skip src files with mtime < arg<br/>(--exclude-older-than {int}) |
-| fasp_port | int | Y | Y | Y | Y | Y | Specifies fasp (UDP) port.<br/>(-O {int}) |
-| fasp_url | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Only used in Faspex.<br/>(&lt;ignored&gt;) |
-| file_checksum | string | Y | Y | &nbsp; | &nbsp; | &nbsp; | Enable checksum reporting for transferred files by specifying the hash to use.<br/>Allowed values: sha-512, sha-384, sha-256, sha1, md5, none<br/>(&lt;ignored&gt;) |
-| http_fallback | bool<br/>string | Y | Y | Y | Y | Y | When true(1), attempts to perform an HTTP transfer if a FASP transfer cannot be performed.<br/>(-y (conversion){bool}\|{string}) |
-| http_fallback_port | int | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Specifies http port when no cipher is used<br/>(-t {int}) |
-| https_fallback_port | int | Y | Y | Y | Y | Y | Specifies https port when cipher is used<br/>(-t {int}) |
-| keepalive | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The session is running in persistent session mode.<br/>(--keepalive) |
-| lock_min_rate | bool | Y | Y | Y | Y | Y | TODO: remove ?<br/>(&lt;ignored&gt;) |
-| lock_min_rate_kbps | bool | &nbsp; | &nbsp; | Y | &nbsp; | &nbsp; | If true, lock the minimum transfer rate to the value set for min_rate_kbps.<br/>If false, users can adjust the transfer rate up to the value set for target_rate_cap_kbps.<br/>(&lt;ignored&gt;) |
-| lock_rate_policy | bool | &nbsp; | &nbsp; | Y | &nbsp; | &nbsp; | If true, lock the rate policy to the default value.<br/>(&lt;ignored&gt;) |
-| lock_target_rate | bool | Y | Y | Y | Y | Y | TODO: remove ?<br/>(&lt;ignored&gt;) |
-| lock_target_rate_kbps | bool | Y | Y | Y | Y | Y | If true, lock the target transfer rate to the default value set for target_rate_kbps.<br/>If false, users can adjust the transfer rate up to the value set for target_rate_cap_kbps.<br/>(&lt;ignored&gt;) |
-| min_rate_cap_kbps | int | Y | Y | Y | Y | Y | The highest minimum rate that an incoming transfer can request, in kilobits per second.<br/>Client minimum rate requests that exceed the minimum rate cap are ignored.<br/>The default value of unlimited applies no cap to the minimum rate. (Default: 0)<br/>(&lt;ignored&gt;) |
-| min_rate_kbps | int | Y | Y | Y | Y | Y | Set the minimum transfer rate in kilobits per second.<br/>(-m {int}) |
-| move_after_transfer | string | Y | Y | &nbsp; | &nbsp; | &nbsp; | The relative path to which the files will be moved after the transfer at the source side. Available as of 3.8.0.<br/>(--move-after-transfer {string}) |
-| multi_session | int | Y | Y | Y | Y | Y | Use multi-session transfer. max 128.<br/>Each participant on one host needs an independent UDP (-O) port.<br/>Large files are split between sessions only when transferring with resume_policy=none.<br/><br/>(&lt;special&gt;) |
-| multi_session_threshold | int | Y | Y | &nbsp; | &nbsp; | &nbsp; | Split files across multiple ascp sessions if their size in bytes is greater than or equal to the specified value.<br/>(0=no file is split)<br/>(--multi-session-threshold {int}) |
-| obfuscate_file_names | bool | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | HTTP Gateway obfuscates file names when set to true.<br/>(&lt;ignored&gt;) |
-| overwrite | string | Y | Y | Y | Y | Y | Overwrite destination files with the source files of the same name.<br/>Allowed values: never, always, diff, older, diff+older<br/>(--overwrite {enum}) |
-| password | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | Password for local Windows user when transfer user associated with node api user is not the same as the one running asperanoded.<br/>Allows impersonating the transfer user and have access to resources (e.g. network shares).<br/>Windows only, node api only.<br/>(&lt;ignored&gt;) |
-| paths | array | Y | Y | Y | Y | Y | Array of path to the source (required) and a path to the destination (optional).<br/>(&lt;special&gt;) |
-| precalculate_job_size | bool | Y | Y | Y | Y | Y | Specifies whether to precalculate the job size.<br/>(--precalculate-job-size) |
-| preserve_access_time | bool | Y | Y | Y | Y | Y | Preserve the source-file access timestamps at the destination.<br/>Because source access times are updated by the transfer operation,<br/>the timestamp that is preserved is the one just before to the transfer.<br/>(--preserve-access-time) |
-| preserve_acls | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve access control lists.<br/>Allowed values: none, native, metafile<br/>(--preserve-acls {enum}) |
-| preserve_creation_time | bool | Y | Y | Y | Y | Y | (Windows only) Preserve source-file creation timestamps at the destination.<br/>Only Windows systems retain information about creation time.<br/>If the destination is not a Windows computer, this option is ignored.<br/>(--preserve-creation-time) |
-| preserve_extended_attrs | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the extended attributes.<br/>Allowed values: none, native, metafile<br/>(--preserve-xattrs {enum}) |
-| preserve_file_owner_gid | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the group ID for a file owner<br/>(--preserve-file-owner-gid) |
-| preserve_file_owner_uid | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the user ID for a file owner<br/>(--preserve-file-owner-uid) |
-| preserve_modification_time | bool | Y | Y | Y | Y | Y | Set the modification time, the last time a file or directory was modified (written), of a transferred file<br/>to the modification of the source file or directory.<br/>Preserve source-file modification timestamps at the destination.<br/>(--preserve-modification-time) |
-| preserve_remote_acls | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve remote access control lists.<br/>Allowed values: none, native, metafile<br/>(--remote-preserve-acls {enum}) |
-| preserve_source_access_time | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the time logged for when the source file was accessed<br/>(--preserve-source-access-time) |
-| preserve_times | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | Preserve file timestamps.<br/>(--preserve-times) |
-| proxy | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Specify the address of the Aspera high-speed proxy server.<br/>dnat(s)://[user[:password]@]server:port<br/>Default ports for DNAT and DNATS protocols are 9091 and 9092.<br/>Password, if specified here, overrides the value of environment variable ASPERA_PROXY_PASS.<br/>(--proxy {string}) |
-| rate_policy | string | Y | Y | Y | Y | Y | The transfer rate policy to use when sharing bandwidth.<br/>Allowed values: low, fair, high, fixed<br/>(--policy {enum}) |
-| rate_policy_allowed | string | &nbsp; | &nbsp; | Y | &nbsp; | &nbsp; | Specifies most aggressive rate policy that is allowed.<br/>Returned by node API.<br/>Allowed values: low, fair, high, fixed<br/>(&lt;ignored&gt;) |
-| read_threads | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | ascp4 only<br/>(&lt;ignored&gt;) |
-| remote_access_key | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The access key ID of the access key that was used to construct the bearer token that is used to authenticate to the remote node.<br/>(&lt;ignored&gt;) |
-| remote_host | string | Y | Y | Y | Y | Y | IP or fully qualified domain name of the remote server<br/>(--host {string}) |
-| remote_password | string | Y | Y | Y | Y | Y | SSH session password<br/>(env:ASPERA_SCP_PASS) |
-| remote_user | string | Y | Y | Y | Y | Y | Remote user. Default value is "xfer" on node or connect.<br/>(--user {string}) |
-| remove_after_transfer | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | Remove SRC files after transfer success<br/>(--remove-after-transfer) |
-| remove_empty_directories | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | Specifies whether to remove empty directories.<br/>(--remove-empty-directories) |
-| remove_empty_source_directory | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Remove empty source subdirectories and remove the source directory itself, if empty<br/>(--remove-empty-source-directory) |
-| remove_skipped | bool | Y | Y | Y | &nbsp; | &nbsp; | Must also have remove_after_transfer set to true, Defaults to false, if true, skipped files will be removed as well.<br/>(--remove-skipped) |
-| resume_policy | string | Y | Y | Y | Y | Y | If a transfer is interrupted or fails to finish, resume without re-transferring the whole files.<br/>Allowed values: none, attrs, sparse_csum, full_csum<br/>(-k (conversion){enum}) |
-| retry_duration | string<br/>int | &nbsp; | Y | Y | &nbsp; | &nbsp; | Specifies how long to wait before retrying transfer. (e.g. "5min")<br/>(&lt;ignored&gt;) |
-| source_root | string | Y | Y | Y | Y | Y | Path to be prepended to each source path.<br/>This is either a conventional path or it can be a URI but only if there is no root defined.<br/>(--source-prefix64 (conversion){string}) |
-| source_root_id | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | The file ID of the source root directory. Required when using Bearer token auth for the source node.<br/>(&lt;ignored&gt;) |
-| src_base | string | Y | Y | &nbsp; | &nbsp; | &nbsp; | Specify the prefix to be stripped off from each source object.<br/>The remaining portion of the source path is kept intact at the destination.<br/>Special care must be taken when used with cloud storage.<br/>(--src-base64 (conversion){string}) |
-| ssh_args | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Array of arguments to pass to SSH. Use with caution.<br/>(&lt;ignored&gt;) |
-| ssh_port | int | Y | Y | Y | Y | Y | Specifies SSH (TCP) port. Default: local:22, other:33001<br/>(-P {int}) |
-| ssh_private_key | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Private key used for SSH authentication.<br/>Shall look like: -----BEGIN RSA PRIV4TE KEY-----\nMII...<br/>Note the JSON encoding: \n for newlines.<br/>(env:ASPERA_SCP_KEY) |
-| ssh_private_key_passphrase | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The passphrase associated with the transfer user's SSH private key. Available as of 3.7.2.<br/>(env:ASPERA_SCP_PASS) |
-| sshfp | string | Y | Y | Y | Y | Y | Check it against server SSH host key fingerprint<br/>(--check-sshfp {string}) |
-| symlink_policy | string | Y | Y | Y | Y | Y | Handle source side symbolic links<br/>Allowed values: follow, copy, copy+force, skip<br/>(--symbolic-links {enum}) |
-| tags | hash | Y | Y | Y | Y | Y | Metadata for transfer as JSON<br/>(--tags64 (conversion){hash}) |
-| target_rate_cap_kbps | int | &nbsp; | &nbsp; | Y | &nbsp; | &nbsp; | Returned by upload/download_setup node API.<br/>(&lt;ignored&gt;) |
-| target_rate_kbps | int | Y | Y | Y | Y | Y | Specifies desired speed for the transfer.<br/>(-l {int}) |
-| target_rate_percentage | string | Y | Y | Y | Y | Y | TODO: remove ?<br/>(&lt;ignored&gt;) |
-| title | string | &nbsp; | Y | Y | &nbsp; | &nbsp; | Title of the transfer<br/>(&lt;ignored&gt;) |
-| token | string | Y | Y | Y | Y | Y | Authorization token: Bearer, Basic or ATM (Also arg -W)<br/>(env:ASPERA_SCP_TOKEN) |
-| use_ascp4 | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | specify version of protocol<br/>(&lt;special&gt;) |
-| use_system_ssh | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | TODO, comment...<br/>(&lt;ignored&gt;) |
-| write_threads | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | ascp4 only<br/>(&lt;ignored&gt;) |
-| wss_enabled | bool | Y | Y | Y | Y | Y | Server has Web Socket service enabled<br/>(&lt;special&gt;) |
-| wss_port | int | Y | Y | Y | Y | Y | TCP port used for websocket service feed<br/>(&lt;special&gt;) |
+| Field | Type | N | D | A | T | H | C | Description |
+| ----- | ---- | - | - | - | - | - | - | ----------- |
+| apply_local_docroot | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Apply local docroot to source paths.<br/>(--apply-local-docroot) |
+| authentication | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | value=token for SSH bypass keys, else password asked if not provided.<br/>(&lt;ignored&gt;) |
+| cipher | string | Y | Y | Y | Y | Y | Y | In transit encryption type.<br/>Allowed values: none, aes-128, aes-192, aes-256, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-gcm, aes-192-gcm, aes-256-gcm<br/>(-c (conversion){enum}) |
+| cipher_allowed | string | Y | Y | Y | Y | Y | Y | returned by node API. Valid literals include "aes-128" and "none".<br/>(&lt;ignored&gt;) |
+| compression | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | ascp4 only, 0 / 1?<br/>(&lt;ignored&gt;) |
+| content_protection | string | Y | Y | Y | Y | Y | Y | Enable client-side encryption at rest. (CSEAR, content protection)<br/>Allowed values: encrypt, decrypt<br/>(--file-crypt {enum}) |
+| content_protection_password | string | Y | Y | Y | Y | Y | Y | Specifies CSEAR password. (content protection)<br/>(env:ASPERA_SCP_FILEPASS) |
+| cookie | string | Y | Y | Y | Y | Y | Y | Metadata for transfer specified by application<br/>(env:ASPERA_SCP_COOKIE) |
+| create_dir | bool | Y | Y | Y | Y | Y | Y | Specifies whether to create new directories.<br/>(-d) |
+| delete_before_transfer | bool | Y | Y | Y | Y | Y | Y | Before transfer, delete files that exist at the destination but not at the source.<br/>The source and destination arguments must be directories that have matching names.<br/>Objects on the destination that have the same name but different type or size as objects<br/>on the source are not deleted.<br/>(--delete-before-transfer) |
+| delete_source | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Remove SRC files after transfer success<br/>(--remove-after-transfer) |
+| destination_root | string | Y | Y | Y | Y | Y | Y | Destination root directory.<br/>(&lt;special&gt;) |
+| destination_root_id | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The file ID of the destination root directory.<br/>Required when using Bearer token auth for the destination node.<br/>(&lt;ignored&gt;) |
+| dgram_size | int | Y | Y | Y | Y | Y | Y | UDP datagram size in bytes<br/>(-Z {int}) |
+| direction | string | Y | Y | Y | Y | Y | Y | Direction of transfer (on client side)<br/>Allowed values: send, receive<br/>(--mode (conversion){enum}) |
+| exclude_newer_than | string | Y | Y | Y | Y | Y | Y | Exclude files, but not directories, from the transfer if they are newer than the specified number of seconds added to the source computer's epoch. e.g. "-86400" for newer than a day back.<br/>(--exclude-newer-than {string}) |
+| exclude_older_than | string | Y | Y | Y | Y | Y | Y | Exclude files, but not directories, from the transfer if they are older than the specified number of seconds added to the source computer's epoch. e.g. "-86400" for older than a day back.<br/>(--exclude-older-than {string}) |
+| fasp_port | int | Y | Y | Y | Y | Y | Y | Specifies fasp (UDP) port.<br/>(-O {int}) |
+| fasp_url | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Only used in Faspex.<br/>(&lt;ignored&gt;) |
+| file_checksum | string | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Enable checksum reporting for transferred files by specifying the hash to use.<br/>Allowed values: sha-512, sha-384, sha-256, sha1, md5, none<br/>(&lt;ignored&gt;) |
+| http_fallback | bool<br/>string | Y | Y | Y | Y | Y | Y | When true(1), attempts to perform an HTTP transfer if a FASP transfer cannot be performed.<br/>(-y (conversion){bool}\|{string}) |
+| http_fallback_port | int | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Specifies http port when no cipher is used<br/>(-t {int}) |
+| https_fallback_port | int | Y | Y | Y | Y | Y | Y | Specifies https port when cipher is used<br/>(-t {int}) |
+| keepalive | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The session is running in persistent session mode.<br/>(--keepalive) |
+| lock_min_rate | bool | Y | Y | Y | Y | Y | Y | TODO: remove ?<br/>(&lt;ignored&gt;) |
+| lock_min_rate_kbps | bool | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | If true, lock the minimum transfer rate to the value set for min_rate_kbps.<br/>If false, users can adjust the transfer rate up to the value set for target_rate_cap_kbps.<br/>(&lt;ignored&gt;) |
+| lock_rate_policy | bool | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | If true, lock the rate policy to the default value.<br/>(&lt;ignored&gt;) |
+| lock_target_rate | bool | Y | Y | Y | Y | Y | Y | TODO: remove ?<br/>(&lt;ignored&gt;) |
+| lock_target_rate_kbps | bool | Y | Y | Y | Y | Y | Y | If true, lock the target transfer rate to the default value set for target_rate_kbps.<br/>If false, users can adjust the transfer rate up to the value set for target_rate_cap_kbps.<br/>(&lt;ignored&gt;) |
+| min_rate_cap_kbps | int | Y | Y | Y | Y | Y | Y | The highest minimum rate that an incoming transfer can request, in kilobits per second.<br/>Client minimum rate requests that exceed the minimum rate cap are ignored.<br/>The default value of unlimited applies no cap to the minimum rate. (Default: 0)<br/>(&lt;ignored&gt;) |
+| min_rate_kbps | int | Y | Y | Y | Y | Y | Y | Set the minimum transfer rate in kilobits per second.<br/>(-m {int}) |
+| move_after_transfer | string | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The relative path to which the files will be moved after the transfer at the source side. Available as of 3.8.0.<br/>(--move-after-transfer {string}) |
+| multi_session | int | Y | Y | Y | Y | Y | Y | Use multi-session transfer. max 128.<br/>Each participant on one host needs an independent UDP (-O) port.<br/>Large files are split between sessions only when transferring with resume_policy=none.<br/><br/>(&lt;special&gt;) |
+| multi_session_threshold | int | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Split files across multiple ascp sessions if their size in bytes is greater than or equal to the specified value.<br/>(0=no file is split)<br/>(--multi-session-threshold {int}) |
+| obfuscate_file_names | bool | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | &nbsp; | HTTP Gateway obfuscates file names when set to true.<br/>(&lt;ignored&gt;) |
+| overwrite | string | Y | Y | Y | Y | Y | Y | Overwrite destination files with the source files of the same name.<br/>Allowed values: never, always, diff, older, diff+older<br/>(--overwrite {enum}) |
+| password | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Password for local Windows user when transfer user associated with node api user is not the same as the one running asperanoded.<br/>Allows impersonating the transfer user and have access to resources (e.g. network shares).<br/>Windows only, node api only.<br/>(&lt;ignored&gt;) |
+| paths | array | Y | Y | Y | Y | Y | Y | Array of path to the source (required) and a path to the destination (optional).<br/>(&lt;special&gt;) |
+| precalculate_job_size | bool | Y | Y | Y | Y | Y | Y | Specifies whether to precalculate the job size.<br/>(--precalculate-job-size) |
+| preserve_access_time | bool | Y | Y | Y | Y | Y | Y | Preserve the source-file access timestamps at the destination.<br/>Because source access times are updated by the transfer operation,<br/>the timestamp that is preserved is the one just before to the transfer.<br/>(--preserve-access-time) |
+| preserve_acls | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve access control lists.<br/>Allowed values: none, native, metafile<br/>(--preserve-acls {enum}) |
+| preserve_creation_time | bool | Y | Y | Y | Y | Y | Y | (Windows only) Preserve source-file creation timestamps at the destination.<br/>Only Windows systems retain information about creation time.<br/>If the destination is not a Windows computer, this option is ignored.<br/>(--preserve-creation-time) |
+| preserve_extended_attrs | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the extended attributes.<br/>Allowed values: none, native, metafile<br/>(--preserve-xattrs {enum}) |
+| preserve_file_owner_gid | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the group ID for a file owner<br/>(--preserve-file-owner-gid) |
+| preserve_file_owner_uid | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the user ID for a file owner<br/>(--preserve-file-owner-uid) |
+| preserve_modification_time | bool | Y | Y | Y | Y | Y | Y | Set the modification time, the last time a file or directory was modified (written), of a transferred file<br/>to the modification of the source file or directory.<br/>Preserve source-file modification timestamps at the destination.<br/>(--preserve-modification-time) |
+| preserve_remote_acls | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve remote access control lists.<br/>Allowed values: none, native, metafile<br/>(--remote-preserve-acls {enum}) |
+| preserve_source_access_time | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve the time logged for when the source file was accessed<br/>(--preserve-source-access-time) |
+| preserve_times | bool | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Preserve file timestamps.<br/>(--preserve-times) |
+| proxy | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Specify the address of the Aspera high-speed proxy server.<br/>dnat(s)://[user[:password]@]server:port<br/>Default ports for DNAT and DNATS protocols are 9091 and 9092.<br/>Password, if specified here, overrides the value of environment variable ASPERA_PROXY_PASS.<br/>(--proxy {string}) |
+| rate_policy | string | Y | Y | Y | Y | Y | Y | The transfer rate policy to use when sharing bandwidth.<br/>Allowed values: low, fair, high, fixed<br/>(--policy {enum}) |
+| rate_policy_allowed | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | Specifies most aggressive rate policy that is allowed.<br/>Returned by node API.<br/>Allowed values: low, fair, high, fixed<br/>(&lt;ignored&gt;) |
+| read_threads | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | ascp4 only<br/>(&lt;ignored&gt;) |
+| remote_access_key | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The access key ID of the access key that was used to construct the bearer token that is used to authenticate to the remote node.<br/>(&lt;ignored&gt;) |
+| remote_host | string | Y | Y | Y | Y | Y | Y | IP or fully qualified domain name of the remote server<br/>(--host {string}) |
+| remote_password | string | Y | Y | Y | Y | Y | Y | SSH session password<br/>(env:ASPERA_SCP_PASS) |
+| remote_user | string | Y | Y | Y | Y | Y | Y | Remote user. Default value is "xfer" on node or connect.<br/>(--user {string}) |
+| remove_after_transfer | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Remove SRC files after transfer success<br/>(--remove-after-transfer) |
+| remove_empty_directories | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Specifies whether to remove empty directories.<br/>(--remove-empty-directories) |
+| remove_empty_source_directory | bool | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Remove empty source subdirectories and remove the source directory itself, if empty<br/>(--remove-empty-source-directory) |
+| remove_skipped | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | Y | Must also have remove_after_transfer set to true, Defaults to false, if true, skipped files will be removed as well.<br/>(--remove-skipped) |
+| resume_policy | string | Y | Y | Y | Y | Y | Y | If a transfer is interrupted or fails to finish, resume without re-transferring the whole files.<br/>Allowed values: none, attrs, sparse_csum, full_csum<br/>(-k (conversion){enum}) |
+| retry_duration | string<br/>int | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | Specifies how long to wait before retrying transfer. (e.g. "5min")<br/>(&lt;ignored&gt;) |
+| source_root | string | Y | Y | Y | Y | Y | Y | Path to be prepended to each source path.<br/>This is either a conventional path or it can be a URI but only if there is no root defined.<br/>(--source-prefix64 (conversion){string}) |
+| source_root_id | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The file ID of the source root directory. Required when using Bearer token auth for the source node.<br/>(&lt;ignored&gt;) |
+| src_base | string | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Specify the prefix to be stripped off from each source object.<br/>The remaining portion of the source path is kept intact at the destination.<br/>Special care must be taken when used with cloud storage.<br/>(--src-base64 (conversion){string}) |
+| ssh_args | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Array of arguments to pass to SSH. Use with caution.<br/>(&lt;ignored&gt;) |
+| ssh_port | int | Y | Y | Y | Y | Y | Y | Specifies SSH (TCP) port. Default: local:22, other:33001<br/>(-P {int}) |
+| ssh_private_key | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Private key used for SSH authentication.<br/>Shall look like: -----BEGIN RSA PRIV4TE KEY-----\nMII...<br/>Note the JSON encoding: \n for newlines.<br/>(env:ASPERA_SCP_KEY) |
+| ssh_private_key_passphrase | string | &nbsp; | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | The passphrase associated with the transfer user's SSH private key. Available as of 3.7.2.<br/>(env:ASPERA_SCP_PASS) |
+| sshfp | string | Y | Y | Y | Y | Y | Y | Check it against server SSH host key fingerprint<br/>(--check-sshfp {string}) |
+| symlink_policy | string | Y | Y | Y | Y | Y | Y | Handle source side symbolic links<br/>Allowed values: follow, copy, copy+force, skip<br/>(--symbolic-links {enum}) |
+| tags | hash | Y | Y | Y | Y | Y | Y | Metadata for transfer as JSON. Key `aspera` is reserved. Key `aspera.xfer_retry` specified a retry timeout for node api initiated transfers.<br/>(--tags64 (conversion){hash}) |
+| target_rate_cap_kbps | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | Returned by upload/download_setup node API.<br/>(&lt;ignored&gt;) |
+| target_rate_kbps | int | Y | Y | Y | Y | Y | Y | Specifies desired speed for the transfer.<br/>(-l {int}) |
+| target_rate_percentage | string | Y | Y | Y | Y | Y | Y | TODO: remove ?<br/>(&lt;ignored&gt;) |
+| title | string | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | Y | Title of the transfer<br/>(&lt;ignored&gt;) |
+| token | string | Y | Y | Y | Y | Y | Y | Authorization token: Bearer, Basic or ATM (Also arg -W)<br/>(env:ASPERA_SCP_TOKEN) |
+| use_ascp4 | bool | Y | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | specify version of protocol<br/>(&lt;special&gt;) |
+| use_system_ssh | string | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | TODO, comment...<br/>(&lt;ignored&gt;) |
+| write_threads | int | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | ascp4 only<br/>(&lt;ignored&gt;) |
+| wss_enabled | bool | Y | Y | Y | Y | Y | Y | Server has Web Socket service enabled<br/>(&lt;special&gt;) |
+| wss_port | int | Y | Y | Y | Y | Y | Y | TCP port used for websocket service feed<br/>(&lt;special&gt;) |
+| xfer_max_retries | int | Y | &nbsp; | &nbsp; | &nbsp; | &nbsp; | &nbsp; | maximum number of retries, for node API initiated transfers. Shall not exceed aspera.conf `transfer_manager_max_retries` (default 5).<br/>(&lt;ignored&gt;) |
 
 #### Destination folder for transfers
 
@@ -3516,9 +3680,9 @@ where:
 | Name   | Type | Description |
 |--------|------|-------------|
 |count   |int   |Number of files<br/>Mandatory|
-|file    |string|Basename for files<br>Default: `file`|
-|size    |int   |Size of first file.<br>Default: 0|
-|inc     |int   |Increment applied to determine next file size<br>Default: 0|
+|file    |string|Basename for files<br/>Default: `file`|
+|size    |int   |Size of first file.<br/>Default: 0|
+|inc     |int   |Increment applied to determine next file size<br/>Default: 0|
 |seq     |enum  |Sequence in determining next file size<br/>Values: random, sequential<br/>Default: sequential|
 |buf_init|enum  |How source data is initialized<br/>Option 'none' is not allowed for downloads.<br/>Values:none, zero, random<br/>Default:zero|
 
@@ -3565,7 +3729,7 @@ ascli server upload "faux:///mydir?file=testfile&count=1m&size=0&inc=2&seq=seque
 ```text
 ascli -h
 NAME
-        ascli -- a command line tool for Aspera Applications (v4.19.0)
+        ascli -- a command line tool for Aspera Applications (v4.21.1)
 
 SYNOPSIS
         ascli COMMANDS [OPTIONS] [ARGS]
@@ -3597,14 +3761,14 @@ OPTIONS: global
         --interactive=ENUM           Use interactive input of missing params: [no], yes
         --ask-options=ENUM           Ask even optional options: [no], yes
         --struct-parser=ENUM         Default parser when expected value is a struct: json, ruby
-        --format=ENUM                Output format: text, nagios, ruby, json, jsonpp, yaml, [table], multi, csv, image
+        --format=ENUM                Output format: text, nagios, ruby, json, jsonpp, yaml, [table], csv, image
         --output=VALUE               Destination for results (String)
         --display=ENUM               Output only some information: [info], data, error
         --fields=VALUE               Comma separated list of: fields, or ALL, or DEF (String, Array, Regexp, Proc)
         --select=VALUE               Select only some items in lists: column, value (Hash, Proc)
         --table-style=VALUE          Table display style (Hash)
-        --flat-hash=ENUM             Display deep values as additional keys: no, [yes]
-        --transpose-single=ENUM      Single object fields output vertically: no, [yes]
+        --flat-hash=ENUM             (Table) Display deep values as additional keys: no, [yes]
+        --multi-single=ENUM          (Table) Control how object list is displayed as single table, or multiple objects: [no], yes, single
         --show-secrets=ENUM          Show secrets on command output: [no], yes
         --image=VALUE                Options for image display (Hash)
     -h, --help                       Show this message
@@ -3619,17 +3783,12 @@ OPTIONS: global
         --log-secrets=ENUM           Show passwords in logs: [no], yes
         --clean-temp=ENUM            Cleanup temporary files on exit: no, [yes]
         --pid-file=VALUE             Write process identifier to file, delete on exit (String)
-
-COMMAND: config
-SUBCOMMANDS: ascp check_update coffee detect documentation echo email_test file flush_tokens folder gem genkey image initdemo open platform plugins preset proxy_check pubkey remote_certificate smtp_settings throw vault wizard
-OPTIONS:
         --home=VALUE                 Home folder for tool (String)
         --config-file=VALUE          Path to YAML file with preset configuration
         --secret=VALUE               Secret for access keys
         --vault=VALUE                Vault for secrets (Hash)
         --vault-password=VALUE       Vault password
-        --query=VALUE                Additional filter for for some commands (list/delete) (Hash)
-        --value=VALUE                Value for create, update, list filter (Hash) (deprecated: (4.14) Use positional value for create/modify or option: query for list/delete)
+        --query=VALUE                Additional filter for for some commands (list/delete) (Hash, Array)
         --property=VALUE             Name of property to set (modify operation)
         --bulk=ENUM                  Bulk operation (only some): [no], yes
         --bfail=ENUM                 Bulk operation error handling: no, [yes]
@@ -3657,14 +3816,17 @@ OPTIONS:
         --http-proxy=VALUE           URL for HTTP proxy with optional credentials (String)
         --cache-tokens=ENUM          Save and reuse OAuth tokens: no, [yes]
         --fpac=VALUE                 Proxy auto configuration script
-        --proxy-credentials=VALUE    HTTP proxy credentials for fpac. Array: user,password (Array)
+        --proxy-credentials=VALUE    HTTP proxy credentials for fpac: user, password (Array)
         --ts=VALUE                   Override transfer spec values (Hash)
         --to-folder=VALUE            Destination folder for transferred files
         --sources=VALUE              How list of transferred files is provided (@args,@ts,Array)
         --src-type=ENUM              Type of file list: [list], pair
-        --transfer=ENUM              Type of transfer agent: node, [direct], alpha, httpgw, connect, trsdk
+        --transfer=ENUM              Type of transfer agent: node, [direct], alpha, transferd, httpgw, connect
         --transfer-info=VALUE        Parameters for transfer agent (Hash)
 
+COMMAND: config
+SUBCOMMANDS: ascp check_update coffee detect documentation download echo email_test file folder gem genkey image initdemo open platform plugins preset proxy_check pubkey remote_certificate smtp_settings test tokens transferd vault wizard
+
 
 COMMAND: shares
 SUBCOMMANDS: admin files health
@@ -3684,7 +3846,8 @@ OPTIONS:
         --asperabrowserurl=VALUE     URL for simple aspera web ui
         --sync-name=VALUE            Sync name
         --default-ports=ENUM         Use standard FASP ports or get from node api (gen4): no, [yes]
-        --root-id=VALUE              File id of top folder if using bearer tokens
+        --node-cache=ENUM            Set to no to force actual file system read (gen4): no, [yes]
+        --root-id=VALUE              File id of top folder when using access key (override AK root id)
         --sync-info=VALUE            Information for sync instance and sessions (Hash)
 
 
@@ -3833,12 +3996,6 @@ OPTIONS:
         --workspace=VALUE            Name of workspace (String, NilClass)
         --new-user-option=VALUE      New user creation option for unknown package recipients (Hash)
         --validate-metadata=ENUM     Validate shared inbox metadata: no, [yes]
-        --validator=VALUE            Identifier of validator (optional for central)
-        --asperabrowserurl=VALUE     URL for simple aspera web ui
-        --sync-name=VALUE            Sync name
-        --default-ports=ENUM         Use standard FASP ports or get from node api (gen4): no, [yes]
-        --root-id=VALUE              File id of top folder if using bearer tokens
-        --sync-info=VALUE            Information for sync instance and sessions (Hash)
 
 
 COMMAND: server
@@ -3873,6 +4030,22 @@ Bulk creation and deletion of resources are possible using option `bulk` (`yes`,
 In that case, the operation expects an `Array` of `Hash` instead of a simple `Hash` using the [Extended Value Syntax](#extended-value-syntax).
 This option is available only for some of the resources: if you need it: try and see if the entities you try to create or delete support this option.
 
+### Option: `query`
+
+The `query` option can generally be used to add URL parameters to commands that list ressources.
+It takes either a `Hash` or an `Array`, corresponding to key/value pairs that appear in the query part of request.
+
+For example: `--query=@json:'{"p1":"v1","p2":"v2"}'` leads to query: `?p1=v1&p2=v2`.
+
+If the same parameter needs to be provided several times, then it's possible as well to provide an Array or 2-element Array: `--query=@json:'[["p1":,"v1"],["p2":"v2"]]'` leads to the same result as previously.
+
+If PHP's style array is used, then one can use either:
+
+- `--query=@json:'{"a":["[]","v1","v2"]}'`
+- `--query=@json:'[["a[]","v1"],["a[]","v2"]]'`
+
+Both result in: `?a[]=v1&a[]=v2`.
+
 ### Plugins
 
 `ascli` uses a plugin mechanism.
@@ -3963,7 +4136,7 @@ ascli aoc user profile show
 Optionally, it is possible to create a new organization-specific integration, i.e. client application identification.
 For this, specify the option: `--use-generic-client=no`.
 
-If you already know the application, and want to limit the detection to it, provide url and plugin name:
+If you already know the application, and want to limit the detection to it, provide URL and plugin name:
 
 ```bash
 ascli config wizard _your_instance_ aoc
@@ -3981,7 +4154,7 @@ Several types of OAuth authentication are supported:
 
 - JSON Web Token (JWT) : authentication is secured by a private key (recommended for `ascli`)
 - Web based authentication : authentication is made by user using a browser
-- URL Token : external users authentication with url tokens (public links)
+- URL Token : external users authentication with URL tokens (public links)
 
 The authentication method is controlled by option `auth`.
 
@@ -4016,7 +4189,7 @@ Let's start by a registration with web based authentication (auth=web):
   - leave the JWT part for now
 - **Save**
 
-> **Note:** For web based authentication, `ascli` listens on a local port (e.g. specified by the redirect_uri, in this example: 12345), and the browser will provide the OAuth code there. For ``ascli`, HTTP is required, and 12345 is the default port.
+> **Note:** For web based authentication, `ascli` listens on a local port (e.g. specified by the redirect_uri, in this example: 12345), and the browser will provide the OAuth code there. For `ascli`, HTTP is required, and 12345 is the default port.
 
 Once the client is registered, a **Client ID** and **Secret** are created, these values will be used in the next step.
 
@@ -4070,7 +4243,7 @@ If you are not using the built-in client_id and secret, JWT needs to be authoriz
 - Using command line
 
 ```bash
-ascli aoc admin res client list
+ascli aoc admin client list
 ```
 
 ```output
@@ -4082,7 +4255,7 @@ ascli aoc admin res client list
 ```
 
 ```bash
-ascli aoc admin res client modify my_BJbQiFw @json:'{"jwt_grant_enabled":true,"explicit_authorization_required":false}'
+ascli aoc admin client modify my_BJbQiFw @json:'{"jwt_grant_enabled":true,"explicit_authorization_required":false}'
 ```
 
 ```output
@@ -4107,7 +4280,7 @@ Open the previously generated public key located here: `$HOME/.aspera/ascli/my_p
 ##### Using command line
 
 ```bash
-ascli aoc admin res user list
+ascli aoc admin user list
 ```
 
 ```output
@@ -4194,7 +4367,7 @@ ascli aoc files bearer_token_node /
 ```
 
 ```bash
-ascli aoc admin res node v4 1234 --secret=_ak_secret_here_ bearer_token_node /
+ascli aoc admin node v4 1234 --secret=_ak_secret_here_ bearer_token_node /
 ```
 
 ### Administration
@@ -4205,7 +4378,8 @@ It allows actions (create, update, delete) on **resources**: users, group, nodes
 
 #### Listing resources
 
-The command `aoc admin res <type> list` lists all entities of given type. It uses paging and multiple requests if necessary.
+The command `aoc admin <type> list` lists all entities of given type.
+It uses paging and multiple requests if necessary.
 
 The option `query` can be optionally used.
 It expects a `Hash` using [Extended Value Syntax](#extended-value-syntax), generally provided using: `--query=@json:{...}`.
@@ -4236,19 +4410,19 @@ Examples:
 - List users with `laurent` in name:
 
 ```bash
-ascli aoc admin res user list --query=@json:'{"q":"laurent"}'
+ascli aoc admin user list --query=@json:'{"q":"laurent"}'
 ```
 
 - List users who logged-in before a date:
 
 ```bash
-ascli aoc admin res user list --query=@json:'{"q":"last_login_at:<2018-05-28"}'
+ascli aoc admin user list --query=@json:'{"q":"last_login_at:<2018-05-28"}'
 ```
 
 - List external users and sort in reverse alphabetical order using name:
 
 ```bash
-ascli aoc admin res user list --query=@json:'{"member_of_any_workspace":false,"sort":"-name"}'
+ascli aoc admin user list --query=@json:'{"member_of_any_workspace":false,"sort":"-name"}'
 ```
 
 Refer to the AoC API for full list of query parameters, or use the browser in developer mode with the web UI.
@@ -4261,17 +4435,17 @@ Resources are identified by a unique `id`, as well as a unique `name` (case inse
 
 To execute an action on a specific resource, select it using one of those methods:
 
-- **recommended**: give id directly on command line **after the action**: `aoc admin res node show 123`
-- Give name on command line **after the action**: `aoc admin res node show name abc`
-- Provide option `id` : `aoc admin res node show 123`
-- Provide option `name` : `aoc admin res node show --name=abc`
+- **recommended**: give id directly on command line **after the action**: `aoc admin node show 123`
+- Give name on command line **after the action**: `aoc admin node show name abc`
+- Provide option `id` : `aoc admin node show 123`
+- Provide option `name` : `aoc admin node show --name=abc`
 
 #### Creating a resource
 
 New resources (users, groups, workspaces, etc..) can be created using a command like:
 
 ```bash
-ascli aoc admin res create <resource type> @json:'{<...parameters...>}'
+ascli aoc admin create <resource type> @json:'{<...parameters...>}'
 ```
 
 Some of the API endpoints are described [here](https://developer.ibm.com/apis/catalog?search=%22aspera%20on%20cloud%20api%22). Sadly, not all.
@@ -4279,7 +4453,7 @@ Some of the API endpoints are described [here](https://developer.ibm.com/apis/ca
 Nevertheless, it is possible to guess the structure of the creation value by simply dumping an existing resource, and use the same parameters for the creation.
 
 ```bash
-ascli aoc admin res group show 12345 --format=json
+ascli aoc admin group show 12345 --format=json
 ```
 
 ```json
@@ -4291,7 +4465,7 @@ Remove the parameters that are either obviously added by the system: `id`, `crea
 And then craft your command:
 
 ```bash
-ascli aoc admin res group create @json:'{"description":"test to delete","name":"test 1 to delete","saml_group":false}'
+ascli aoc admin group create @json:'{"description":"test to delete","name":"test 1 to delete","saml_group":false}'
 ```
 
 If the command returns an error, example:
@@ -4318,7 +4492,7 @@ The secret is provided using the `secret` option.
 For example in a command like:
 
 ```bash
-ascli aoc admin res node 123 --secret="my_secret_here" v3 info
+ascli aoc admin node 123 --secret="my_secret_here" v3 info
 ```
 
 It is also possible to store secrets in the [secret vault](#secret-vault) and then automatically find the related secret using the [config finder](#configuration-finder).
@@ -4407,7 +4581,7 @@ Current Workspace: Default (default)
 #### Example: Bulk creation of users
 
 ```bash
-ascli aoc admin res user create --bulk=yes @json:'[{"email":"dummyuser1@example.com"},{"email":"dummyuser2@example.com"}]'
+ascli aoc admin user create --bulk=yes @json:'[{"email":"dummyuser1@example.com"},{"email":"dummyuser2@example.com"}]'
 ```
 
 ```output
@@ -4422,7 +4596,7 @@ ascli aoc admin res user create --bulk=yes @json:'[{"email":"dummyuser1@example.
 #### Example: Find with filter and delete
 
 ```bash
-ascli aoc admin res user list --query='@json:{"q":"dummyuser"}' --fields=id,email
+ascli aoc admin user list --query='@json:{"q":"dummyuser"}' --fields=id,email
 ```
 
 ```output
@@ -4435,7 +4609,7 @@ ascli aoc admin res user list --query='@json:{"q":"dummyuser"}' --fields=id,emai
 ```
 
 ```bash
-ascli aoc admin res user list --query='@json:{"q":"dummyuser"}' --fields=id --display=data --format=csv | ascli aoc admin res user delete @lines:@stdin: --bulk=yes
+ascli aoc admin user list --query='@json:{"q":"dummyuser"}' --fields=id --display=data --format=csv | ascli aoc admin user delete @lines:@stdin: --bulk=yes
 ```
 
 ```output
@@ -4450,7 +4624,7 @@ ascli aoc admin res user list --query='@json:{"q":"dummyuser"}' --fields=id --di
 #### Example: Find deactivated users since more than 2 years
 
 ```ruby
-ascli aoc admin res user list --query=@ruby:'{"deactivated"=>true,"q"=>"last_login_at:<#{(DateTime.now.to_time.utc-2*365*86400).iso8601}"}'
+ascli aoc admin user list --query=@ruby:'{"deactivated"=>true,"q"=>"last_login_at:<#{(DateTime.now.to_time.utc-2*365*86400).iso8601}"}'
 ```
 
 To delete them use the same method as before
@@ -4482,7 +4656,7 @@ ascli aoc admin resource node --name=_node_name_ --secret=_secret_ v4 access_key
 #### Example: Display transfer events (ops/transfer)
 
 ```bash
-ascli aoc admin res node --secret=_secret_ v3 transfer list --query=@json:'[["q","*"],["count",5]]'
+ascli aoc admin node --secret=_secret_ v3 transfer list --query=@json:'[["q","*"],["count",5]]'
 ```
 
 Examples of query:
@@ -4498,13 +4672,13 @@ Examples of query:
 #### Example: Display node events (events)
 
 ```bash
-ascli aoc admin res node --secret=_secret_ v3 events
+ascli aoc admin node --secret=_secret_ v3 events
 ```
 
 #### Example: Display members of a workspace
 
 ```bash
-ascli aoc admin res workspace_membership list --fields=member_type,manager,member.email --query=@json:'{"embed":"member","inherited":false,"workspace_id":11363,"sort":"name"}'
+ascli aoc admin workspace_membership list --fields=member_type,manager,member.email --query=@json:'{"embed":"member","inherited":false,"workspace_id":11363,"sort":"name"}'
 ```
 
 ```output
@@ -4512,7 +4686,7 @@ ascli aoc admin res workspace_membership list --fields=member_type,manager,membe
 | member_type | manager |           member.email           |
 +-------------+---------+----------------------------------+
 | user        | true    | john.curtis@email.com            |
-| user        | false   | someuser@example.com |
+| user        | false   | someuser@example.com             |
 | user        | false   | jean.dupont@me.com               |
 | user        | false   | another.user@example.com         |
 | group       | false   |                                  |
@@ -4532,20 +4706,20 @@ a- Get id of first workspace
 
 ```bash
 WS1='First Workspace'
-WS1ID=$(ascli aoc admin res workspace list --query=@json:'{"q":"'"$WS1"'"}' --select=@json:'{"name":"'"$WS1"'"}' --fields=id --format=csv)
+WS1ID=$(ascli aoc admin workspace list --query=@json:'{"q":"'"$WS1"'"}' --select=@json:'{"name":"'"$WS1"'"}' --fields=id --format=csv)
 ```
 
 b- Get id of second workspace
 
 ```bash
 WS2='Second Workspace'
-WS2ID=$(ascli aoc admin res workspace list --query=@json:'{"q":"'"$WS2"'"}' --select=@json:'{"name":"'"$WS2"'"}' --fields=id --format=csv)
+WS2ID=$(ascli aoc admin workspace list --query=@json:'{"q":"'"$WS2"'"}' --select=@json:'{"name":"'"$WS2"'"}' --fields=id --format=csv)
 ```
 
 c- Extract membership information
 
 ```bash
-ascli aoc admin res workspace_membership list --fields=manager,member_id,member_type,workspace_id --query=@json:'{"workspace_id":'"$WS1ID"'}' --format=jsonpp --output=ws1_members.json
+ascli aoc admin workspace_membership list --fields=manager,member_id,member_type,workspace_id --query=@json:'{"workspace_id":'"$WS1ID"'}' --format=jsonpp --output=ws1_members.json
 ```
 
 d- Convert to creation data for second workspace:
@@ -4563,13 +4737,13 @@ jq '[.[] | {member_type,member_id,workspace_id,manager,workspace_id:"'"$WS2ID"'"
 e- Add members to second workspace
 
 ```bash
-ascli aoc admin res workspace_membership create --bulk=yes @json:@file:ws2_members.json
+ascli aoc admin workspace_membership create --bulk=yes @json:@file:ws2_members.json
 ```
 
 #### Example: Get users who did not log since a date
 
 ```bash
-ascli aoc admin res user list --fields=email --query=@json:'{"q":"last_login_at:<2018-05-28"}'
+ascli aoc admin user list --fields=email --query=@json:'{"q":"last_login_at:<2018-05-28"}'
 ```
 
 ```output
@@ -4584,7 +4758,7 @@ ascli aoc admin res user list --fields=email --query=@json:'{"q":"last_login_at:
 #### Example: List **Limited** users
 
 ```bash
-ascli aoc admin res user list --fields=email --select=@json:'{"member_of_any_workspace":false}'
+ascli aoc admin user list --fields=email --select=@json:'{"member_of_any_workspace":false}'
 ```
 
 #### Example: Create a group, add to workspace and add user to group
@@ -4592,7 +4766,7 @@ ascli aoc admin res user list --fields=email --select=@json:'{"member_of_any_wor
 - Create the group and take note of `id`
 
 ```bash
-ascli aoc admin res group create @json:'{"name":"group 1","description":"my super group"}'
+ascli aoc admin group create @json:'{"name":"group 1","description":"my super group"}'
 ```
 
 Group: `11111`
@@ -4600,7 +4774,7 @@ Group: `11111`
 - Get the workspace id
 
 ```bash
-ascli aoc admin res workspace list --query=@json:'{"q":"myworkspace"}' --fields=id --format=csv --display=data
+ascli aoc admin workspace list --query=@json:'{"q":"myworkspace"}' --fields=id --format=csv --display=data
 ```
 
 Workspace: 22222
@@ -4608,13 +4782,13 @@ Workspace: 22222
 - Add group to workspace
 
 ```bash
-ascli aoc admin res workspace_membership create @json:'{"workspace_id":22222,"member_type":"user","member_id":11111}'
+ascli aoc admin workspace_membership create @json:'{"workspace_id":22222,"member_type":"user","member_id":11111}'
 ```
 
 - Get a user's id
 
 ```bash
-ascli aoc admin res user list --query=@json:'{"q":"manu.macron@example.com"}' --fields=id --format=csv --display=data
+ascli aoc admin user list --query=@json:'{"q":"manu.macron@example.com"}' --fields=id --format=csv --display=data
 ```
 
 User: 33333
@@ -4622,7 +4796,7 @@ User: 33333
 - Add user to group
 
 ```bash
-ascli aoc admin res group_membership create @json:'{"group_id":11111,"member_type":"user","member_id":33333}'
+ascli aoc admin group_membership create @json:'{"group_id":11111,"member_type":"user","member_id":33333}'
 ```
 
 #### Example: Perform a multi Gbps transfer between two remote shared folders
@@ -4670,7 +4844,7 @@ ascli -Paoc_show aoc files transfer --from-folder='IBM Cloud SJ' --to-folder='AW
 #### Example: Create registration key to register a node
 
 ```bash
-ascli aoc admin res client create @json:'{"data":{"name":"laurentnode","client_subject_scopes":["alee","aejd"],"client_subject_enabled":true}}' --fields=token --format=csv
+ascli aoc admin client create @json:'{"data":{"name":"laurentnode","client_subject_scopes":["alee","aejd"],"client_subject_enabled":true}}' --fields=token --format=csv
 ```
 
 ```output
@@ -4680,7 +4854,7 @@ jfqslfdjlfdjfhdjklqfhdkl
 #### Example: Delete all registration keys
 
 ```bash
-ascli aoc admin res client list --fields=id --format=csv|ascli aoc admin res client delete @lines:@stdin: --bulk=yes
+ascli aoc admin client list --fields=id --format=csv|ascli aoc admin client delete @lines:@stdin: --bulk=yes
 ```
 
 ```output
@@ -4725,13 +4899,13 @@ So, for example, the creation of a node using ATS in IBM Cloud looks like (see o
   First, Retrieve the ATS node address
 
   ```bash
-  ascli aoc admin ats cluster show --cloud=softlayer --region=eu-de --fields=transfer_setup_url --format=csv --transpose-single=no
+  ascli aoc admin ats cluster show --cloud=softlayer --region=eu-de --fields=transfer_setup_url --format=csv
   ```
 
   Then use the returned address for the `url` key to actually create the AoC Node entity:
 
   ```bash
-  ascli aoc admin res node create @json:'{"name":"myname","access_key":"myaccesskeyid","ats_access_key":true,"ats_storage_type":"ibm-s3","url":"https://ats-sl-fra-all.aspera.io"}'
+  ascli aoc admin node create @json:'{"name":"myname","access_key":"myaccesskeyid","ats_access_key":true,"ats_storage_type":"ibm-s3","url":"https://ats-sl-fra-all.aspera.io"}'
   ```
 
 Creation of a node with a self-managed node is similar, but the command `aoc admin ats access_key create` is replaced with `node access_key create` on the private node itself.
@@ -4789,6 +4963,20 @@ If a user recipient (email) is not already registered and the workspace allows e
 - if the option `new_user_option` is `@json:{"package_contact":true}` (default), then a public link is sent and the external user does not need to create an account
 - if the option `new_user_option` is `@json:{}`, then external users are invited to join the workspace
 
+#### List packages
+
+By default, when using `aoc packages list`, the following `query` is performed:
+
+| query parameter            | value |
+|----------------------------|-------|
+| `archived`                 | `false` |
+| `has_content`              | `true`  |
+| `received`                 | `true`  |
+| `completed`                | `true`  |
+| `workspace_id`             | based on current workspace |
+| `exclude_dropbox_packages` | `true` or `false` depending if watching a dropbox|
+| `dropbox_id`               | set accoring to `dropbox_name` |
+
 #### Example: Send a package with one file to two users, using their email
 
 ```bash
@@ -4798,13 +4986,13 @@ ascli aoc packages send @json:'{"name":"my title","note":"my note","recipients":
 #### Example: Send a package to a shared inbox with metadata
 
 ```bash
-ascli aoc packages send --workspace=eudemo @json:'{"name":"my pack title","recipients":["Shared Inbox With Meta"],"metadata":{"Project Id":"123","Type":"Opt2","CheckThose":["Check1","Check2"],"Optional Date":"2021-01-13T15:02:00.000Z"}}' ~/Documents/Samples/200KB.1
+ascli aoc packages send --workspace="my ws" @json:'{"name":"my pack title","recipients":["Shared Inbox With Meta"],"metadata":{"Project Id":"123","Type":"Opt2","CheckThose":["Check1","Check2"],"Optional Date":"2021-01-13T15:02:00.000Z"}}' ~/Documents/Samples/200KB.1
 ```
 
 It is also possible to use identifiers and API parameters:
 
 ```bash
-ascli aoc packages send --workspace=eudemo @json:'{"name":"my pack title","recipients":[{"type":"dropbox","id":"12345"}],"metadata":[{"input_type":"single-text","name":"Project Id","values":["123"]},{"input_type":"single-dropdown","name":"Type","values":["Opt2"]},{"input_type":"multiple-checkbox","name":"CheckThose","values":["Check1","Check2"]},{"input_type":"date","name":"Optional Date","values":["2021-01-13T15:02:00.000Z"]}]}' ~/Documents/Samples/200KB.1
+ascli aoc packages send --workspace="my ws" @json:'{"name":"my pack title","recipients":[{"type":"dropbox","id":"12345"}],"metadata":[{"input_type":"single-text","name":"Project Id","values":["123"]},{"input_type":"single-dropdown","name":"Type","values":["Opt2"]},{"input_type":"multiple-checkbox","name":"CheckThose","values":["Check1","Check2"]},{"input_type":"date","name":"Optional Date","values":["2021-01-13T15:02:00.000Z"]}]}' ~/Documents/Samples/200KB.1
 ```
 
 #### Example: List packages in a given shared inbox
@@ -4830,7 +5018,7 @@ ascli aoc packages list --query=@json:'{"dropbox_name":"My Shared Inbox","archiv
 Using shared inbox identifier: first retrieve the id of the shared inbox, and then list packages with the appropriate filter.
 
 ```bash
-shared_box_id=$(ascli aoc packages shared_inboxes show --name='My Shared Inbox' --format=csv --display=data --fields=id --transpose-single=no)
+shared_box_id=$(ascli aoc packages shared_inboxes show --name='My Shared Inbox' --format=csv --display=data --fields=id)
 ```
 
 ```bash
@@ -4882,6 +5070,26 @@ ascli aoc packages recv ALL --once-only=yes --lock-port=12345
 
 Typically, one would execute this command on a regular basis, using the method of your choice: see [Scheduler](#scheduler).
 
+### Example: Content of a received Package
+
+Some `node` operations are available for a package, such as `browse` and `find`.
+
+To list the content of a package, use command `packages browse <package id> <folder>`:
+
+```bash
+ascli aoc package browse my5CnbeWng /
+```
+
+To list recursively, use command `find`.
+
+To download only some of the files listed in the package, just add the path of the files on the command line.
+
+For advanced users, it's also possible to pipe node information for the package and use node operations:
+
+```bash
+ascli aoc package node_info <package id here> / --format=json --show-secrets=yes --display=data | ascli node -N --preset=@json:@stdin: access_key do self browse /
+```
+
 ### Files
 
 The Files application presents a **Home** folder to users in a given workspace.
@@ -4907,13 +5115,47 @@ ascli aoc files download <single file path>
 
 #### Shared folders
 
-Shared folder created by users are managed through **permissions**.
+Like in AoC web UI, "Shared Folders" can be created and shared with either **Private** or **Public** links.
+**Private** links require the collaborator to log-in to access the shared folder.
+**Public** links include a passcode that enables the user to access the shared folder without login-in.
+
+Shared folders can be created either:
+
+- by users in a workspace: they can share personal folders with other users in the same workspace: `aoc files perm`
+- by administrators: they can share a folder with users in any workspace: `aoc admin node do [node id] perm`
+
+Technically (API), shared folder are managed through [permissions](https://developer.ibm.com/apis/catalog/aspera--aspera-node-api/Introduction) on node and an event is sent to AoC to create a **link** in the user's home folder to the shared folder.
+In both cases, it is necessary to specify a workspace.
 
-For creation, parameters are the same as for node API [permissions](https://developer.ibm.com/apis/catalog/aspera--aspera-node-api/api/API--aspera--node-api#post960739960).
-`ascli` expects the same payload for creation, but it will automatically populate required tags if needed.
+The basic payload (last argument at creation usually specified with `@json:`) is:
 
-Also, the pseudo key `with` is available: it will lookup the name in the contacts and fill the proper type and id.
-The pseudo parameter `link_name` allows changing default **shared as** name.
+```json
+{
+  "file_id": "50",
+  "access_levels": ["list","read","write","delete","mkdir","rename","preview"],
+  "access_type": "user",
+  "access_id": "john@example.com",
+  "tags": {...},
+}
+```
+
+`ascli` expects the same payload for creation.
+`ascli` automatically populates this payload like this:
+
+- `file_id` : the id of the folder to share whose path is specified in the command line
+- `access_levels` : are set by default to full access.
+- `tags` : are set with expected values for AoC: user name who creates, and workspace in which the shared folder is created.
+- `access_type` and `access_id` : need to be set by the user, or using special key as follows.
+
+To change `access_levels`, just provide the list of levels in the `@json:` payload.
+
+In order to declare/create the shared folder in the workspace, a special value for `access_id` is used: `ASPERA_ACCESS_KEY_ADMIN_WS_[workspace id]]`. This is conveniently set by `ascli` using an empty string for the pseudo key `with`. In order to share a folder with a different, special tags are set, but this is conveniently done by `ascli` using the `as` key.
+
+The following optional additional helper keys are supported by `ascli`:
+
+- `with` : Recipient of shared folder. Can be a user name, a group name, or a workspace name. `ascli` will resolve the name to the proper type and id in fields `access_type` and `access_id`. If the value is the empty string, then it declares the shared folder in the workspace (first action to do, see below).
+- `link_name` : The name of the link file created in the user's home folder for private links.
+- `as` : The name of the link file created in the user's home folder for admin shared folders.
 
 - List permissions on a shared folder as user
 
@@ -4936,12 +5178,24 @@ ascli aoc files perm /shared_folder_test1 delete 6161
 Public and Private short links can be managed with command:
 
 ```bash
-ascli aoc files short_link private create _path_here_
-ascli aoc files short_link private list _path_here_
-ascli aoc files short_link public list _path_here_
+ascli aoc files short_link _path_here_ private create
+ascli aoc files short_link _path_here_ private list
+ascli aoc files short_link _path_here_ public list
 ascli aoc files short_link public delete _id_
 ```
 
+- Create an admin shared folder and shared with a user or group or workspace
+
+```bash
+ascli aoc admin node do 1234 mkdir folder_on_node
+ascli aoc admin node do 1234 perm folder_on_node create @json:'{"with":"","as":"folder_for_users"}' --workspace="my ws"
+ascli aoc admin node do 1234 perm folder_on_node create @json:'{"with":"john@example.com","as":"folder_for_users"}' --workspace="my ws"
+ascli aoc admin node do 1234 perm folder_on_node create @json:'{"with":"group 1","as":"folder_for_users"}' --workspace="my ws"
+ascli aoc admin node do 1234 perm folder_on_node create @json:'{"with":"my ws","as":"folder_for_users"}' --workspace="my ws"
+```
+
+> **Note:** The node can be conveniently identified using the **percent selector** instead of numerical id.
+
 #### Cross Organization transfers
 
 It is possible to transfer files directly between organizations without having to first download locally and then upload...
@@ -4979,7 +5233,7 @@ The command `aoc files find` allows to search for files in a given workspace.
 It works also on `node` resource using the `v4` command:
 
 ```bash
-ascli aoc admin res node --name='my node name' --secret='my_secret_here' v4 find ...
+ascli aoc admin node --name='my node name' --secret='my_secret_here' v4 find ...
 ```
 
 For instructions, refer to section `find` for plugin `node`.
@@ -4990,8 +5244,8 @@ For instructions, refer to section `find` for plugin `node`.
 
 ```bash
 admin analytics transfers nodes
-admin analytics transfers organization --query=@json:'{"status":"completed","direction":"receive"}' --notify-to=my_email_external --notify-template=@ruby:'%Q{From: <%=from_name%> <<%=from_email%>>\nTo: <<%=to%>>\nSubject: <%=ev["files_completed"]%> files received\n\n<%=ev.to_yaml%>}'
-admin analytics transfers users --once_only=yes
+admin analytics transfers organization --query=@json:'{"status":"completed","direction":"receive","limit":2}' --notify-to=my_email_external --notify-template=@ruby:'%Q{From: <%=from_name%> <<%=from_email%>>\nTo: <<%=to%>>\nSubject: <%=ev["files_completed"]%> files received\n\n<%=ev.to_yaml%>}'
+admin analytics transfers users --once-only=yes
 admin application list
 admin ats access_key create --cloud=aws --region=my_region --params=@json:'{"id":"ak_aws","name":"my test key AWS","storage":{"type":"aws_s3","bucket":"my_bucket","credentials":{"access_key_id":"my_access_key","secret_access_key":"my_secret_key"},"path":"/"}}'
 admin ats access_key create --cloud=softlayer --region=my_region --params=@json:'{"id":"ak1ibmcloud","secret":"my_secret_here","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_bucket","credentials":{"access_key_id":"my_access_key","secret_access_key":"my_secret_key"},"path":"/"}}'
@@ -5013,12 +5267,19 @@ admin dropbox list
 admin dropbox_membership list
 admin group list
 admin kms_profile list
-admin node do %name:my_ak_name --secret=my_ak_secret browse /
-admin node do %name:my_ak_name --secret=my_ak_secret delete /folder1
-admin node do %name:my_ak_name --secret=my_ak_secret mkdir /folder1
-admin node do %name:my_ak_name --secret=my_ak_secret v3 access_key create @json:'{"id":"testsub1","storage":{"path":"/folder1"}}'
-admin node do %name:my_ak_name --secret=my_ak_secret v3 access_key delete testsub1
-admin node do %name:my_ak_name --secret=my_ak_secret v3 events
+admin node do %name:my_node_name --secret=my_ak_secret browse /
+admin node do %name:my_node_name --secret=my_ak_secret delete /folder1
+admin node do %name:my_node_name --secret=my_ak_secret delete /folder_sub
+admin node do %name:my_node_name --secret=my_ak_secret mkdir /folder1
+admin node do %name:my_node_name --secret=my_ak_secret mkdir /folder_sub
+admin node do %name:my_node_name --secret=my_ak_secret v3 access_key create @json:'{"id":"testsub1","storage":{"path":"/folder_sub"}}'
+admin node do %name:my_node_name --secret=my_ak_secret v3 access_key delete testsub1
+admin node do %name:my_node_name --secret=my_ak_secret v3 events
+admin node do %name:my_node_name delete test_shared_folder
+admin node do %name:my_node_name mkdir test_shared_folder
+admin node do %name:my_node_name perm test_shared_folder create @json:'{"with":"","as":"other_name_shared"}' --workspace=my_workspace_shared_inbox
+admin node do %name:my_node_name perm test_shared_folder create @json:'{"with":"my_user_email","as":"other_name_shared"}' --workspace=my_workspace_shared_inbox
+admin node do %name:my_node_name perm test_shared_folder create @json:'{"with":"my_user_group","as":"other_name_shared"}' --workspace=my_workspace_shared_inbox
 admin node list
 admin operation list
 admin organization show
@@ -5051,15 +5312,17 @@ files browse my_remote_folder/
 files delete /testsrc
 files download --transfer=alpha testdst/test_file.bin
 files download --transfer=connect testdst/test_file.bin
+files find /
 files find / '\.partial$'
+files find / @ruby:'->(f){f["type"].eql?("file")}'
 files http_node_download --to-folder=. testdst/test_file.bin
 files mkdir /testsrc
 files modify my_test_folder
 files permission my_test_folder list
 files rename /some_folder testdst
-files short_link private create /testdst
-files short_link private list /testdst
-files short_link public create testdst
+files short_link /testdst private create
+files short_link /testdst private list
+files short_link /testdst public create
 files show %id:aoc_file_id
 files show /
 files show testdst/test_file.bin
@@ -5080,13 +5343,14 @@ files v3 info
 gateway --pid-file=pid_aocfxgw https://localhost:12345/aspera/faspex &
 org --url=my_public_link_recv_from_aoc_user
 organization
-packages browse package_id3 /contents
+packages browse package_id3 /
 packages list
 packages list --query=@json:'{"dropbox_name":"my_shared_inbox_name","sort":"-received_at","archived":false,"received":true,"has_content":true,"exclude_dropbox_packages":false}'
 packages receive ALL --once-only=yes --to-folder=. --lock-port=12345
 packages receive ALL --once-only=yes --to-folder=. --lock-port=12345 --query=@json:'{"dropbox_name":"my_shared_inbox_name","archived":false,"received":true,"has_content":true,"exclude_dropbox_packages":false,"include_draft":false}' --ts=@json:'{"resume_policy":"sparse_csum","target_rate_kbps":50000}'
 packages receive INIT --once-only=yes --query=@json:'{"dropbox_name":"my_shared_inbox_name"}'
 packages receive package_id3 --to-folder=.
+packages receive package_id3 --to-folder=. /
 packages send --workspace=my_workspace_shared_inbox --validate-metadata=yes @json:'{"name":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["my_shared_inbox_meta"],"metadata":[{"input_type":"single-text","name":"Project Id","values":["123"]},{"input_type":"single-dropdown","name":"Type","values":["Opt2"]},{"input_type":"multiple-checkbox","name":"CheckThose","values":["Check1","Check2"]},{"input_type":"date","name":"Optional Date","values":["2021-01-13T15:02:00.000Z"]}]}' test_file.bin
 packages send --workspace=my_workspace_shared_inbox --validate-metadata=yes @json:'{"name":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["my_shared_inbox_meta"],"metadata":{"Project Id":"456","Type":"Opt2","CheckThose":["Check1","Check2"],"Optional Date":"2021-01-13T15:02:00.000Z"}}' test_file.bin
 packages send --workspace=my_workspace_shared_inbox --validate-metadata=yes @json:'{"name":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["my_shared_inbox_meta"],"metadata":{"Type":"Opt2","CheckThose":["Check1","Check2"],"Optional Date":"2021-01-13T15:02:00.000Z"}}' test_file.bin
@@ -5096,8 +5360,10 @@ packages send @json:'{"name":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["
 packages send @json:'{"name":"$(notdir test) PACKAGE_TITLE_BASE"}' test_file.bin --url=my_public_link_send_aoc_user --password=my_public_link_send_use_pass
 packages send @json:'{"name":"$(notdir test) PACKAGE_TITLE_BASE"}' test_file.bin --url=my_public_link_send_shared_inbox
 packages shared_inboxes list
+packages shared_inboxes show %name:my_shared_inbox_name
 remind --username=my_user_email
 servers
+tier_restrictions
 user pref modify @json:'{"default_language":"en-us"}'
 user pref show
 user profile modify @json:'{"name":"dummy change"}'
@@ -5179,7 +5445,7 @@ ascli ats api_key create
 
 ```output
 +--------+----------------------------------------------+
-| key    | value                                        |
+| field  | value                                        |
 +--------+----------------------------------------------+
 | id     | ats_XXXXXXXXXXXXXXXXXXXXXXXX                 |
 | secret | YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY |
@@ -5254,11 +5520,18 @@ cluster show 1f412ae7-869a-445c-9c05-02ad16813be2
 ## Plugin: `server`: IBM Aspera High Speed Transfer Server (SSH)
 
 The `server` plugin is used for operations on Aspera HSTS using SSH authentication.
-It is the legacy way of accessing an Aspera Server, often used for server to server transfers.
+It is the original way of accessing an Aspera Server, often used for server to server transfers.
 An SSH session is established, authenticated with either a password or an SSH private key,
 then commands `ascp` (for transfers) and `ascmd` (for file operations) are executed.
 
-> **Note:** The URL to be provided is usually: `ssh://_server_address_:33001`
+The URL to be provided with option `url` shall be like `ssh://_server_address_:33001`, then option `username` is used to specify the transfer user, and finally either option `password` or `ssh_keys` (with one or several paths) for the authentication.
+
+Typically:
+
+```console
+`ascli` server --url=ssh://hsts.example.com:33001 --username=john --password=_something_here_ ...
+`ascli` server --url=ssh://hsts.example.com:33001 --username=john --ssh-keys=~/.ssh/id_rsa ...
+```
 
 ### Server sample commands
 
@@ -5274,7 +5547,7 @@ delete my_inside_folder
 delete my_upload_folder/to.delete
 df
 download my_inside_folder/test_file.bin --to-folder=. --transfer-info=@json:'{"wss":false,"resume":{"iter_max":1}}'
-download my_inside_folder/test_file.bin --to-folder=my_upload_folder --transfer=node
+download my_large_file --to-folder=my_upload_folder --transfer=node --ts=@json:'{"resume_policy":"none"}'
 du /
 health transfer --to-folder=my_upload_folder --format=nagios
 info
@@ -5292,10 +5565,10 @@ upload 'faux:///test1?100m' 'faux:///test2?100m' --to-folder=/Upload --ts=@json:
 upload 'test_file.bin' --to-folder=my_inside_folder --ts=@json:'{"multi_session":3,"multi_session_threshold":1,"resume_policy":"none","target_rate_kbps":100000}' --transfer-info=@json:'{"spawn_delay_sec":2.5,"multi_incr_udp":false}' --progress-bar=yes
 upload --sources=@ts --transfer-info=@json:'{"ascp_args":["--file-list","filelist.txt"]}' --to-folder=my_inside_folder
 upload --sources=@ts --transfer-info=@json:'{"ascp_args":["--file-pair-list","file_pair_list.txt"]}'
-upload --sources=@ts --ts=@json:'{"paths":[{"source":"test_file.bin","destination":"my_inside_folder/other_name_4"}]}' --transfer=trsdk
+upload --sources=@ts --ts=@json:'{"paths":[{"source":"test_file.bin","destination":"my_inside_folder/other_name_4"}]}' --transfer=transferd
 upload --src-type=pair 'test_file.bin' my_inside_folder/other_name_2 --notify-to=my_email_external --transfer-info=@json:'{"ascp_args":["-l","100m"]}'
-upload --src-type=pair --sources=@json:'["test_file.bin","my_inside_folder/other_name_3"]' --transfer-info=@json:'{"quiet":false}' --ts=@json:'{"use_ascp4":true}' --progress=no
-upload --src-type=pair test_file.bin my_upload_folder/other_name_5 --ts=@json:'{"cipher":"aes-192-gcm","content_protection":"encrypt","content_protection_password":"my_secret_here","cookie":"biscuit","create_dir":true,"delete_before_transfer":false,"delete_source":false,"exclude_newer_than":1,"exclude_older_than":10000,"fasp_port":33001,"http_fallback":false,"multi_session":0,"overwrite":"diff+older","precalculate_job_size":true,"preserve_access_time":true,"preserve_creation_time":true,"rate_policy":"fair","resume_policy":"sparse_csum","symlink_policy":"follow"}'
+upload --src-type=pair --sources=@json:'["test_file.bin","my_inside_folder/other_name_3"]' --transfer-info=@json:'{"quiet":false}' --progress=no
+upload --src-type=pair test_file.bin my_upload_folder/other_name_5 --ts=@json:'{"cipher":"aes-192-gcm","content_protection":"encrypt","content_protection_password":"my_secret_here","cookie":"biscuit","create_dir":true,"delete_before_transfer":false,"delete_source":false,"exclude_newer_than":"-1","exclude_older_than":"-10000","fasp_port":33001,"http_fallback":false,"multi_session":0,"overwrite":"diff+older","precalculate_job_size":true,"preserve_access_time":true,"preserve_creation_time":true,"rate_policy":"fair","resume_policy":"sparse_csum","symlink_policy":"follow"}'
 upload --to-folder=my_upload_folder/target_hot --lock-port=12345 --transfer-info=@json:'{"ascp_args":["--remove-after-transfer","--remove-empty-directories","--exclude-newer-than=-8","--src-base","source_hot"]}' source_hot
 ```
 
@@ -5308,7 +5581,8 @@ If SSH is the session protocol (by default i.e. not WSS), then following session
 
 If `username` is not provided then the default transfer user `xfer` is used.
 
-If no SSH password or key is provided and a transfer token is provided in transfer spec (option `ts`), then standard SSH bypass keys are used.
+If neither SSH password nor key is provided and a transfer token is provided in transfer spec (option `ts`), then standard SSH bypass key(s) is used.
+
 Example:
 
 ```bash
@@ -5404,6 +5678,8 @@ This plugin gives access to capabilities provided by the HSTS node API.
 The authentication is `username` and `password` or `access_key` and `secret` through options: `username` and `password`.
 
 > **Note:** Capabilities of this plugin are used in other plugins which access to the node API, such as `aoc`, `ats`, `shares`.
+>
+> **Note:** This plugin can be used with any type of **Aspera Node**, either on-prem or ATS, provided that you have node api credentials. Those credentials can be either Node API user or Access Key (e.g. on ATS).
 
 ### File Operations
 
@@ -5427,11 +5703,13 @@ Native API parameters can be placed in option `query`.
 
 Special parameters can be placed in option `query` for "gen3" browse:
 
-| Parameter | Description |
-|-----------|-------------|
+| Parameter   | Description |
+|-------------|-------------|
 | `recursive` | Recursively list files |
-| `max` | Maximum number of files to list |
-| `self` | Offset in the list |
+| `max`       | Maximum number of files to list |
+| `self`      | Offset in the list |
+
+Option `node_cache` can be set to `no` to avoid use of folder cache (Redis) and force actual read of file system.
 
 ### Operation `find` on **gen4/access key**
 
@@ -5508,6 +5786,24 @@ ascli node access_keys do self find / @ruby:'->(f){f["type"].eql?("file") and (D
 
 > **Note:** The pipe `|` character on the last line.
 
+### Listing transfer events
+
+When a transfer is run, its information is stored (typicall, 1 day) in the HSTS database (Redis).
+This information can be retrieved with command: `transfer list`.
+
+If the number of transfer is too large, then the list will be retrieved in several API calls.
+
+In addition, it is possible to list "only new information" using option `once_only`.
+
+```bash
+ascli node transfer list --once-only=yes
+```
+
+The `iteratin_token` that keeps memory of latest event is stored in the persistance repository of `ascli`.
+To reset it, add option: `--query=@json:'{"reset": true}'`.
+To list only a number of events, use the `max` parameter in query.
+Other parameters are directly transmitted to the underlying API (`GET /ops/transfers`).
+
 ### Central
 
 The central subcommand uses the **reliable query** API (session and file).
@@ -5562,8 +5858,8 @@ Follow the Aspera Transfer Server configuration to activate this feature.
 
 The following command lists one file that requires validation, and assign it to the unique validator identifier provided:
 
-```bash
-ascli node central file list --validator=ascli --data=@json:'{"file_transfer_filter":{"max_result":1}}'
+```json
+ascli node central file list --validator=ascli @json:'{"file_transfer_filter":{"max_result":1}}'
 ```
 
 ```output
@@ -5576,8 +5872,8 @@ ascli node central file list --validator=ascli --data=@json:'{"file_transfer_fil
 
 To update the status of the file, use the following command:
 
-```bash
-ascli node central file update --validator=ascli --data=@json:'{"files":[{"session_uuid": "1a74444c-...","file_id": "084fb181-...","status": "completed"}]}'
+```json
+ascli node central file update --validator=ascli @json:'{"files":[{"session_uuid": "1a74444c-...","file_id": "084fb181-...","status": "completed"}]}'
 ```
 
 ```output
@@ -5651,11 +5947,11 @@ ascli node info --field=@ruby:'/^access_key_configuration_capabilities.*/'
 
 Bearer tokens are part of the **gen4/access key** API.
 It follows the model of OAuth 2.
-For example they are used in Aspera on Cloud.
+For example, they are used in Aspera on Cloud.
 This is also available for developers for any application integrating Aspera.
-In this API, files, users and groups are identified by an id (a String, e.g. `"125"`, not necessarily numerical).
+In this API, files, users and groups are identified by an id (a `String`, e.g. `"125"`, not necessarily numerical).
 
-Bearer tokens are typically generated by the authentication application, and then recognized by the node API.
+Bearer tokens are typically generated by the authentication application and then recognized by the node API.
 A bearer token is authorized on the node by creating `permissions` on a **folder**.
 
 Bearer tokens can be generated using command `bearer_token`: it takes two arguments:
@@ -5681,6 +5977,11 @@ Bearer tokens can be generated using command `bearer_token`: it takes two argume
 
 #### Bearer token: Environment
 
+An access key shall be created to grant access for transfers to its storage.
+The access_key and its secrets represent an administrative access to the storage as it has access rights to the whole storage of the access key.
+
+They way to create access keys depend slightly on the type of HSTS:
+
 - If a self-managed Aspera node is used, then a **node user admin** must be created:
   It has no `docroot` but has at least one file restriction (for testing, one can use `*` to accept creation of an access key with any storage root path).
   Refer to the Aspera HSTS documentation.
@@ -5689,12 +5990,10 @@ Bearer tokens can be generated using command `bearer_token`: it takes two argume
 
 - If Aspera on Cloud or ATS is used, then the SaaS API for access key creation is used.
 
-- An access key shall be created to grant access for transfers to its storage.
-  The access_key and its secrets represent an administrative access to the storage as it has access rights to the whole storage of the access key.
-
 #### Bearer token: Preparation
 
 Let's assume that the access key was created, and a default configuration is set to use this **access key**.
+Using `ascli`, an access key can be created using the `access_key create` on the node (using main node credentials) or ATS.
 
 - Create a private key (organization key) that will be used to sign bearer tokens:
 
@@ -5714,6 +6013,7 @@ Let's assume that the access key was created, and a default configuration is set
 
   > **Note:** Either the public or private key can be provided, and only the public key is used.
   > This will enable to check the signature of the bearer token.
+  > Above command is executed with access key credentials.
 
   Alternatively, use the following equivalent command, as `ascli` kindly extracts the public key with extension `.pub`:
 
@@ -5756,7 +6056,7 @@ Let's assume that the access key was created, and a default configuration is set
 
 Now, let's assume we are the user, the only information received are:
 
-- The url of the node API
+- The URL of the node API
 - A Bearer token
 - A file `id` for which we have access
 
@@ -5775,18 +6075,17 @@ ascli node -N --url=... --password="Bearer $(cat bearer.txt)" --root-id=$my_fold
 access_key create @json:'{"id":"my_username","secret":"my_password_here","storage":{"type":"local","path":"/"}}'
 access_key delete my_username
 access_key do my_ak_name browse /
-access_key do my_ak_name delete /folder2
-access_key do my_ak_name delete testfile1
-access_key do my_ak_name download testfile1 --to-folder=.
+access_key do my_ak_name delete /test_nd_ak2
+access_key do my_ak_name delete test_nd_ak3
+access_key do my_ak_name download test_nd_ak3 --to-folder=.
 access_key do my_ak_name find my_test_folder
 access_key do my_ak_name find my_test_folder @ruby:'->(f){f["name"].end_with?(".jpg")}'
-access_key do my_ak_name find my_test_folder exec:'f["name"].end_with?(".jpg")'
-access_key do my_ak_name mkdir /folder1
+access_key do my_ak_name mkdir /tst_nd_ak
 access_key do my_ak_name node_info /
-access_key do my_ak_name rename /folder1 folder2
+access_key do my_ak_name rename /tst_nd_ak test_nd_ak2
 access_key do my_ak_name show %id:1
-access_key do my_ak_name show /testfile1
-access_key do my_ak_name upload 'faux:///testfile1?1k' --default_ports=no
+access_key do my_ak_name show /test_nd_ak3
+access_key do my_ak_name upload 'faux:///test_nd_ak3?100k' --default-ports=no
 access_key do self permission %id:root_id create @json:'{"access_type":"user","access_id":"666"}'
 access_key do self show / --fields=id --output=root_id
 access_key list
@@ -5804,7 +6103,7 @@ basic_token
 bearer_token @file:my_private_key @json:'{"user_id":"666"}' --output=bearer_666
 browse / --log-level=trace2
 central file list
-central file modify --validator=1 --query=@json:'{"files":[]}'
+central file modify --validator=1 @json:'{"files":[]}'
 central session list
 delete @list:,my_upload_folder/a_folder,my_upload_folder/tdlink,my_upload_folder/a_file
 delete my_upload_folder/test_file.bin
@@ -5825,7 +6124,7 @@ slash
 space /
 ssync bandwidth %name:my_node_sync
 ssync counters %name:my_node_sync
-ssync create @json:'{"configuration":{"name":"my_node_sync","local":{"path":"my_local_path"},"remote":{"host":"my_host","port":my_port,"user":"my_username","pass":"my_password_here","path":"my_remote_path"}}}'
+ssync create @json:'{"configuration":{"name":"my_node_sync","local":{"path":"my_local_path_real"},"remote":{"host":"my_host","port":my_port,"user":"my_username","pass":"my_password_here","path":"my_remote_path"}}}'
 ssync delete %name:my_node_sync
 ssync files %name:my_node_sync
 ssync list
@@ -5839,7 +6138,9 @@ sync admin status --sync-info=@json:'{"name":"my_node_sync2","reset":true,"direc
 sync admin status --sync-info=@json:'{"sessions":[{"name":"my_node_sync1","direction":"pull","local_dir":"/data/local_sync","remote_dir":"/aspera-test-dir-tiny","reset":true}]}'
 sync start --sync-info=@json:'{"name":"my_node_sync1","reset":true,"quiet":false,"direction":"pull","local":{"path":"/data/local_sync"},"remote":{"path":"/aspera-test-dir-tiny"}}'
 sync start --sync-info=@json:'{"name":"my_node_sync2","reset":true,"direction":"pull","local":{"path":"/data/local_sync"},"remote":{"path":"/aspera-test-dir-tiny"}}'
+transfer list --once-only=yes
 transfer list --query=@json:'{"active_only":true}'
+transfer list --query=@json:'{"reset":true}' --once-only=yes
 transfer sessions
 transport
 upload --to-folder=my_upload_folder --sources=@ts --ts=@json:'{"paths":[{"source":"/aspera-test-dir-small/10MB.2"}],"precalculate_job_size":true}' --transfer=node --transfer-info=@json:'{"url":"https://node.example.com/path@","username":"my_username","password":"my_password_here"}'
@@ -5928,16 +6229,16 @@ Activation is in two steps:
   - Click on `Create` Button
   - Take note of Client Id (and Client Secret, but not used in current version)
 
-- The user uses a private key and sets the public key in his faspex 5 profile
+- The user will authenticate with a private key and set the public key in his faspex 5 profile.
 
+  **Note:** If you don't have a private key refer to section [Private Key](#private-key) to generate one.
+  
   This operation is done by each user using the CLI.
 
   - As user, click on the user logo, left to the app switcher on top right.
   - Select `Account Settings`
   - on the bottom in the text field: `Public key in PEM format` paste the **public** key corresponding to the private key used by the user.
 
-  **Note:** If you don't have any refer to section [Private Key](#private-key)
-
 Then use these options:
 
 ```text
@@ -6007,12 +6308,12 @@ admin contacts list
 admin distribution_lists create @json:'{"name":"test4","contacts":[{"name":"john@example.com"}]}'
 admin distribution_lists delete %name:test4
 admin distribution_lists list --query=@json:'{"type":"global"}'
-admin event app
+admin event app --query=@json:'{"max":20}'
 admin event web
 admin jobs list --query=@json:'{"job_type":"email","status":"failed"}' --fields=id,error_desc
 admin metadata_profiles list
 admin node list
-admin oauth_clients list
+admin oauth_clients list --query=@json:'[["client_types[]","public"]]'
 admin registrations list
 admin saml_configs list
 admin shared_inboxes invite %name:my_shared_box_name johnny@example.com
@@ -6048,7 +6349,7 @@ packages show --box=my_shared_box_name package_box_id1
 packages show --box=my_workgroup --group-type=workgroups workgroup_package_id1
 packages show f5_p31
 packages status f5_p31
-postprocessing --pid-file=pid_f5_postproc @json:'{"url":"https://localhost:8443/domain","processing":{"script_folder":""}}' &
+postprocessing --pid-file=pid_f5_postproc @json:'{"url":"http://localhost:8088/asclihook","processing":{"script_folder":""}}' &
 shared browse %name:my_src
 shared list
 shared_folders browse %name:my_shared_folder_name
@@ -6085,13 +6386,23 @@ To select another inbox, use option `box` with one of the following values:
 
 ### Faspex 5: Send a package
 
-The `Hash` creation **Command Parameter** provided to command `faspex5 packages send [extended value: Hash with package info ] [files...]` corresponds to the Faspex 5 API: `POST /packages`.
+A package can be sent with the command:
+
+```bash
+ascli faspex5 packages send [extended value: Hash with package info ] [files...]
+```
 
-The interface is the one of the API (Refer to Faspex5 API documentation, or look at request in browser).
+The `Hash` creation **Command Parameter** provided to command corresponds to the Faspex 5 API: `POST /packages` (refer to the API reference for a full list of parameters, or look at request in browser).
 
 Required fields are `title` and `recipients`.
 
-Example using `@json:` format:
+Example (assuming a default preset is created for the connection information):
+
+```bash
+ascli faspex5 packages send @json:'{"title":"some title","recipients":["user@example.com"]}' mybygfile1
+```
+
+Longer example for the ayload of `@json:`:
 
 ```json
 {"title":"some title","recipients":[{"recipient_type":"user","name":"user@example.com"}]}
@@ -6175,7 +6486,7 @@ To list the content of a package, use command `faspex5 packages browse /`.
 
 Option `query` is available.
 
-To list recursively add option `--query=@json:{"recursive":true}`.
+To list recursively add option `--query=@json:'{"recursive":true}'`.
 
 > **Note:** Option `recursive` makes recursive API calls, so it can take a long time on large packages.
 
@@ -6205,26 +6516,26 @@ To keep the content encrypted, use option: `--ts=@json:'{"content_protection":nu
 If you are a regular user, to list work groups you belong to:
 
 ```bash
-ascli faspex5 admin res workgroup list
+ascli faspex5 admin workgroup list
 ```
 
 If you are admin or manager, add option: `--query=@json:'{"all":true}'`, this will list items you manage, even if you do not belong to them.
 Example:
 
 ```bash
-ascli faspex5 admin res shared list --query=@json:'{"all":true}' --fields=id,name
+ascli faspex5 admin shared list --query=@json:'{"all":true}' --fields=id,name
 ```
 
 Shared inbox members can also be listed, added, removed, and external users can be invited to a shared inbox.
 
 ```bash
-ascli faspex5 admin res shared_inboxes invite '%name:the shared inbox' john@example.com
+ascli faspex5 admin shared_inboxes invite '%name:the shared inbox' john@example.com
 ```
 
 It is equivalent to:
 
 ```bash
-ascli faspex5 admin res shared_inboxes invite '%name:the shared inbox' @json:'{"email_address":"john@example.com"}'
+ascli faspex5 admin shared_inboxes invite '%name:the shared inbox' @json:'{"email_address":"john@example.com"}'
 ```
 
 Other payload parameters are possible for `invite` in this last `Hash` **Command Parameter**:
@@ -6236,27 +6547,27 @@ Other payload parameters are possible for `invite` in this last `Hash` **Command
 ### Faspex 5: Create Metadata profile
 
 ```bash
-ascli faspex5 admin res metadata_profiles create @json:'{"name":"the profile","default":false,"title":{"max_length":200,"illegal_chars":[]},"note":{"max_length":400,"illegal_chars":[],"enabled":false},"fields":[{"ordering":0,"name":"field1","type":"text_area","require":true,"illegal_chars":[],"max_length":100},{"ordering":1,"name":"fff2","type":"option_list","require":false,"choices":["opt1","opt2"]}]}'
+ascli faspex5 admin metadata_profiles create @json:'{"name":"the profile","default":false,"title":{"max_length":200,"illegal_chars":[]},"note":{"max_length":400,"illegal_chars":[],"enabled":false},"fields":[{"ordering":0,"name":"field1","type":"text_area","require":true,"illegal_chars":[],"max_length":100},{"ordering":1,"name":"fff2","type":"option_list","require":false,"choices":["opt1","opt2"]}]}'
 ```
 
 ### Faspex 5: Create a Shared inbox with specific metadata profile
 
 ```bash
-ascli faspex5 admin res shared create @json:'{"name":"the shared inbox","metadata_profile_id":1}'
+ascli faspex5 admin shared create @json:'{"name":"the shared inbox","metadata_profile_id":1}'
 ```
 
 ### Faspex 5: List content in Shared folder and send package from remote source
 
 ```bash
-ascli faspex5 shared_folders list
+ascli faspex5 shared_folders list --fields=id,name
 ```
 
 ```markdown
-+----+----------+---------+-----+
-| id | name     | node_id | ... |
-+----+----------+---------+-----+
-| 3  | partages | 2       | ... |
-+----+----------+---------+-----+
++----+----------+
+| id | name     |
++----+----------+
+| 3  | partages |
++----+----------+
 ```
 
 ```bash
@@ -6289,19 +6600,23 @@ There are two types of invitations of package submission: public or private.
 
 Public invitations are for external users, provide just the email address.
 
+```bash
+ascli faspex5 invitations create @json:'{"email_address":"john@example.com"}' --fields=access_url
+```
+
 Private invitations are for internal users, provide the user or shared inbox identifier through field `recipient_name`.
 
 ### Faspex 5: Cleanup packages
 
 > **Note:** Operation requires admin level.
 
-Automated cleanup period can be displayed with:
+The default automated cleanup period can be displayed with:
 
 ```bash
 ascli faspex5 admin configuration show --fields=days_before_deleting_package_records
 ```
 
-This parameter can also be modified, for example:
+This parameter can be modified with:
 
 ```bash
 ascli faspex5 admin configuration modify @json:'{"days_before_deleting_package_records":30}'
@@ -6313,6 +6628,8 @@ To start package purge, i.e. permanently remove packages marked for deletion old
 ascli faspex5 admin clean_deleted
 ```
 
+> **Note:** The expiration perid taken by default is the one from `admin configuration show`. To use a different period than the default, specify it on command line with: `@json:'{"days_before_deleting_package_records":15}'`
+
 To delete all packages, one can use the following command:
 
 ```bash
@@ -6320,12 +6637,32 @@ ascli faspex5 packages list --box=ALL --format=yaml --fields=id | ascli faspex5
 ```
 
 > **Note:** Above command will mark all packages for deletion, and will be permanently removed after the configured period (`clean_deleted` command).
-> It is possible to add a filter to the list command to only delete packages matching some criteria, e.g. using `--select=@ruby:`.
+> It is possible to add a filter to the list command to only delete packages matching some criteria, e.g. using `--select=@ruby:'->(p){...}'` on `packages list`.
+
+### Faspex 5: Admin: Unlock user
+
+To unlock a user, you can de-activate and then re-activate the user:
+
+```bash
+ascli faspex5 admin accounts modify %name:some.user@example.com @json:'{"account_activated":false}'
+```
+
+```bash
+ascli faspex5 admin accounts modify %name:some.user@example.com @json:'{"account_activated":true}'
+```
+
+> **Note:** here we use the convenient percent selector, but the numerical if can be used as well.
+
+To send a password reset link to a user, use command `reset_password` on the `account`.
 
 ### Faspex 5: Faspex 4-style postprocessing
 
-`ascli` provides command `postprocessing` in plugin `faspex5` to emulate Faspex 4 postprocessing.
-It implements Faspex 5 web hooks, and calls a local script with the same environment as Faspex 4.
+The command command `ascli faspex5 postprocessing` emulates Faspex 4 postprocessing script execution in Faspex 5.
+It implements Faspex 5 web hooks and calls a script with the same environment variables as set by Faspex 4.
+Environment variables at set to the values provided by the web hook which are the same as Faspex 4 postprocessing.
+
+It allows to quickly migrate workflows to Faspex 5 while preserving scripts.
+Nevertheless, on long term, a native approach shall be considered, such as using Aspera Orchestrator or other workflow engine.
 
 It is invoked like this:
 
@@ -6333,43 +6670,71 @@ It is invoked like this:
 ascli faspex5 postprocessing @json:'{"url":"http://localhost:8080/processing"}'
 ```
 
-The following parameters are supported:
+The following parameters are supported in the extended value `Hash`:
 
-| parameter                  | type    | default                | description                                         |
-|----------------------------|---------|------------------------|-----------------------------------------------------|
-| url                        | string  | http://localhost:8080  | Base url on which requests are listened             | <!-- markdownlint-disable-line -->
-| certificate                | hash    | nil                    | Certificate information (if HTTPS)                  |
-| certificate.key            | string  | nil                    | Path to private key file                            |
-| certificate.cert           | string  | nil                    | Path to certificate                                 |
-| certificate.chain          | string  | nil                    | Path to intermediary certificates                   |
-| processing                 | hash    | nil                    | Behavior of post processing                         |
-| processing.script_folder   | string  | .                      | Prefix added to script path                         |
-| processing.fail_on_error   | bool    | false                  | Fail if true and process exit with non zero         |
-| processing.timeout_seconds | integer | 60                     | Max. execution time before script is killed         |
+| parameter                  | type     | default | description                                       |
+|----------------------------|----------|---------|-----------------------------------------------------|
+| url                        | `String` | `http://localhost:8080` | Base URL on which requests are listened, a path can be provided.             | <!-- markdownlint-disable-line -->
+| certificate                | `Hash`   | nil     | Certificate information (if URL is HTTPS)           |
+| certificate.key            | `String` | nil     | Path to private key file                            |
+| certificate.cert           | `String` | nil     | Path to certificate                                 |
+| certificate.chain          | `String` | nil     | Path to certificate chain                           |
+| processing                 | `Hash`   | nil     | Behavior of post processing                         |
+| processing.script_folder   | `String` | .       | Prefix added to script path                         |
+| processing.fail_on_error   | `Bool`   | false   | Fail if true and process exits with non zero code   |
+| processing.timeout_seconds | `Integer`| 60      | Max. execution time before script is killed         |
 
-Parameter `url` defines:
+Parameter `url` (base URL) defines:
 
 - If `http` or `https` is used
-- The local port number
-- The **base path**, i.e. the path under which requests are received.
+- The local port number (default 443 for HTTPS, 80 for HTTP)
+- The **base path**, i.e. the path under which requests are received, if a reverse proxy is used this can be used to route.
 
 When a request is received the following happens:
 
-- The processor get the path of the url called
-- It removes the **base path**
+- `ascli` gets the path of the URL called
+- It removes the **base path** of base URL.
 - It prepends it with the value of `script_folder`
 - It executes the script
 - Upon success, a success code is returned
 
-In Faspex 5, configure like this:
+For example:
 
-**Webhook endpoint URI** : `http://localhost:8080/processing/script1.sh`
+The base URL is defined as: `http://localhost:8080/processing`.
+The parameter `script_folder` is set to `/opt/scripts`
 
-Then, the postprocessing script executed will be `script1.sh`.
+In Faspex 5, the URL of the webhook endpoint shall be reachable from within Faspex containers.
+For example, if `ascli` in running in the base host, the URL hostname shall not be localhost, as this refers to the local address inside Faspex container.
+Instead, one can specify the IP address of the host or `host.containers.internal`.
 
-Environment variables at set to the values provided by the web hook which are the same as Faspex 4 postprocessing.
+**Webhook endpoint URI** : `http://host.containers.internal:8080/processing/script1.sh`
 
-### Faspex 5: Missing commands
+Then the postprocessing script executed will be `/opt/scripts/script1.sh`.
+
+### Faspex 5: Faspex 4 Gateway
+
+> **Note:** This is not a feature for production. It's provided for testing only.
+
+For legacy faspex client applications that use the `send` API (only) of Faspex v4, the command `gateway` provides the capability to present an API compatible with Faspex 4, and it will call the Faspex 5 API.
+
+It takes a single argument which is the URL at which the gateway will be located (locally):
+
+```bash
+ascli faspex5 gateway https://localhost:12345/aspera/faspex
+```
+
+There are many limitations:
+
+- It's only to emulate the Faspex 4 `send` API (send package)
+- No support for remote sources, only for an actual file transfer by the client
+- The client must use the transfer spec returned by the API (not faspe: URL)
+- tags returned in transfer spec must be used in transfer
+- only a single authentication is possible (per gateway) on Faspex5
+- no authentication of F4 side (ignored)
+
+Behavior: The API client calls the Faspex 4 API on the gateway, then the gateway transforms this into a Faspex5 API call, which returns a transfer spec, which is returned to the calling client. The calling client uses this to start a transfer to HSTS which is actually managed by Faspex 5.
+
+### Faspex 5: Get Bearer token to use API
 
 If a command is missing, then it is still possible to execute command by calling directly the API on the command line using `curl`:
 
@@ -6379,6 +6744,8 @@ curl -H "Authorization: $(ascli ascli bearer)" https://faspex5.example.com/asper
 
 ## Plugin: `faspex`: IBM Aspera Faspex v4
 
+> **Note:** Faspex v4 is end of support since Sept. 30th, 2024. So this plugin for faspex v4 is deprecated. If you still need to use Faspex4, then use `ascli` version 4.19.0 or earlier.
+>
 > **Note:** For full details on Faspex API, refer to: [Reference on Developer Site](https://developer.ibm.com/apis/catalog/?search=faspex)
 
 This plugin uses APIs versions 3 Faspex v4.
@@ -6559,7 +6926,7 @@ package receive f4_prs2 --to-folder=. --box=sent
 package send --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["*my_dbx"]}' test_file.bin
 package send --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["*my_wkg"]}' test_file.bin
 package send --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["my_email_internal","my_username"]}' test_file.bin
-package send --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["my_email_internal"]}' --remote_source=%name:my_src sample_source.txt
+package send --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE","recipients":["my_email_internal"]}' --remote-source=%name:my_src sample_source.txt
 package send --link=https://app.example.com/send_to_dropbox_path --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE"}' test_file.bin
 package send --link=https://app.example.com/send_to_user_path --delivery-info=@json:'{"title":"$(notdir test) PACKAGE_TITLE_BASE"}' test_file.bin
 source info %name:my_src --storage=@preset:faspex4_storage
@@ -6603,12 +6970,12 @@ To figure out the entities payload, for example for creation, refer to the API d
 admin group all list
 admin node list
 admin share list --fields=DEF,-status,status_message
-admin share user_permissions 1 list
+admin share user_permissions 3 list
 admin user all app_authorizations 1 modify @json:'{"app_login":true}'
 admin user all app_authorizations 1 show
 admin user all list
 admin user all share_permissions 1 list
-admin user all share_permissions 1 show 1
+admin user all share_permissions 1 show 3
 admin user ldap add the_name
 admin user local list
 admin user saml import @json:'{"id":"the_id","name_id":"the_name"}'
@@ -6616,9 +6983,10 @@ files browse /
 files delete my_share1/new_folder
 files delete my_share1/test_file.bin
 files download --to-folder=. my_share1/test_file.bin
-files download --to-folder=. my_share1/test_file.bin --transfer=httpgw --transfer-info=@json:'{"url":"https://tst.example.com/path@"}'
+files download --to-folder=. my_share1/test_file.bin my_share1/test_file.bin --transfer=httpgw --transfer-info=@json:'{"url":"https://tst.example.com/path@"}'
 files mkdir my_share1/new_folder
 files upload --to-folder=https://shares.share1 'faux:///testfile?1m' --transfer=httpgw --transfer-info=@json:'{"url":"my_example.com/path@","synchronous":true,"api_version":"v1","upload_chunk_size":100000}'
+files upload --to-folder=https://shares.share1 sendfolder --transfer=httpgw --transfer-info=@json:'{"url":"my_example.com/path@","synchronous":true,"api_version":"v1","upload_chunk_size":100000}'
 files upload --to-folder=my_share1 test_file.bin
 files upload --to-folder=my_share1 test_file.bin --transfer=httpgw --transfer-info=@json:'{"url":"https://tst.example.com/path@"}'
 health
@@ -6673,7 +7041,7 @@ If you don't have credentials but have access to the IBM Cloud console, then use
 If you have those parameters already, then following options shall be provided:
 
 - `bucket` bucket name
-- `endpoint` storage endpoint url, e.g. `https://s3.hkg02.cloud-object-storage.appdomain.cloud`
+- `endpoint` storage endpoint URL, e.g. `https://s3.hkg02.cloud-object-storage.appdomain.cloud`
 - `apikey` API Key
 - `crn` resource instance id
 
@@ -6684,7 +7052,7 @@ ascli config preset update mycos --bucket=mybucket --endpoint=https://s3.us-east
 ascli config preset set default cos mycos
 ```
 
-Then, jump to the transfer example.
+Then, jump to the [transfer example](#operations-transfers).
 
 ### Using service credential file
 
@@ -6759,14 +7127,13 @@ ascli cos node info
 ascli cos node upload 'faux:///sample1G?1g'
 ```
 
-> **Note:** A dummy file `sample1G` of size 2GB is generated using the `faux` PVCL (man `ascp` and section above), but you can, of course, send a real file by specifying a real file instead.
+> **Note:** A dummy file `sample1G` of size 2GB is generated using the `faux` PVCL (man `ascp` and section above), but you can, of course, send a real file by specifying a real file path instead.
 
 ### Cos sample commands
 
 > **Note:** Add `ascli cos` in front of the commands:
 
 ```bash
-node access_key show self
 node download test_file.bin --to-folder=.
 node info --bucket=my_bucket --endpoint=my_endpoint --apikey=my_api_key --crn=my_resource_instance_id
 node info --bucket=my_bucket --region=my_region --service-credentials=@json:@file:my_cos_svc_cred
@@ -6782,6 +7149,7 @@ node upload test_file.bin
 
 ```bash
 health
+info
 ```
 
 ## Plugin: `faspio`: Faspio Gateway
@@ -6806,7 +7174,8 @@ Retrieve information on subscription.
 > **Note:** Add `ascli alee` in front of the commands:
 
 ```bash
-health
+entitlement
+health -N
 ```
 
 ## Plugin: `preview`: Preview generator for AoC
@@ -7107,6 +7476,7 @@ If the preview generator does not have access to files on the file system (it is
 
 ```bash
 check --skip-types=office
+events --once-only=yes --skip-types=office --log-level=info
 scan --scan-id=1 --skip-types=office --log-level=info --file-access=remote --ts=@json:'{"target_rate_kbps":1000000}'
 scan --skip-types=office --log-level=info
 show --base=test my_docx
@@ -7211,7 +7581,7 @@ Interesting `ascp` features are found in its arguments: (see `ascp` manual):
 
 > **Note:** `ascli` takes transfer parameters exclusively as a [**transfer-spec**](#transfer-specification), with `ts` option.
 >
-> **Note:** Most, but not all, native `ascp` arguments are available as standard [**transfer-spec**](#transfer-specification) parameters.
+> **Note:** Usual native `ascp` arguments are available as standard [**transfer-spec**](#transfer-specification) parameters, but not special or advanced options.
 >
 > **Note:** Only for the [`direct`](#agent-direct) transfer agent (not others, like connect or node), native `ascp` arguments can be provided with parameter `ascp_args` of option `transfer_info` .
 
@@ -7369,10 +7739,12 @@ A default e-mail template is used, but it can be overridden with option `notify_
 
 The environment provided contains the following additional variables:
 
-- `subject`
-- `body`
-- `global_transfer_status`
-- `ts`
+- `subject` : a default subject including transfer status
+- `status` : global status of transfer
+- `ts` : the [**transfer-spec**](#transfer-specification) used for the transfer
+- `from_email` : email of sender (from `smtp` configuration)
+- `from_name` : name of sender (from `smtp` configuration)
+- `to` : recipient of the email (from `notify_to`)
 
 Example of template:
 
@@ -7381,7 +7753,7 @@ From: <%=from_name%> <<%=from_email%>>
 To: <<%=to%>>
 Subject: <%=subject%>
 
-Transfer is: <%=global_transfer_status%>
+Transfer is: <%=status%>
 ```
 
 ## Tool: `asession`
@@ -7465,21 +7837,25 @@ asession -h
 USAGE
     asession
     asession -h|--help
-    asession <session spec extended value>
+    asession [<session spec extended value>]
     
     If no argument is provided, default will be used: @json:@stdin
     -h, --help display this message
-    <session spec extended value> a dictionary value (Hash)
+    <session spec extended value> a dictionary (Hash)
     The value can be either:
        the JSON description itself, e.g. @json:'{"xx":"yy",...}'
        @json:@stdin, if the JSON is provided from stdin
        @json:@file:<path>, if the JSON is provided from a file
-    Parameter spec is mandatory, it contains the transfer spec
+    The following keys are recognized in session spec:
+       spec : mandatory, contains the transfer spec
+       loglevel : modify log level (to stderr)
+       agent : modify transfer agent parameters, e.g. ascp_args
+       file_list_folder : location of temporary files
+       sdk : location of SDK (ascp)
     Asynchronous commands can be provided on STDIN, examples:
        {"type":"START","source":"/aspera-test-dir-tiny/200KB.2"}
        {"type":"START","source":"xx","destination":"yy"}
        {"type":"DONE"}
-Note: debug information can be placed on STDERR, using the "loglevel" parameter in session spec (debug=0)
 EXAMPLES
     asession @json:'{"spec":{"remote_host":"demo.asperasoft.com","remote_user":"asperaweb","ssh_port":33001,"remote_password":"demoaspera","direction":"receive","destination_root":"./test.dir","paths":[{"source":"/aspera-test-dir-tiny/200KB.1"}]}}'
     echo '{"spec":{"remote_host":...}}'|asession @json:@stdin