@uipath/skills 1.195.0

package/skills/uipath-admin/references/organization-management.md

@@ -0,0 +1,146 @@
+# Organization Management
+
+Multi-step workflows for managing the caller's organization via `uip admin organizations`. For per-command flag tables, output codes, and single-command examples, see [organizations-commands.md](organizations-commands.md).
+
+## Concept
+
+The Organization Management Service (OMS) owns the org record, the region catalog, org-level service catalog (read-only), and the shared async-operation poll endpoint that tenant lifecycle ops use.
+
+- **Org surface is read + update only.** `uip admin organizations` exposes `get`, `update`, `regions list`, `services list / list-available`, and `operation get`. **No `create` / `delete`** — those are not exposed by the CLI; org creation/deletion goes through the UiPath Portal or support flow.
+- **All org commands are synchronous.** Async polling on this command tree is for *tenant* lifecycle ops (see [tenant-management.md](tenant-management.md)) — the poll endpoint just happens to live under `organizations operation get`. See [Polling procedure](#polling-procedure-auto-poll-then-hand-off).
+- **Login-tenant default** does NOT apply to org commands — they always operate on the caller's organization.
+
+## Workflow: Inspect the Organization
+
+The common read-side scenario — show the caller their org record.
+
+### Compact view (just the org record)
+
+```bash
+uip admin organizations get --output json
+```
+
+Returns the organization name, id, region, country, language, lifecycle state, and timestamps.
+
+When surfacing the result to the user, lead with **`Organization: <ORG_NAME> (region: <REGION>)`** so they see at a glance which org the session is on. Do not show the raw `id` field alone — pair it with the name.
+
+### Bundled view (org + tenants + service catalog in one call)
+
+```bash
+uip admin organizations get --full --output json
+```
+
+Use `--full` when you need to answer a follow-up about tenants or services in the same response — it avoids the second round-trip to `tenants list` or `services list`.
+
+### Discover provisioning regions for `tenants create`
+
+```bash
+uip admin organizations regions list --output json
+```
+
+The returned region names go directly into `--region` on `tenants create`.
+
+## Workflow: Update the Organization
+
+Two shapes:
+
+- **Inline** for one or two simple fields (`--name`, `--logical-name`, `--language`).
+- **File** for the full `UpdateOrganizationCommand` body when changing multiple structured fields.
+
+See [organizations-commands.md — `organizations update`](organizations-commands.md#organizations-update). Synchronous — the response carries the final state.
+
+> **No CLI `organizations create` / `delete`.** If a user asks to create or delete an organization, redirect them to the UiPath Portal or support flow — the CLI does not expose those verbs.
+
+## Workflow: Poll an Async Operation
+
+Canonical poll endpoint for OMS async operations. Today every async op comes from a `tenants` lifecycle verb (`create / update / delete / enable / disable`); the endpoint lives under `organizations operation get` and works for any future async ops as well:
+
+```bash
+uip admin organizations operation get <OPERATION_ID> --output json
+```
+
+### Polling procedure (auto-poll then hand off)
+
+Auto-poll briefly, then hand control back to the user. Bounded — never indefinite.
+
+1. **Echo the operationId and the resume command** so the user can always pick up later:
+   ```bash
+   uip admin organizations operation get <OPERATION_ID> --output json
+   ```
+2. **Auto-poll up to 3 times at 5-second intervals** (≈15 s total). Between polls, sleep 5 s. After each call, surface the current status — e.g. *"Poll 2/3: status=`Running`"*. Never loop silently.
+3. **Stop polling on any terminal status.** Treat anything that is not `Pending` / `Running` / `InProgress` as terminal (`Succeeded`, `Failed`, `Cancelled`). On terminal, report final state and re-fetch the affected resource (`organizations get` / `tenants get <ID>`).
+4. **Still non-terminal after 3 polls → hand off with a numbered menu** (`<ROUND>` starts at 1; increment each time the user picks `1`):
+   ```
+   Operation <OP_ID> is still `<STATUS>` after round <ROUND> (3 × 5 s polls). Choose:
+     1. Keep polling (another 3 × 5 s)
+     2. Poll once more
+     3. Stop and return the operationId for later
+   ```
+   - `1` → resume one more auto-poll cycle; increment `<ROUND>`. After **round 2 (≈30 s total)**, drop option `1` from the menu — only `2` and `3` remain. The user cannot extend auto-polling beyond ~30 s.
+   - `2` → one more `operation get` call, then re-prompt with the same menu (option `1` still gated by the round cap).
+   - `3` → print the resume command and exit; the user can come back and run `operation get <OP_ID>` later.
+5. **Never auto-poll indefinitely.** Total auto-poll window is capped at ~30 s (2 rounds). Beyond that the user must drive every additional poll via option `2` or walk away via `3`.
+
+### Status vocabulary
+
+The response's `status` field uses these values (treat case-insensitively in match logic, but show the user the exact case from the response):
+
+| Family | Examples | Action |
+|---|---|---|
+| In-progress | `Pending`, `Running`, `InProgress` | Continue polling (within the 3-poll cap) |
+| Terminal — success | `Succeeded` | Stop, re-fetch the resource, report success |
+| Terminal — failure | `Failed`, `Cancelled` | Stop, surface the error payload (`Data.error` / `Data.message`), do NOT retry the original mutation automatically — ask the user |
+
+If the response lacks a `status` field altogether, treat the operation as in-progress for that poll and try once more; if the field is missing across all 3 polls, surface the raw response to the user and stop.
+
+## Workflow: List Org-Level Services — Provisioned vs. Available
+
+Two distinct surfaces — never merge them:
+
+| Verb | Returns | Has lifecycle status? |
+|---|---|---|
+| `organizations services list` | **Provisioned** org-level service instances (what currently exists on this org) | Yes — `Enabled`, `Disabled`, or `Deleted` (soft-deleted) |
+| `organizations services list-available` | **Catalog** of service types that *can* be provisioned at the org level | No — catalog entries are not provisioned |
+
+### Currently provisioned (with status)
+
+```bash
+uip admin organizations services list --output json
+```
+
+Surface to the user as **"Provisioned services on `<ORG_NAME>`"**. For each row, show: service type, **status** (`Enabled` / `Disabled` / `Deleted`), region. Flag any soft-deleted (`Deleted`) entries explicitly so the user knows they were removed but are still recoverable.
+
+If the result is empty, say so explicitly: *"No org-level services are currently provisioned."* — do not show an empty table.
+
+Optional filters (client-side, applied after the API call):
+
+```bash
+uip admin organizations services list --status Enabled --output json
+uip admin organizations services list --service orchestrator --output json
+uip admin organizations services list --region "<REGION>" --output json
+```
+
+### Available to provision (catalog only)
+
+```bash
+uip admin organizations services list-available --output json
+```
+
+Surface to the user as **"Available service catalog (org-level)"**. Do NOT add a status column — catalog entries have no lifecycle state. Visually separate this from the provisioned list (different header, ideally a different table).
+
+### When the user's intent is ambiguous
+
+If the user says "show me the services" without specifying provisioned vs. available, run both and present them in two clearly labeled sections so they can pick.
+
+## Before Mutating the Organization — Name the Target
+
+Before `organizations update`, echo the resolved target back so the user knows exactly which organization will change:
+
+```
+Organization: <ORG_NAME> (region: <REGION>, id: <ORG_ID>)
+Action: update
+```
+
+`organizations get --output json` returns the name and region — resolve them up-front; do not run the mutation against just the active login session implicitly.
+
+> The CLI does not expose `organizations delete`, so this echo only ever covers `update`. If the user asks to delete the org, redirect to the Portal / support flow.

package/skills/uipath-admin/references/organizations-commands.md

@@ -0,0 +1,175 @@
+# Organizations CLI Command Reference
+
+Complete reference for all `uip admin organizations` commands — caller's organization read + update, async-operation polling (for tenant lifecycle ops), region catalog, and org-level service catalog (read-only). Part of the Organization Management Service (OMS).
+
+For tenant commands, see [tenants-commands.md](tenants-commands.md). For workflow-level guidance, see [organization-management.md](organization-management.md).
+
+## Global Flags
+
+Every command accepts these flags (omitted from per-command tables):
+
+| Flag | Description |
+|------|-------------|
+| `--output <format>` | Output format: `json`, `table`, `yaml`, `plain` (default: json) |
+| `--output-filter <expression>` | JMESPath expression to filter output |
+| `--log-level <level>` | Log level: `debug`, `info`, `warn`, `error` (default: info) |
+| `--log-file <path>` | Write logs to file instead of stderr |
+| `--login-validity <minutes>` | Override token validity — forces refresh if token expires within this window |
+
+Organization is resolved automatically from the active login session — no `--organization` flag.
+
+## Prerequisites
+
+```bash
+uip login status --output json
+```
+
+If not logged in: `uip login`.
+
+## Concepts
+
+### OMS sync vs async — quick reference
+
+| Operation | Sync/Async | Confirm completion |
+|---|---|---|
+| `organizations get`, `update` | **Sync** | Response. No CLI `create` / `delete` — Portal / support flow only. |
+| `tenants create / update / delete / enable / disable` | **Async** — returns `operationId` | Poll `organizations operation get <OP_ID>` (single endpoint for all OMS async ops) |
+| `tenants services add / enable / disable / remove` | **Sync** | Response — except `disable` (Integration Service, Data Fabric, Insights) and `remove` (Orchestrator, Maestro, Integration Service, Data Fabric, Insights, Test Manager), which return Success but no-op. Re-list. |
+| All `*list*`, `get`, `regions list`, `services list-available` | **Sync** | — |
+
+### Notes
+
+- **Org surface is read + update only.** This command tree exposes `get`, `update`, `regions list`, `services list / list-available`, and `operation get`. **There is no `organizations create` or `organizations delete` in the CLI** — those are not exposed; org creation/deletion goes through the UiPath Portal / support flow.
+- **All org verbs are synchronous.** `update`, `get`, `regions list`, and all `services` reads complete in a single round-trip and carry the final state in the response.
+- **Single poll endpoint for the platform.** `operation get` lives here for historical reasons, but it polls async **tenant** lifecycle ops (`tenants create / update / delete / enable / disable`). Use it whenever those return an `operationId`.
+- **No login-tenant default here.** Org commands always operate on the caller's organization (resolved from the active login).
+- **Region is required for tenant create.** Run `regions list` here, then pass `--region` to `tenants create` (see [tenants-commands.md](tenants-commands.md)).
+
+---
+
+## Organization — `uip admin organizations`
+
+### `organizations get`
+
+Fetch the caller's organization record.
+
+```bash
+uip admin organizations get --output json
+uip admin organizations get --full --output json
+```
+
+| Flag | Required | Description |
+|------|----------|-------------|
+| `--full` | No | Return bundle: org + tenants + service catalog in one call |
+
+**Output code:** `OmsOrganizationGet`
+
+### `organizations update`
+
+Patch editable fields on the caller's organization. **Synchronous** — response carries the final state.
+
+```bash
+uip admin organizations update --name "<NEW_NAME>" --output json
+uip admin organizations update --logical-name "<NEW_SLUG>" --output json
+uip admin organizations update --language "<LANGUAGE_CODE>" --output json
+uip admin organizations update --file ./org-update.json --output json
+```
+
+| Flag | Required | Description |
+|------|----------|-------------|
+| `--name <name>` | No | New display name |
+| `--logical-name <slug>` | No | New URL slug |
+| `--language <code>` | No | New language code |
+| `--file <path>` | Alternative | Full `UpdateOrganizationCommand` body |
+
+At least one field flag (or `--file`) is required. **Output code:** `OmsOrganizationUpdated`.
+
+> **No `create` / `delete` here.** The CLI does not expose `organizations create` or `organizations delete`; both return `ValidationError: unknown command`. For org provisioning or removal, use the UiPath Portal or the support flow.
+
+---
+
+## Async Operations — `uip admin organizations operation`
+
+### `operation get`
+
+Poll the status of an async OMS operation (tenant lifecycle today; org create/delete are not exposed by the CLI).
+
+```bash
+uip admin organizations operation get <OPERATION_ID> --output json
+```
+
+| Argument | Required | Description |
+|----------|----------|-------------|
+| `<OPERATION_ID>` | Yes | Operation UUID returned by a `tenants` lifecycle command (`create`, `update`, `delete`, `enable`, `disable`) |
+
+The response carries a `status` field. Treat `Pending` / `Running` / `InProgress` as in-progress; anything else (`Succeeded`, `Failed`, `Cancelled`) as terminal.
+
+**Polling cadence — auto-poll up to 3× at 5-second intervals, then ask the user.** Surface each intermediate status; never loop silently and never auto-poll indefinitely. For the full procedure (including the numbered next-step menu the agent presents after the 3-poll auto-window), see [organization-management.md — Polling procedure](organization-management.md#polling-procedure-auto-poll-then-hand-off).
+
+**Output code:** `OmsOperationGet`.
+
+---
+
+## Regions — `uip admin organizations regions`
+
+### `regions list`
+
+List provisioning regions in which Portal can stand up tenants (and orgs via the Portal). Run before `tenants create` to confirm `--region` accepts the desired value.
+
+```bash
+uip admin organizations regions list --output json
+```
+
+Returned region names go directly into `--region` on `tenants create`.
+
+**Output code:** `OmsRegionsList`.
+
+---
+
+## Org-Level Services — `uip admin organizations services`
+
+> **Read-only at the org surface.** Only `list` and `list-available` exist here — there is no `add` / `enable` / `disable` / `remove` at the org level. To provision / mutate services on a specific tenant, use [`tenants services` →](tenants-commands.md#tenant-level-services--uip-admin-tenants-services).
+
+> **`list` vs `list-available` are different sets — never merge them.** `services list` returns the **currently provisioned** org-level instances (each with a `status`: `Enabled` / `Disabled` / `Deleted`). `services list-available` returns the **catalog** of provisionable service types (no status — catalog entries are not provisioned). Always present them as two clearly labeled sections when surfacing results to the user. See [organization-management.md — List Org-Level Services](organization-management.md#workflow-list-org-level-services--provisioned-vs-available).
+
+### `services list`
+
+List **currently provisioned** org-level service instances. Each row carries a lifecycle `status` — `Enabled`, `Disabled`, or `Deleted` (soft-deleted). Surface the status field in any presentation; flag `Deleted` entries explicitly.
+
+```bash
+uip admin organizations services list --output json
+uip admin organizations services list --service orchestrator --output json
+uip admin organizations services list --status Enabled --output json
+uip admin organizations services list --region "<REGION>" --output json
+```
+
+| Flag | Required | Description |
+|------|----------|-------------|
+| `--service <type>` | No | Filter by service type (client-side) |
+| `--status <state>` | No | Filter by lifecycle status, e.g. `Enabled`, `Disabled` (client-side) |
+| `--region <region>` | No | Filter by region (client-side) |
+
+All filters are client-side after the API call (no server-side filters).
+
+**Output code:** `OmsOrgServicesList`.
+
+### `services list-available`
+
+List the **catalog** of services that can be provisioned at the org level. Catalog only — entries are not provisioned and have no lifecycle status. Do not show a status column when surfacing results.
+
+```bash
+uip admin organizations services list-available --output json
+```
+
+**Output code:** `OmsOrgServicesAvailable`.
+
+---
+
+## Error Handling
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `region not allowed` | `--region` value not in available regions (only relevant via `tenants create`) | Run `regions list` and use a returned value |
+| Operation never completes | Async op stuck or failed | Inspect `Data` from `operation get <OPERATION_ID>`; retry or escalate |
+| Empty service list | Filter mismatch (all filters client-side) | Drop a filter or try a different value |
+| Auth error | Login expired | `uip login status`, then `uip login` |

package/skills/uipath-admin/references/pat-management.md

@@ -0,0 +1,73 @@
+# PAT Management
+
+Workflows for managing personal access tokens via `uip admin pat`. For full command syntax and flags, see [identity-commands.md](identity-commands.md#personal-access-tokens--uip-admin-pat).
+
+PATs provide scoped API authentication for users — an alternative to OAuth2 client credentials when a user-context token is needed.
+
+## Lifetime Constraints
+
+| Constraint | Value |
+|------------|-------|
+| Minimum expiration | 1 day from now |
+| Default maximum | 360 days (~1 year) |
+| Hard maximum | 1,800 days (~5 years), configurable per org |
+| Max tokens per user | 5 (default), up to 50 |
+| Max description length | 256 characters |
+
+## Workflow: Create a PAT
+
+1. Discover available scopes: `uip admin scopes list --output json`
+2. Create with description, expiration, and scopes:
+   ```bash
+   uip admin pat create \
+     --description "CI/CD pipeline token" \
+     --expiration "2027-01-15" \
+     --scope "OR.Folders.Read,OR.Jobs.Read" \
+     --output json
+   ```
+3. **Save the token value immediately.** It appears only in the creation response.
+
+## Workflow: List PATs
+
+List your own tokens:
+```bash
+uip admin pat list --output json
+```
+
+List all tokens in the organization (admin only):
+```bash
+uip admin pat list --scope all --output json
+```
+
+Search by user:
+```bash
+uip admin pat list --search "john" --output json
+```
+
+## Workflow: Revoke a PAT
+
+Confirm with user before revoking — this permanently invalidates the token.
+
+```bash
+uip admin pat revoke <TOKEN_ID> --output json
+```
+
+## Workflow: Regenerate a PAT
+
+Regenerate with a new expiration. Returns new token value (shown only once):
+
+```bash
+uip admin pat regenerate <TOKEN_ID> --expiration "2028-01-15" --output json
+```
+
+## Error Handling
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `not found` | Invalid token ID | Run `pat list` to find correct ID |
+| `Invalid expiration` | Bad date format | Use ISO 8601: `YYYY-MM-DD` |
+| `expiration too small` | Less than 1 day from now | Set at least 1 day in the future |
+| `expiration too large` | Exceeds org max (default 360 days) | Shorten expiration |
+| `limit reached` | Max tokens per user (default 5) | Revoke unused tokens first |
+| `scope not found` | Invalid scope name | Run `uip admin scopes list` to find valid scopes |
+| `HTTP 403` | Listing all tokens without admin role | Omit `--scope all` to list only your own |

package/skills/uipath-admin/references/robot-account-management.md

@@ -0,0 +1,36 @@
+# Robot Account Management
+
+Workflows for managing robot accounts via `uip admin robot-accounts`. For full command syntax and flags, see [identity-commands.md](identity-commands.md#robot-accounts--uip-admin-robot-accounts).
+
+Robot accounts represent unattended automation identities that run processes without human interaction.
+
+## Credential Model
+
+See [SKILL.md — Robot Accounts vs External Apps](../SKILL.md#robot-accounts-vs-external-apps) for the full distinction. Key point: robot credentials are provisioned by Orchestrator during machine connection — do not create external apps as robot credentials.
+
+## Workflow: Create a Robot Account
+
+1. Check for duplicates: `uip admin robot-accounts list --search "<NAME>" --output json`
+2. Create: `uip admin robot-accounts create "<NAME>" --display-name "<DISPLAY_NAME>" --output json`
+3. Verify: `uip admin robot-accounts list --search "<NAME>" --output json`
+4. **Next steps:** Assign to groups for role-based access, then configure machine connection in Orchestrator (which provisions robot credentials automatically).
+
+## Workflow: Update a Robot Account
+
+```bash
+uip admin robot-accounts update <ROBOT_ACCOUNT_ID> --display-name "<NEW_DISPLAY_NAME>" --output json
+```
+
+## Workflow: Delete a Robot Account
+
+1. Confirm exists: `uip admin robot-accounts get <ROBOT_ACCOUNT_ID> --output json`
+2. Confirm with user.
+3. Delete: `uip admin robot-accounts delete <ROBOT_ACCOUNT_ID> --output json`
+
+## Error Handling
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `already exists` | Robot account name taken | Choose a unique name |
+| `No fields to update` | No `--display-name` flag | Provide `--display-name` |
+| `not found` | Invalid robot account ID | Run `robot-accounts list` to find the correct ID |

package/skills/uipath-admin/references/smtp-management.md

@@ -0,0 +1,73 @@
+# SMTP Management
+
+Workflows for managing SMTP email settings via `uip admin smtp`. For full command syntax and flags, see [identity-commands.md](identity-commands.md#smtp--uip-admin-smtp).
+
+SMTP settings control how the platform sends emails (invitations, notifications, password resets).
+
+## Workflow: View Current Settings
+
+```bash
+uip admin smtp get --output json
+```
+
+Returns host, port, SSL config, sender address, and display name. Password is never returned.
+
+## Workflow: Configure SMTP (Recommended)
+
+**Test first, then save.** This prevents saving broken settings that would disrupt platform emails.
+
+1. Get current settings: `uip admin smtp get --output json`
+2. Test the new settings without saving — pass all SMTP options to `test`:
+   ```bash
+   uip admin smtp test \
+     --recipient "admin@example.com" \
+     --host "smtp.example.com" \
+     --port 587 \
+     --enable-ssl "true" \
+     --username "smtp-user" \
+     --password "smtp-pass" \
+     --from-address "noreply@example.com" \
+     --from-display-name "UiPath Platform" \
+     --output json
+   ```
+3. If test succeeds, save the settings:
+   ```bash
+   uip admin smtp update \
+     --host "smtp.example.com" \
+     --port 587 \
+     --enable-ssl "true" \
+     --username "smtp-user" \
+     --password "smtp-pass" \
+     --from-address "noreply@example.com" \
+     --from-display-name "UiPath Platform" \
+     --output json
+   ```
+4. If test fails, fix the settings and re-test before saving.
+
+When custom options are provided to `test`, `--password` is required.
+
+> If user explicitly asks to update without testing first, proceed — but note this is not recommended as broken settings will disrupt platform emails until corrected.
+
+## Workflow: Test Saved Settings
+
+Test the currently saved SMTP configuration:
+
+```bash
+uip admin smtp test --recipient "admin@example.com" --output json
+```
+
+## Workflow: Delete SMTP Settings
+
+Removes custom SMTP configuration, reverting to platform defaults. Confirm with user first.
+
+```bash
+uip admin smtp delete --output json
+```
+
+## Error Handling
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `No fields to update` | No SMTP flags provided | Provide at least one flag (e.g., `--host`, `--port`) |
+| SMTP test fails | Incorrect settings | Verify host, port, credentials, and SSL settings |
+| `HTTP 403` | Insufficient permissions | Needs admin role |