@uipath/skills 1.201.0-preview.621 → 1.202.0-preview.635

package/skills/uipath-admin/references/ip-restriction/ip-range-management.md

@@ -1,21 +1,16 @@
 # IP Range Management
 
-Multi-step workflows for managing IP allowlist entries via `uip admin ip-restriction ip-ranges`. For per-command flag tables, output codes, and single-command examples, see [ip-restriction-commands.md](ip-restriction-commands.md).
+Manage IP allowlist entries with `uip admin ip-restriction ip-ranges`. See [ip-restriction-commands.md](ip-restriction-commands.md) for flag tables, output codes, and single-command examples.
 
 ## Concept
 
-Each entry is one of:
-- A **CIDR block** (e.g., `10.0.0.0/16`) — preferred shape.
-- A **start/end IP range** (e.g., `10.0.0.1`–`10.0.0.50`) — legacy shape, still supported.
-- A **list of CIDRs** under one named entry (pass `--cidr` multiple times).
+An entry is a preferred **CIDR block** (for example, `10.0.0.0/16`), a supported legacy **start/end IP range** (for example, `10.0.0.1`–`10.0.0.50`), or multiple CIDRs under one name using repeated `--cidr` flags.
 
-Entries can carry an `--expires` duration (`<INTEGER><m|h|d|w>` — e.g. `15m`, `2h`, `30d`, `1w`).
+Entries may use `--expires` with `<INTEGER><m|h|d|w>` (for example, `15m`, `2h`, `30d`, `1w`). When `enforcement get` returns `Enabled`, only addresses in these entries can reach the org. See [enforcement-management.md](enforcement-management.md).
 
-When `enforcement get` returns `Enabled`, only addresses inside these entries can reach the org. See [enforcement-management.md](enforcement-management.md) for the switch.
+## Add an Entry (idempotent on CIDR)
 
-## Workflow: Add an Entry (idempotent on CIDR)
-
-`create` is idempotent on CIDR — running it twice with the same `--cidr` is a safe no-op.
+`create` is idempotent on CIDR: repeating the same `--cidr` is a safe no-op. Run the applicable command:
 
 ### Single CIDR
 
@@ -58,68 +53,76 @@ uip admin ip-restriction ip-ranges create \
 
 ### Full body via JSON file
 
+Run:
+
 ```bash
 uip admin ip-restriction ip-ranges create --file ./entry.json --output json
 ```
 
 The body is `AddIpConfigurationRequest`.
 
-## Workflow: Update an Entry
+## Update an Entry
 
-Patch an existing entry — rename, swap CIDRs, extend / shorten expiry, or migrate between CIDR and start/end shapes. Common scenarios: extending an expiring contractor allowlist, replacing a stale office CIDR after an ISP change.
+Update an entry to rename it, replace CIDRs, change expiry, or migrate between CIDR and start/end shapes. First run:
 
-1. Fetch the current entry so you can see what's there:
-   ```bash
-   uip admin ip-restriction ip-ranges get <ENTRY_ID> --output json
-   ```
-   Or lookup by CIDR if you only know that:
-   ```bash
-   uip admin ip-restriction ip-ranges get --cidr "<CURRENT_CIDR>" --output json
-   ```
-2. Apply the patch — only the flags you pass are updated:
+```bash
+uip admin ip-restriction ip-ranges get <ENTRY_ID> --output json
+```
 
-   **Rename:**
-   ```bash
-   uip admin ip-restriction ip-ranges update <ENTRY_ID> --name "<NEW_NAME>" --output json
-   ```
+If only the CIDR is known, run:
 
-   **Replace CIDR(s):**
-   ```bash
-   uip admin ip-restriction ip-ranges update <ENTRY_ID> --cidr "<NEW_CIDR>" --output json
-   ```
+```bash
+uip admin ip-restriction ip-ranges get --cidr "<CURRENT_CIDR>" --output json
+```
 
-   **Swap to a start/end IP range:**
-   ```bash
-   uip admin ip-restriction ip-ranges update <ENTRY_ID> --start-ip "<IP>" --end-ip "<IP>" --output json
-   ```
+Run only the needed patch command:
 
-   **Full body via `--file`** (for fields not exposed inline):
-   ```bash
-   uip admin ip-restriction ip-ranges update <ENTRY_ID> --file ./entry-update.json --output json
-   ```
+**Rename:**
+
+```bash
+uip admin ip-restriction ip-ranges update <ENTRY_ID> --name "<NEW_NAME>" --output json
+```
+
+**Replace CIDR(s):**
+
+```bash
+uip admin ip-restriction ip-ranges update <ENTRY_ID> --cidr "<NEW_CIDR>" --output json
+```
+
+**Swap to a start/end IP range:**
+
+```bash
+uip admin ip-restriction ip-ranges update <ENTRY_ID> --start-ip "<IP>" --end-ip "<IP>" --output json
+```
+
+**Full body via `--file`:**
+
+```bash
+uip admin ip-restriction ip-ranges update <ENTRY_ID> --file ./entry-update.json --output json
+```
 
-> **Replacing a CIDR while enforcement is on is lockout-sensitive.** If you're swapping the CIDR that currently covers your IP, the new value must also cover it — verify against `my-ip` first. The CLI does not run a pre-flight on `update` (unlike `delete`).
+> **Replacing a CIDR while enforcement is on is lockout-sensitive.** If the current CIDR covers your IP, the new value must also cover it. Verify against `my-ip` first. The CLI does not run a pre-flight on `update` (unlike `delete`).
 
-## Workflow: Delete an Entry (lockout-sensitive)
+## Delete an Entry (lockout-sensitive)
 
-**Lockout warning** — removing the wrong entry while enforcement is enabled can lock the caller (or the whole org) out of UiPath.
+Removing the wrong entry while enforcement is enabled can lock the caller or the whole org out of UiPath.
 
-1. Confirm the entry to delete:
+1. Confirm the entry by running:
    ```bash
    uip admin ip-restriction ip-ranges get <ENTRY_ID> --output json
    ```
-2. Check enforcement state — and mention it when confirming with the user:
+2. Check enforcement state and mention it when confirming with the user by running:
    ```bash
    uip admin ip-restriction enforcement get --output json
    ```
 3. Confirm with the user explicitly.
-4. Delete with `--confirm`:
+4. Delete with `--confirm` by running:
    ```bash
    uip admin ip-restriction ip-ranges delete <ENTRY_ID> --confirm --output json
    ```
-   Or by CIDR:
+   Or delete by CIDR by running:
    ```bash
    uip admin ip-restriction ip-ranges delete --cidr "<CIDR>" --confirm --output json
    ```
 
-If enforcement is on, the CLI also runs a server-side safety pre-flight (`only-entry` / `caller-IP-uniquely-covered`) and may reject the delete. To bypass that check, run `enforcement disable` first — but only if you understand the consequences. See [enforcement-management.md](enforcement-management.md).
+When enforcement is on, the CLI also runs a server-side safety pre-flight (`only-entry` / `caller-IP-uniquely-covered`) and may reject the delete. To bypass it, run `enforcement disable` first—but only if you understand the consequences. See [enforcement-management.md](enforcement-management.md).

package/skills/uipath-admin/references/ip-restriction/ip-restriction-commands.md

@@ -1,113 +1,97 @@
 # IP-Restriction CLI Command Reference
 
-Complete reference for all `uip admin ip-restriction` commands — org-wide IP allowlisting, the enforcement switch, URL-pattern bypass rules, and the `my-ip` lookup.
+Reference for `uip admin ip-restriction`: organization-wide IP allowlisting, enforcement, URL-pattern bypass rules, and `my-ip` lookup.
 
-> **Internal acronym: `APMS`** (Access Policy Management Service). This is the platform's internal name for IP Restriction. **Never surface `APMS` in user-facing output** — always say "IP Restriction".
+> **Internal acronym: `APMS`** (Access Policy Management Service). Never surface `APMS` in user-facing output; say “IP Restriction”.
 
-For workflow-level guidance, see [ip-range-management.md](ip-range-management.md), [enforcement-management.md](enforcement-management.md), and [bypass-rule-management.md](bypass-rule-management.md).
+For workflow guidance, see [ip-range-management.md](ip-range-management.md), [enforcement-management.md](enforcement-management.md), and [bypass-rule-management.md](bypass-rule-management.md).
 
-## Global Flags
+## Global flags
 
-Every command accepts these flags (omitted from per-command tables):
+All commands accept:
 
 | Flag | Description |
-|------|-------------|
-| `--output <format>` | Output format: `json`, `table`, `yaml`, `plain` (default: json) |
-| `--output-filter <expression>` | JMESPath expression to filter output |
-| `--log-level <level>` | Log level: `debug`, `info`, `warn`, `error` (default: info) |
-| `--log-file <path>` | Write logs to file instead of stderr |
-| `--login-validity <minutes>` | Override token validity — forces refresh if token expires within this window |
+|---|---|
+| `--output <format>` | `json`, `table`, `yaml`, or `plain` (default: `json`) |
+| `--output-filter <expression>` | JMESPath output filter |
+| `--log-level <level>` | `debug`, `info`, `warn`, or `error` (default: `info`) |
+| `--log-file <path>` | Write logs instead of stderr |
+| `--login-validity <minutes>` | Force token refresh when it expires within this window |
 
-Organization is resolved automatically from the active login session.
+Organization is resolved from the active login session.
 
-## Prerequisites
+## Prerequisites and safety
+
+Run:
 
 ```bash
 uip login status --output json
 ```
 
-If not logged in: `uip login`.
-
-## Concepts
-
-- **Allowlist semantics.** When `enforcement` is `Enabled`, only IP networks in `ip-ranges list` can reach the org. Everything else is blocked.
-- **Lockout risk is the dominant concern.** Removing the wrong CIDR or enabling enforcement with the caller's IP outside the list locks the caller (and possibly the whole org) out of UiPath. Safety rails:
-  - `enforcement enable` runs a `my-ip` pre-flight and rejects the call if the caller's IP is not covered.
-  - `ip-ranges delete` runs a server-side safety pre-flight (only-entry / caller-IP-uniquely-covered) when enforcement is on.
-  - Both `ip-ranges delete` and `enforcement enable` require `--confirm`.
-- **Idempotent ops.** `ip-ranges create` upserts on CIDR (safe to re-run). `enforcement enable` / `disable` are idempotent.
-- **Bypass rules are server-compiled.** The CLI sends `regexEntry`; the platform compiles the regex.
-- **Bypass rules only matter when enforcement is `Enabled`.** With enforcement disabled they have no effect.
-
----
+If not logged in, run `uip login`.
 
-## IP Ranges — `uip admin ip-restriction ip-ranges`
+- When `enforcement` is `Enabled`, only networks in `ip-ranges list` can reach the organization; all others are blocked.
+- Lockout is the primary risk. `enforcement enable` runs a `my-ip` pre-flight and rejects callers not covered by the allowlist. `ip-ranges delete` runs a server-side only-entry/caller-IP-uniquely-covered pre-flight when enforcement is on. Both commands require `--confirm`.
+- `ip-ranges create` upserts on CIDR; `enforcement enable` and `disable` are idempotent.
+- Bypass rules send `regexEntry`; the platform compiles it. They apply only when enforcement is `Enabled`.
 
-Each entry is one of:
-- A **CIDR block** (e.g., `10.0.0.0/16`) — preferred shape.
-- A **start/end IP range** (e.g., `10.0.0.1`–`10.0.0.50`) — legacy shape.
-- A **list of CIDRs** under one named entry (pass `--cidr` multiple times).
+## IP ranges — `uip admin ip-restriction ip-ranges`
 
-Entries can carry an `--expires` duration (`15m`, `2h`, `30d`, `1w`).
+An entry may contain a CIDR block, a legacy start/end IP range, or multiple CIDRs under one name. `--expires` accepts `15m`, `2h`, `30d`, or `1w`.
 
-### `ip-ranges list`
+### List
 
-List allowlist entries.
+Run:
 
 ```bash
 uip admin ip-restriction ip-ranges list --output json
 uip admin ip-restriction ip-ranges list --filter "<NAME_FRAGMENT>" --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--filter <fragment>` | No | Case-insensitive substring match on entry `name` (client-side) |
+`--filter <fragment>` is an optional, client-side, case-insensitive substring match on `name`.
 
 **Output code:** `ApmsIpRangesList`.
 
-### `ip-ranges get`
+### Get
 
-Fetch an entry by id or by CIDR.
+Run either:
 
 ```bash
 uip admin ip-restriction ip-ranges get <ENTRY_ID> --output json
 uip admin ip-restriction ip-ranges get --cidr "<CIDR>" --output json
 ```
 
-| Argument/Flag | Required | Description |
-|---------------|----------|-------------|
-| `<ENTRY_ID>` | Conditional | Entry UUID (positional) — required unless `--cidr` |
-| `--cidr <cidr>` | Conditional | Lookup by CIDR value instead of id |
+`<ENTRY_ID>` is required unless `--cidr` is supplied. `--cidr <cidr>` looks up by CIDR.
 
 **Output code:** `ApmsIpRangeGet`.
 
-### `ip-ranges create`
+### Create
 
-Add an allowlist entry. **Idempotent on CIDR** — re-running with the same `--cidr` is a safe no-op.
+Run:
 
 ```bash
 uip admin ip-restriction ip-ranges create \
-  --name "<DISPLAY_NAME>" \
-  --cidr "<CIDR>" \
-  --output json
+  --name "<DISPLAY_NAME>" --cidr "<CIDR>" --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--name <name>` | Yes (inline) | Display name for the entry |
-| `--cidr <cidr>` | Conditional | CIDR block. Repeatable for multiple CIDRs under one entry |
-| `--start-ip <ip>` | Conditional | Start of legacy IP range. Requires `--end-ip` |
-| `--end-ip <ip>` | Conditional | End of legacy IP range. Requires `--start-ip` |
-| `--expires <duration>` | No | Expiry: `<INTEGER><m\|h\|d\|w>` (e.g., `30d`, `2h`) |
+This is idempotent on CIDR and is safe to rerun with the same `--cidr`.
+
+| Flag | Requirement | Description |
+|---|---|---|
+| `--name <name>` | Required inline | Display name |
+| `--cidr <cidr>` | Conditional | CIDR; repeat for multiple CIDRs under one entry |
+| `--start-ip <ip>` | Conditional | Legacy range start; requires `--end-ip` |
+| `--end-ip <ip>` | Conditional | Legacy range end; requires `--start-ip` |
+| `--expires <duration>` | Optional | `<INTEGER><m\|h\|d\|w>` |
 | `--file <path>` | Alternative | Full `AddIpConfigurationRequest` body |
 
-Either `--cidr` (one or more) **or** the `--start-ip`/`--end-ip` pair is required.
+Supply either one or more `--cidr` flags or the `--start-ip`/`--end-ip` pair.
 
 **Output code:** `ApmsIpRangeCreated`.
 
-### `ip-ranges update`
+### Update
 
-Patch an entry.
+Run one of:
 
 ```bash
 uip admin ip-restriction ip-ranges update <ENTRY_ID> --name "<NEW_NAME>" --output json
@@ -116,130 +100,101 @@ uip admin ip-restriction ip-ranges update <ENTRY_ID> --start-ip "<IP>" --end-ip
 uip admin ip-restriction ip-ranges update <ENTRY_ID> --file ./entry-update.json --output json
 ```
 
-| Argument/Flag | Required | Description |
-|---------------|----------|-------------|
-| `<ENTRY_ID>` | Yes | Entry UUID |
-| `--name <name>` | No | New display name |
-| `--cidr <cidr>` | No | Replace CIDR(s) |
-| `--start-ip <ip>` | No | New range start |
-| `--end-ip <ip>` | No | New range end |
-| `--file <path>` | Alternative | Full update body |
+`<ENTRY_ID>` is required. Optional patch flags are `--name <name>`, `--cidr <cidr>` (replace CIDR(s)), `--start-ip <ip>`, `--end-ip <ip>`, or alternative `--file <path>` containing the full update body.
 
 **Output code:** `ApmsIpRangeUpdated`.
 
-### `ip-ranges delete`
+### Delete
 
-Remove an entry. **Lockout-sensitive — requires `--confirm`.**
+Run with confirmation:
 
 ```bash
 uip admin ip-restriction ip-ranges delete <ENTRY_ID> --confirm --output json
 uip admin ip-restriction ip-ranges delete --cidr "<CIDR>" --confirm --output json
 ```
 
-| Argument/Flag | Required | Description |
-|---------------|----------|-------------|
-| `<ENTRY_ID>` | Conditional | Entry UUID (positional) — required unless `--cidr` |
-| `--cidr <cidr>` | Conditional | Delete by CIDR value instead of id |
-| `--confirm` | Yes | Acknowledge lockout risk |
-
-If enforcement is on, the CLI also runs a server-side safety pre-flight (only-entry / caller-IP-uniquely-covered) and may reject the delete. To bypass: run `enforcement disable` first (only if you understand the consequences).
+`<ENTRY_ID>` is required unless `--cidr` is supplied. `--confirm` is required. When enforcement is on, the server may reject deletion if the entry is the only entry or uniquely covers the caller’s IP. To bypass that check, first run `enforcement disable`, only if the consequences are understood.
 
 **Output code:** `ApmsIpRangeDeleted`.
 
----
-
-## Enforcement Switch — `uip admin ip-restriction enforcement`
+## Enforcement switch — `uip admin ip-restriction enforcement`
 
-Singleton per organization. **Idempotent** on both sides — flipping twice is a safe no-op.
+There is one switch per organization. Both states are idempotent.
 
-### `enforcement get`
+### Get
 
-Current enforcement state.
+Run:
 
 ```bash
 uip admin ip-restriction enforcement get --output json
 ```
 
-Returns `Data.status`: `Enabled` or `Disabled`.
+`Data.status` is `Enabled` or `Disabled`.
 
 **Output code:** `ApmsEnforcementGet`.
 
-### `enforcement enable`
+### Enable
 
-Turn enforcement on. **Lockout-sensitive — requires `--confirm` and a `my-ip` pre-flight.**
+Run with confirmation:
 
 ```bash
 uip admin ip-restriction enforcement enable --confirm --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--confirm` | Yes | Acknowledge lockout risk |
-
-The CLI runs its own `my-ip` pre-flight and rejects the call if the caller is not covered by any entry in `ip-ranges list`. If rejected, do NOT retry until the allowlist is fixed — see [enforcement-management.md](enforcement-management.md).
+`--confirm` is required. The CLI runs a `my-ip` pre-flight and rejects the call if the caller is not covered by any `ip-ranges list` entry. If rejected, do not retry until the allowlist is fixed; see [enforcement-management.md](enforcement-management.md).
 
 **Output code:** `ApmsEnforcementEnabled`.
 
-### `enforcement disable`
+### Disable
 
-Turn enforcement off. **Safe and idempotent.** No `--confirm` required.
+Run:
 
 ```bash
 uip admin ip-restriction enforcement disable --output json
 ```
 
-Use this to recover from a near-lockout, or to bypass the `ip-ranges delete` safety pre-flight.
+This is safe and idempotent; it requires no `--confirm`. Use it to recover from a near-lockout or bypass the `ip-ranges delete` safety pre-flight.
 
 **Output code:** `ApmsEnforcementDisabled`.
 
----
-
-## Bypass Rules — `uip admin ip-restriction bypass-rules`
+## Bypass rules — `uip admin ip-restriction bypass-rules`
 
-URL-pattern exceptions to IP allowlisting. Each rule's `regexEntry` is compiled server-side.
+Rules are URL-pattern exceptions. The server compiles each `regexEntry`; rules have no effect while enforcement is `Disabled`.
 
-### `bypass-rules list`
+### List
 
-List rules.
+Run:
 
 ```bash
 uip admin ip-restriction bypass-rules list --output json
 uip admin ip-restriction bypass-rules list --filter "<FRAGMENT>" --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--filter <fragment>` | No | Case-insensitive substring match on `regexEntry` or `appName` (client-side) |
+`--filter <fragment>` is optional and performs a client-side, case-insensitive substring match on `regexEntry` or `appName`.
 
 **Output code:** `ApmsBypassRulesList`.
 
-### `bypass-rules get`
+### Get
 
-Fetch a rule by id.
+Run:
 
 ```bash
 uip admin ip-restriction bypass-rules get <RULE_ID> --output json
 ```
 
-| Argument | Required | Description |
-|----------|----------|-------------|
-| `<RULE_ID>` | Yes | Rule UUID |
+`<RULE_ID>` is required and is a rule UUID.
 
 **Output code:** `ApmsBypassRulesGet`.
 
-### `bypass-rules create`
+### Create
 
-Create a rule. **File-only** — no inline shortcut.
+Create is file-only. Run:
 
 ```bash
 uip admin ip-restriction bypass-rules create --file ./bypass-rule.json --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--file <path>` | Yes | `AddRegexBypassRequest` body |
-
-`./bypass-rule.json`:
+`--file <path>` is required and contains an `AddRegexBypassRequest` body:
 
 ```json
 {
@@ -248,71 +203,59 @@ uip admin ip-restriction bypass-rules create --file ./bypass-rule.json --output
 }
 ```
 
-Authoring tips: escape dots (`\.`), anchor with `^` and `$`.
+Escape dots (`\.`) and anchor patterns with `^` and `$`.
 
 **Output code:** `ApmsBypassRulesCreated`.
 
-### `bypass-rules update`
+### Update
 
-Patch a rule.
+Run either:
 
 ```bash
 uip admin ip-restriction bypass-rules update <RULE_ID> --regex-entry "<NEW_PATTERN>" --output json
 uip admin ip-restriction bypass-rules update <RULE_ID> --file ./bypass-rule-update.json --output json
 ```
 
-| Argument/Flag | Required | Description |
-|---------------|----------|-------------|
-| `<RULE_ID>` | Yes | Rule UUID |
-| `--regex-entry <pattern>` | No | Replace the stored regex pattern |
-| `--file <path>` | Alternative | Full `UpdateRegexBypassRequest` body (use for tenant / app metadata updates) |
+`<RULE_ID>` is required. Optional `--regex-entry <pattern>` replaces the stored pattern. Alternatively, `--file <path>` supplies the full `UpdateRegexBypassRequest`, including tenant/app metadata updates.
 
 **Output code:** `ApmsBypassRulesUpdated`.
 
-### `bypass-rules delete`
+### Delete
 
-Delete a rule. **No `--confirm`** — bypass-rule deletion only narrows access.
+Run:
 
 ```bash
 uip admin ip-restriction bypass-rules delete <RULE_ID> --output json
 ```
 
-| Argument | Required | Description |
-|----------|----------|-------------|
-| `<RULE_ID>` | Yes | Rule UUID |
+`<RULE_ID>` is required. No `--confirm` is required because deletion only narrows access.
 
 **Output code:** `ApmsBypassRulesDeleted`.
 
----
-
 ## My IP — `uip admin ip-restriction my-ip`
 
-### `my-ip`
-
-Return the public IP the platform sees for the current caller. This is the direct answer whenever a user asks what their public IP is or what IP the platform sees for them ("what's my IP?", "what public IP does the platform see for me right now?") — run it standalone, no enforcement context needed. It is also the safety pre-flight before `enforcement enable` (verify the allowlist covers your IP).
+When asked for the user’s public IP or the IP the platform sees, run this standalone command; no enforcement context is needed:
 
 ```bash
 uip admin ip-restriction my-ip --output json
 ```
 
-Returns `Data.ipAddress`.
+It returns `Data.ipAddress` and is also the safety pre-flight for `enforcement enable`.
 
 **Output code:** `ApmsMyIpGet`.
 
----
-
-## Error Handling
+## Error handling
 
 | Error | Cause | Fix |
-|-------|-------|-----|
-| `--confirm required` | `ip-ranges delete` or `enforcement enable` called without `--confirm` | Re-run with `--confirm` after user confirmation |
-| Safety pre-flight rejected delete | Enforcement on + entry is the only / caller's covering entry | Add a new covering entry first, OR disable enforcement, OR target a different entry |
-| `my-ip pre-flight failed` | Caller's IP is not in any `ip-ranges` entry | Add a covering CIDR with `ip-ranges create`, then retry |
-| `entry not found` | Invalid id / CIDR not in allowlist | Run `ip-ranges list` to confirm available entries |
-| `cidr already exists` (no error — create is idempotent) | Already-present CIDR | None — `create` is upsert-on-CIDR |
-| `invalid expires` | Bad duration string | Use `<INTEGER><m\|h\|d\|w>` (e.g., `2h`, `30d`) |
-| `invalid regex` | Server failed to compile `regexEntry` | Fix the regex in the body file |
+|---|---|---|
+| `--confirm required` | Delete or enable omitted `--confirm` | After user confirmation, rerun with `--confirm` |
+| Safety pre-flight rejected delete | Enforcement is on and the entry is the only or caller-covering entry | Add a covering entry first, disable enforcement, or target another entry |
+| `my-ip pre-flight failed` | Caller’s IP is not in an `ip-ranges` entry | Run `ip-ranges create` with a covering CIDR, then retry |
+| `entry not found` | Invalid ID or CIDR absent | Run `ip-ranges list` |
+| `cidr already exists` (no error — create is idempotent) | CIDR already exists | None |
+| `invalid expires` | Invalid duration | Use `<INTEGER><m\|h\|d\|w>` such as `2h` or `30d` |
+| `invalid regex` | Server could not compile `regexEntry` | Fix the regex in the body file |
 | `rule not found` | Invalid rule UUID | Run `bypass-rules list` |
-| Bypass rule has no effect | Enforcement is `Disabled` | Bypass rules only apply when `enforcement get` returns `Enabled` |
+| Bypass rule has no effect | Enforcement is `Disabled` | Run `enforcement get`; rules apply only when it returns `Enabled` |
 | `enforcement already <state>` (no error — idempotent) | Already in target state | None |
-| Auth error | Login expired | `uip login status`, then `uip login` |
+| Auth error | Login expired | Run `uip login status`, then `uip login` |

package/skills/uipath-admin/references/key-concepts.md

@@ -0,0 +1,24 @@
+# UiPath Admin — Key Concepts
+
+> when: you need the identity/organization model — the org hierarchy, or how robot accounts differ from external apps and from robot credentials.
+
+## Organization hierarchy
+
+```
+Organization (org)
+  └── Partition (= org in most cases)
+        ├── Users           ← human identities
+        ├── Groups          ← role containers (BuiltIn + Custom)
+        ├── Robot Accounts  ← unattended automation identities
+        └── External Apps   ← OAuth2 clients (Client ID + Secret)
+```
+
+## Robot accounts vs external apps
+
+| Concept | Purpose | Managed by |
+|---|---|---|
+| **Robot account** | Identity — who the robot is | Identity Server (`uip admin`) |
+| **Robot credentials** | Per-robot Client ID + Secret for machine auth | Orchestrator (machine connection) |
+| **External app** | OAuth2 client for API integrations, CI/CD | Identity Server (`uip admin`) |
+
+Robot credentials are provisioned automatically by Orchestrator on machine connect — not by creating external apps.