@uipath/skills 1.201.0-preview.621 → 1.202.0-preview.635

package/skills/uipath-admin/references/organization-management.md

@@ -1,59 +1,53 @@
 # Organization Management
 
-Multi-step workflows for managing the caller's organization via `uip admin organizations`. For per-command flag tables, output codes, and single-command examples, see [organizations-commands.md](organizations-commands.md).
+Manage the caller's organization with `uip admin organizations`. For per-command flag tables, output codes, and single-command examples, see [organizations-commands.md](organizations-commands.md).
 
-## Concept
+## Scope
 
-The Organization Management Service (OMS) owns the org record, the region catalog, org-level service catalog (read-only), and the shared async-operation poll endpoint that tenant lifecycle ops use.
+The Organization Management Service (OMS) owns the organization record, region catalog, read-only org-level service catalog, and shared async-operation poll endpoint for tenant lifecycle operations.
 
-- **Org surface is read + update only.** `uip admin organizations` exposes `get`, `update`, `regions list`, `services list / list-available`, and `operation get`. **No `create` / `delete`** — those are not exposed by the CLI; org creation/deletion goes through the UiPath Portal or support flow.
-- **All org commands are synchronous.** Async polling on this command tree is for *tenant* lifecycle ops (see [tenant-management.md](tenant-management.md)) — the poll endpoint just happens to live under `organizations operation get`. See [Polling procedure](#polling-procedure-auto-poll-then-hand-off).
-- **Login-tenant default** does NOT apply to org commands — they always operate on the caller's organization.
+- The org surface is read/update only: `get`, `update`, `regions list`, `services list / list-available`, and `operation get`. There is no CLI `create` or `delete`; redirect organization creation/deletion to the UiPath Portal or support flow.
+- Organization commands are synchronous. `organizations operation get` polls tenant lifecycle operations (`create / update / delete / enable / disable`) and may support future async operations.
+- The login-tenant default does not apply; always target the caller's organization.
 
-## Workflow: Inspect the Organization
+## Inspect and Update
 
-The common read-side scenario — show the caller their org record.
-
-### Compact view (just the org record)
+Run the compact organization view:
 
 ```bash
 uip admin organizations get --output json
 ```
 
-Returns the organization name, id, region, country, language, lifecycle state, and timestamps.
-
-When surfacing the result to the user, lead with **`Organization: <ORG_NAME> (region: <REGION>)`** so they see at a glance which org the session is on. Do not show the raw `id` field alone — pair it with the name.
+Report it beginning with **`Organization: <ORG_NAME> (region: <REGION>)`**. It includes organization name, id, region, country, language, lifecycle state, and timestamps; never show the raw `id` alone—pair it with the name.
 
-### Bundled view (org + tenants + service catalog in one call)
+Run the bundled view **only** when tenants or services are also needed:
 
 ```bash
 uip admin organizations get --full --output json
 ```
 
-Use `--full` when you need to answer a follow-up about tenants or services in the same response — it avoids the second round-trip to `tenants list` or `services list`.
+`--full` returns a **nested `{Organization, Tenants, Logos}` envelope — NOT the flat org record** (it has no top-level `Id`). For "show / save the organization record" requests, use the plain compact `organizations get` above and save that `Data` object (name + top-level `Id`).
 
-### Discover provisioning regions for `tenants create`
+Run this to discover regions for `tenants create`, and use returned region names directly with `--region` on `tenants create`:
 
 ```bash
 uip admin organizations regions list --output json
 ```
 
-The returned region names go directly into `--region` on `tenants create`.
-
-## Workflow: Update the Organization
+Before `organizations update`, run `organizations get --output json` to resolve the target, then echo:
 
-Two shapes:
-
-- **Inline** for one or two simple fields (`--name`, `--logical-name`, `--language`).
-- **File** for the full `UpdateOrganizationCommand` body when changing multiple structured fields.
+```
+Organization: <ORG_NAME> (region: <REGION>, id: <ORG_ID>)
+Action: update
+```
 
-See [organizations-commands.md — `organizations update`](organizations-commands.md#organizations-update). Synchronous — the response carries the final state.
+Use inline flags for one or two simple fields (`--name`, `--logical-name`, `--language`); use a file for the full `UpdateOrganizationCommand` body when changing multiple structured fields. See [organizations-commands.md — `organizations update`](organizations-commands.md#organizations-update). The operation is synchronous and its response contains the final state. Do not run the mutation against only the active login session implicitly.
 
-> **No CLI `organizations create` / `delete`.** If a user asks to create or delete an organization, redirect them to the UiPath Portal or support flow — the CLI does not expose those verbs.
+Do not attempt `organizations create` or `organizations delete`; redirect those requests to the UiPath Portal or support flow.
 
-## Workflow: Poll an Async Operation
+## Poll an Async Operation
 
-Canonical poll endpoint for OMS async operations. Today every async op comes from a `tenants` lifecycle verb (`create / update / delete / enable / disable`); the endpoint lives under `organizations operation get` and works for any future async ops as well:
+Run:
 
 ```bash
 uip admin organizations operation get <OPERATION_ID> --output json
@@ -61,58 +55,56 @@ uip admin organizations operation get <OPERATION_ID> --output json
 
 ### Polling procedure (auto-poll then hand off)
 
-Auto-poll briefly, then hand control back to the user. Bounded — never indefinite.
-
-1. **Echo the operationId and the resume command** so the user can always pick up later:
+1. Echo the operationId and this resume command:
    ```bash
    uip admin organizations operation get <OPERATION_ID> --output json
    ```
-2. **Auto-poll up to 3 times at 5-second intervals** (≈15 s total). Between polls, sleep 5 s. After each call, surface the current status — e.g. *"Poll 2/3: status=`Running`"*. Never loop silently.
-3. **Stop polling on any terminal status.** Treat anything that is not `Pending` / `Running` / `InProgress` as terminal (`Succeeded`, `Failed`, `Cancelled`). On terminal, report final state and re-fetch the affected resource (`organizations get` / `tenants get <ID>`).
-4. **Still non-terminal after 3 polls → hand off with a numbered menu** (`<ROUND>` starts at 1; increment each time the user picks `1`):
+2. Auto-poll up to 3 times at 5-second intervals (about 15 s total). Sleep 5 s between calls and surface each status, for example *"Poll 2/3: status=`Running`"*. Never loop silently.
+3. Stop on any terminal status. Treat anything other than `Pending`, `Running`, or `InProgress` as terminal (`Succeeded`, `Failed`, `Cancelled`). Report the final state and re-fetch the affected resource with `organizations get` or `tenants get <ID>`.
+4. If still non-terminal after 3 polls, show this numbered menu; `<ROUND>` starts at 1 and increments whenever the user selects `1`:
    ```
    Operation <OP_ID> is still `<STATUS>` after round <ROUND> (3 × 5 s polls). Choose:
      1. Keep polling (another 3 × 5 s)
      2. Poll once more
      3. Stop and return the operationId for later
    ```
-   - `1` → resume one more auto-poll cycle; increment `<ROUND>`. After **round 2 (≈30 s total)**, drop option `1` from the menu — only `2` and `3` remain. The user cannot extend auto-polling beyond ~30 s.
-   - `2` → one more `operation get` call, then re-prompt with the same menu (option `1` still gated by the round cap).
-   - `3` → print the resume command and exit; the user can come back and run `operation get <OP_ID>` later.
-5. **Never auto-poll indefinitely.** Total auto-poll window is capped at ~30 s (2 rounds). Beyond that the user must drive every additional poll via option `2` or walk away via `3`.
+   - Select `1` to run another 3 × 5 s cycle and increment `<ROUND>`. After round 2 (about 30 s total), remove option `1`; only `2` and `3` remain. Do not extend auto-polling beyond about 30 s.
+   - Select `2` to make one `operation get` call, then show the same menu; option `1` remains subject to the round cap.
+   - Select `3` to print the resume command and exit; the user can run `operation get <OP_ID>` later.
+5. Never auto-poll indefinitely. The total auto-poll window is capped at about 30 s (2 rounds); afterward, the user must drive each poll with option `2` or select option `3`.
 
 ### Status vocabulary
 
-The response's `status` field uses these values (treat case-insensitively in match logic, but show the user the exact case from the response):
+Match case-insensitively but display the exact response case:
 
 | Family | Examples | Action |
 |---|---|---|
-| In-progress | `Pending`, `Running`, `InProgress` | Continue polling (within the 3-poll cap) |
-| Terminal — success | `Succeeded` | Stop, re-fetch the resource, report success |
-| Terminal — failure | `Failed`, `Cancelled` | Stop, surface the error payload (`Data.error` / `Data.message`), do NOT retry the original mutation automatically — ask the user |
+| In-progress | `Pending`, `Running`, `InProgress` | Continue within the 3-poll cap |
+| Terminal — success | `Succeeded` | Stop, re-fetch the resource, and report success |
+| Terminal — failure | `Failed`, `Cancelled` | Surface `Data.error` / `Data.message`; do not automatically retry the original mutation—ask the user |
 
-If the response lacks a `status` field altogether, treat the operation as in-progress for that poll and try once more; if the field is missing across all 3 polls, surface the raw response to the user and stop.
+If `status` is absent, treat that poll as in-progress and try once more. If it is absent across all 3 polls, surface the raw response and stop.
 
-## Workflow: List Org-Level Services — Provisioned vs. Available
+## List Org-Level Services
 
-Two distinct surfaces — never merge them:
+Do not merge these surfaces:
 
-| Verb | Returns | Has lifecycle status? |
+| Verb | Returns | Lifecycle status? |
 |---|---|---|
-| `organizations services list` | **Provisioned** org-level service instances (what currently exists on this org) | Yes — `Enabled`, `Disabled`, or `Deleted` (soft-deleted) |
-| `organizations services list-available` | **Catalog** of service types that *can* be provisioned at the org level | No — catalog entries are not provisioned |
+| `organizations services list` | Provisioned org-level service instances | Yes: `Enabled`, `Disabled`, or `Deleted` (soft-deleted) |
+| `organizations services list-available` | Catalog of service types available for org-level provisioning | No |
 
-### Currently provisioned (with status)
+### Provisioned services
+
+Run:
 
 ```bash
 uip admin organizations services list --output json
 ```
 
-Surface to the user as **"Provisioned services on `<ORG_NAME>`"**. For each row, show: service type, **status** (`Enabled` / `Disabled` / `Deleted`), region. Flag any soft-deleted (`Deleted`) entries explicitly so the user knows they were removed but are still recoverable.
-
-If the result is empty, say so explicitly: *"No org-level services are currently provisioned."* — do not show an empty table.
+Report under **"Provisioned services on `<ORG_NAME>`"**. For each row, show service type, **status** (`Enabled` / `Disabled` / `Deleted`), and region. Explicitly flag `Deleted` entries as removed but recoverable. If empty, say: *"No org-level services are currently provisioned."* Do not show an empty table.
 
-Optional filters (client-side, applied after the API call):
+Apply optional client-side filters after the API call:
 
 ```bash
 uip admin organizations services list --status Enabled --output json
@@ -120,27 +112,14 @@ uip admin organizations services list --service orchestrator --output json
 uip admin organizations services list --region "<REGION>" --output json
 ```
 
-### Available to provision (catalog only)
+### Available service catalog
+
+Run:
 
 ```bash
 uip admin organizations services list-available --output json
 ```
 
-Surface to the user as **"Available service catalog (org-level)"**. Do NOT add a status column — catalog entries have no lifecycle state. Visually separate this from the provisioned list (different header, ideally a different table).
-
-### When the user's intent is ambiguous
-
-If the user says "show me the services" without specifying provisioned vs. available, run both and present them in two clearly labeled sections so they can pick.
-
-## Before Mutating the Organization — Name the Target
-
-Before `organizations update`, echo the resolved target back so the user knows exactly which organization will change:
-
-```
-Organization: <ORG_NAME> (region: <REGION>, id: <ORG_ID>)
-Action: update
-```
-
-`organizations get --output json` returns the name and region — resolve them up-front; do not run the mutation against just the active login session implicitly.
+Report under **"Available service catalog (org-level)"**. Do not add a status column: catalog entries have no lifecycle state. Visually separate this from provisioned services, preferably with a different table.
 
-> The CLI does not expose `organizations delete`, so this echo only ever covers `update`. If the user asks to delete the org, redirect to the Portal / support flow.
+If the user asks to "show me the services" without distinguishing provisioned from available, run both commands and present two clearly labeled sections.

package/skills/uipath-admin/references/organizations-commands.md

@@ -1,57 +1,36 @@
 # Organizations CLI Command Reference
 
-Complete reference for all `uip admin organizations` commands — caller's organization read + update, async-operation polling (for tenant lifecycle ops), region catalog, and org-level service catalog (read-only). Part of the Organization Management Service (OMS).
-
-For tenant commands, see [tenants-commands.md](tenants-commands.md). For workflow-level guidance, see [organization-management.md](organization-management.md).
+Reference for `uip admin organizations`: caller-organization read/update, tenant-lifecycle operation polling, regions, and read-only org-level services. For tenant commands, see [tenants-commands.md](tenants-commands.md). For workflow guidance, see [organization-management.md](organization-management.md).
 
 ## Global Flags
 
-Every command accepts these flags (omitted from per-command tables):
+Every command accepts:
 
 | Flag | Description |
 |------|-------------|
-| `--output <format>` | Output format: `json`, `table`, `yaml`, `plain` (default: json) |
-| `--output-filter <expression>` | JMESPath expression to filter output |
-| `--log-level <level>` | Log level: `debug`, `info`, `warn`, `error` (default: info) |
-| `--log-file <path>` | Write logs to file instead of stderr |
-| `--login-validity <minutes>` | Override token validity — forces refresh if token expires within this window |
-
-Organization is resolved automatically from the active login session — no `--organization` flag.
-
-## Prerequisites
+| `--output <format>` | `json`, `table`, `yaml`, `plain` (default: json) |
+| `--output-filter <expression>` | JMESPath output filter |
+| `--log-level <level>` | `debug`, `info`, `warn`, `error` (default: info) |
+| `--log-file <path>` | Write logs instead of stderr |
+| `--login-validity <minutes>` | Force token refresh when expiry is within this window |
 
-```bash
-uip login status --output json
-```
-
-If not logged in: `uip login`.
+Resolve the organization from the active login; no `--organization` flag exists. Run `uip login status --output json`; if not logged in, run `uip login`.
 
 ## Concepts
 
-### OMS sync vs async — quick reference
-
-| Operation | Sync/Async | Confirm completion |
-|---|---|---|
-| `organizations get`, `update` | **Sync** | Response. No CLI `create` / `delete` — Portal / support flow only. |
-| `tenants create / update / delete / enable / disable` | **Async** — returns `operationId` | Poll `organizations operation get <OP_ID>` (single endpoint for all OMS async ops) |
-| `tenants services add / enable / disable / remove` | **Sync** | Response — except `disable` (Integration Service, Data Fabric, Insights) and `remove` (Orchestrator, Maestro, Integration Service, Data Fabric, Insights, Test Manager), which return Success but no-op. Re-list. |
-| All `*list*`, `get`, `regions list`, `services list-available` | **Sync** | — |
-
-### Notes
-
-- **Org surface is read + update only.** This command tree exposes `get`, `update`, `regions list`, `services list / list-available`, and `operation get`. **There is no `organizations create` or `organizations delete` in the CLI** — those are not exposed; org creation/deletion goes through the UiPath Portal / support flow.
-- **All org verbs are synchronous.** `update`, `get`, `regions list`, and all `services` reads complete in a single round-trip and carry the final state in the response.
-- **Single poll endpoint for the platform.** `operation get` lives here for historical reasons, but it polls async **tenant** lifecycle ops (`tenants create / update / delete / enable / disable`). Use it whenever those return an `operationId`.
-- **No login-tenant default here.** Org commands always operate on the caller's organization (resolved from the active login).
-- **Region is required for tenant create.** Run `regions list` here, then pass `--region` to `tenants create` (see [tenants-commands.md](tenants-commands.md)).
-
----
+- `organizations get` and `update` are synchronous and return final state.
+- `tenants create / update / delete / enable / disable` are asynchronous, return `operationId`, and require polling with `organizations operation get <OP_ID>`.
+- `tenants services add / enable / disable / remove` are synchronous, except `disable` (Integration Service, Data Fabric, Insights) and `remove` (Orchestrator, Maestro, Integration Service, Data Fabric, Insights, Test Manager), which return Success but no-op. Re-list.
+- All `*list*`, `get`, `regions list`, and `services list-available` commands are synchronous.
+- The organization surface is read/update only: `get`, `update`, `regions list`, `services list / list-available`, and `operation get`. There is no CLI `organizations create` or `organizations delete`; use the UiPath Portal / support flow.
+- Organization commands use the caller's organization, not a login-tenant default.
+- Region is required for tenant create. Run `regions list`, then pass `--region` to `tenants create`; see [tenants-commands.md](tenants-commands.md).
 
 ## Organization — `uip admin organizations`
 
 ### `organizations get`
 
-Fetch the caller's organization record.
+Fetch the caller's organization record:
 
 ```bash
 uip admin organizations get --output json
@@ -60,13 +39,13 @@ uip admin organizations get --full --output json
 
 | Flag | Required | Description |
 |------|----------|-------------|
-| `--full` | No | Return bundle: org + tenants + service catalog in one call |
+| `--full` | No | Return org, tenants, and service catalog in one call |
 
 **Output code:** `OmsOrganizationGet`
 
 ### `organizations update`
 
-Patch editable fields on the caller's organization. **Synchronous** — response carries the final state.
+Patch editable organization fields synchronously; the response contains final state. Pass at least one field flag or `--file`:
 
 ```bash
 uip admin organizations update --name "<NEW_NAME>" --output json
@@ -82,17 +61,13 @@ uip admin organizations update --file ./org-update.json --output json
 | `--language <code>` | No | New language code |
 | `--file <path>` | Alternative | Full `UpdateOrganizationCommand` body |
 
-At least one field flag (or `--file`) is required. **Output code:** `OmsOrganizationUpdated`.
-
-> **No `create` / `delete` here.** The CLI does not expose `organizations create` or `organizations delete`; both return `ValidationError: unknown command`. For org provisioning or removal, use the UiPath Portal or the support flow.
-
----
+**Output code:** `OmsOrganizationUpdated`. Do not use `organizations create` or `organizations delete`; the CLI does not expose them and returns `ValidationError: unknown command`. Use the UiPath Portal or support flow.
 
 ## Async Operations — `uip admin organizations operation`
 
 ### `operation get`
 
-Poll the status of an async OMS operation (tenant lifecycle today; org create/delete are not exposed by the CLI).
+Poll a tenant lifecycle operation returned by `tenants create`, `update`, `delete`, `enable`, or `disable`:
 
 ```bash
 uip admin organizations operation get <OPERATION_ID> --output json
@@ -100,41 +75,35 @@ uip admin organizations operation get <OPERATION_ID> --output json
 
 | Argument | Required | Description |
 |----------|----------|-------------|
-| `<OPERATION_ID>` | Yes | Operation UUID returned by a `tenants` lifecycle command (`create`, `update`, `delete`, `enable`, `disable`) |
-
-The response carries a `status` field. Treat `Pending` / `Running` / `InProgress` as in-progress; anything else (`Succeeded`, `Failed`, `Cancelled`) as terminal.
+| `<OPERATION_ID>` | Yes | Operation UUID returned by a tenant lifecycle command |
 
-**Polling cadence — auto-poll up to 3× at 5-second intervals, then ask the user.** Surface each intermediate status; never loop silently and never auto-poll indefinitely. For the full procedure (including the numbered next-step menu the agent presents after the 3-poll auto-window), see [organization-management.md — Polling procedure](organization-management.md#polling-procedure-auto-poll-then-hand-off).
+Treat `Pending`, `Running`, and `InProgress` as in-progress; treat every other status, including `Succeeded`, `Failed`, and `Cancelled`, as terminal. Auto-poll up to 3× at 5-second intervals, surface every intermediate status, never loop silently or indefinitely, then ask the user. Follow [organization-management.md — Polling procedure](organization-management.md#polling-procedure-auto-poll-then-hand-off) for the numbered next-step menu after the 3-poll window.
 
-**Output code:** `OmsOperationGet`.
-
----
+**Output code:** `OmsOperationGet`
 
 ## Regions — `uip admin organizations regions`
 
 ### `regions list`
 
-List provisioning regions in which Portal can stand up tenants (and orgs via the Portal). Run before `tenants create` to confirm `--region` accepts the desired value.
+Run this before `tenants create` to validate `--region`, then pass a returned region name directly to `--region`:
 
 ```bash
 uip admin organizations regions list --output json
 ```
 
-Returned region names go directly into `--region` on `tenants create`.
-
-**Output code:** `OmsRegionsList`.
+This lists provisioning regions in which Portal can stand up tenants and orgs.
 
----
+**Output code:** `OmsRegionsList`
 
 ## Org-Level Services — `uip admin organizations services`
 
-> **Read-only at the org surface.** Only `list` and `list-available` exist here — there is no `add` / `enable` / `disable` / `remove` at the org level. To provision / mutate services on a specific tenant, use [`tenants services` →](tenants-commands.md#tenant-level-services--uip-admin-tenants-services).
+This surface is read-only: only `list` and `list-available` exist. Do not use org-level `add`, `enable`, `disable`, or `remove`; mutate services on a tenant with [`tenants services` →](tenants-commands.md#tenant-level-services--uip-admin-tenants-services).
 
-> **`list` vs `list-available` are different sets — never merge them.** `services list` returns the **currently provisioned** org-level instances (each with a `status`: `Enabled` / `Disabled` / `Deleted`). `services list-available` returns the **catalog** of provisionable service types (no status — catalog entries are not provisioned). Always present them as two clearly labeled sections when surfacing results to the user. See [organization-management.md — List Org-Level Services](organization-management.md#workflow-list-org-level-services--provisioned-vs-available).
+Keep result sets separate: `services list` returns currently provisioned org-level instances with status `Enabled`, `Disabled`, or `Deleted`; `services list-available` returns provisionable catalog types with no status. Present them as clearly labeled sections. See [organization-management.md — List Org-Level Services](organization-management.md#list-org-level-services).
 
 ### `services list`
 
-List **currently provisioned** org-level service instances. Each row carries a lifecycle `status` — `Enabled`, `Disabled`, or `Deleted` (soft-deleted). Surface the status field in any presentation; flag `Deleted` entries explicitly.
+List provisioned instances, surface `status`, and explicitly flag `Deleted` entries. All filters run client-side after the API call:
 
 ```bash
 uip admin organizations services list --output json
@@ -145,31 +114,27 @@ uip admin organizations services list --region "<REGION>" --output json
 
 | Flag | Required | Description |
 |------|----------|-------------|
-| `--service <type>` | No | Filter by service type (client-side) |
-| `--status <state>` | No | Filter by lifecycle status, e.g. `Enabled`, `Disabled` (client-side) |
-| `--region <region>` | No | Filter by region (client-side) |
+| `--service <type>` | No | Client-side service-type filter |
+| `--status <state>` | No | Client-side lifecycle filter, e.g. `Enabled`, `Disabled` |
+| `--region <region>` | No | Client-side region filter |
 
-All filters are client-side after the API call (no server-side filters).
-
-**Output code:** `OmsOrgServicesList`.
+**Output code:** `OmsOrgServicesList`
 
 ### `services list-available`
 
-List the **catalog** of services that can be provisioned at the org level. Catalog only — entries are not provisioned and have no lifecycle status. Do not show a status column when surfacing results.
+List the org-level service catalog. Entries are not provisioned and have no lifecycle status; do not show a status column:
 
 ```bash
 uip admin organizations services list-available --output json
 ```
 
-**Output code:** `OmsOrgServicesAvailable`.
-
----
+**Output code:** `OmsOrgServicesAvailable`
 
 ## Error Handling
 
 | Error | Cause | Fix |
 |-------|-------|-----|
-| `region not allowed` | `--region` value not in available regions (only relevant via `tenants create`) | Run `regions list` and use a returned value |
-| Operation never completes | Async op stuck or failed | Inspect `Data` from `operation get <OPERATION_ID>`; retry or escalate |
-| Empty service list | Filter mismatch (all filters client-side) | Drop a filter or try a different value |
-| Auth error | Login expired | `uip login status`, then `uip login` |
+| `region not allowed` | `--region` is not available; relevant via `tenants create` | Run `regions list` and use a returned value |
+| Operation never completes | Async operation is stuck or failed | Inspect `Data` from `operation get <OPERATION_ID>`; retry or escalate |
+| Empty service list | Client-side filter mismatch | Drop a filter or try another value |
+| Auth error | Login expired | Run `uip login status`, then run `uip login` |

package/skills/uipath-admin/references/pat-management.md

@@ -1,23 +1,21 @@
 # PAT Management
 
-Workflows for managing personal access tokens via `uip admin pat`. For full command syntax and flags, see [identity-commands.md](identity-commands.md#personal-access-tokens--uip-admin-pat).
+Manage personal access tokens with `uip admin pat`. See [identity-commands.md](identity-commands.md#personal-access-tokens--uip-admin-pat) for full syntax and flags.
 
-PATs provide scoped API authentication for users — an alternative to OAuth2 client credentials when a user-context token is needed.
+PATs provide scoped API authentication for users when user-context authentication is required instead of OAuth2 client credentials.
 
 ## Lifetime Constraints
 
-| Constraint | Value |
-|------------|-------|
-| Minimum expiration | 1 day from now |
-| Default maximum | 360 days (~1 year) |
-| Hard maximum | 1,800 days (~5 years), configurable per org |
-| Max tokens per user | 5 (default), up to 50 |
-| Max description length | 256 characters |
+- Minimum expiration: 1 day from now
+- Default maximum: 360 days (~1 year)
+- Hard maximum: 1,800 days (~5 years), configurable per org
+- Maximum tokens per user: 5 by default, up to 50
+- Maximum description length: 256 characters
 
-## Workflow: Create a PAT
+## Create a PAT
 
-1. Discover available scopes: `uip admin scopes list --output json`
-2. Create with description, expiration, and scopes:
+1. Run `uip admin scopes list --output json` to discover available scopes.
+2. Run:
    ```bash
    uip admin pat create \
      --description "CI/CD pipeline token" \
@@ -25,36 +23,25 @@ PATs provide scoped API authentication for users — an alternative to OAuth2 cl
      --scope "OR.Folders.Read,OR.Jobs.Read" \
      --output json
    ```
-3. **Save the token value immediately.** It appears only in the creation response.
+3. Save the token value immediately; it appears only in the creation response.
 
-## Workflow: List PATs
+## List PATs
 
-List your own tokens:
-```bash
-uip admin pat list --output json
-```
-
-List all tokens in the organization (admin only):
-```bash
-uip admin pat list --scope all --output json
-```
-
-Search by user:
-```bash
-uip admin pat list --search "john" --output json
-```
+- Run `uip admin pat list --output json` to list your own tokens.
+- Run `uip admin pat list --scope all --output json` to list all organization tokens; admin access is required.
+- Run `uip admin pat list --search "john" --output json` to search by user.
 
-## Workflow: Revoke a PAT
+## Revoke a PAT
 
-Confirm with user before revoking — this permanently invalidates the token.
+Confirm with the user before revoking; revocation permanently invalidates the token. Run:
 
 ```bash
 uip admin pat revoke <TOKEN_ID> --output json
 ```
 
-## Workflow: Regenerate a PAT
+## Regenerate a PAT
 
-Regenerate with a new expiration. Returns new token value (shown only once):
+Run the following with a new expiration. The new token value is returned only once:
 
 ```bash
 uip admin pat regenerate <TOKEN_ID> --expiration "2028-01-15" --output json
@@ -63,11 +50,11 @@ uip admin pat regenerate <TOKEN_ID> --expiration "2028-01-15" --output json
 ## Error Handling
 
 | Error | Cause | Fix |
-|-------|-------|-----|
-| `not found` | Invalid token ID | Run `pat list` to find correct ID |
+|---|---|---|
+| `not found` | Invalid token ID | Run `pat list` to find the correct ID |
 | `Invalid expiration` | Bad date format | Use ISO 8601: `YYYY-MM-DD` |
-| `expiration too small` | Less than 1 day from now | Set at least 1 day in the future |
-| `expiration too large` | Exceeds org max (default 360 days) | Shorten expiration |
-| `limit reached` | Max tokens per user (default 5) | Revoke unused tokens first |
+| `expiration too small` | Less than 1 day from now | Set expiration at least 1 day in the future |
+| `expiration too large` | Exceeds the organization maximum (default 360 days) | Shorten the expiration |
+| `limit reached` | Maximum tokens per user reached (default 5) | Revoke unused tokens first |
 | `scope not found` | Invalid scope name | Run `uip admin scopes list` to find valid scopes |
-| `HTTP 403` | Listing all tokens without admin role | Omit `--scope all` to list only your own |
+| `HTTP 403` | Attempted to list all tokens without the admin role | Omit `--scope all` to list only your own tokens |

package/skills/uipath-admin/references/robot-account-management.md

@@ -1,36 +1,38 @@
 # Robot Account Management
 
-Workflows for managing robot accounts via `uip admin robot-accounts`. For full command syntax and flags, see [identity-commands.md](identity-commands.md#robot-accounts--uip-admin-robot-accounts).
+Manage robot accounts with `uip admin robot-accounts`. For syntax and flags, see [identity-commands.md](identity-commands.md#robot-accounts--uip-admin-robot-accounts).
 
-Robot accounts represent unattended automation identities that run processes without human interaction.
+Robot accounts are unattended automation identities that run processes without human interaction.
 
 ## Credential Model
 
-See [SKILL.md — Robot Accounts vs External Apps](../SKILL.md#robot-accounts-vs-external-apps) for the full distinction. Key point: robot credentials are provisioned by Orchestrator during machine connection — do not create external apps as robot credentials.
+See [Key Concepts — Robot Accounts vs External Apps](key-concepts.md#robot-accounts-vs-external-apps). Orchestrator provisions robot credentials during machine connection; do not create external apps as robot credentials.
 
-## Workflow: Create a Robot Account
+## Create a Robot Account
 
-1. Check for duplicates: `uip admin robot-accounts list --search "<NAME>" --output json`
-2. Create: `uip admin robot-accounts create "<NAME>" --display-name "<DISPLAY_NAME>" --output json`
-3. Verify: `uip admin robot-accounts list --search "<NAME>" --output json`
-4. **Next steps:** Assign to groups for role-based access, then configure machine connection in Orchestrator (which provisions robot credentials automatically).
+1. Run `uip admin robot-accounts list --search "<NAME>" --output json` to check for duplicates.
+2. Run `uip admin robot-accounts create "<NAME>" --display-name "<DISPLAY_NAME>" --output json`.
+3. Run `uip admin robot-accounts list --search "<NAME>" --output json` to verify.
+4. Assign the account to groups for role-based access, then configure machine connection in Orchestrator, which provisions robot credentials automatically.
 
-## Workflow: Update a Robot Account
+## Update a Robot Account
+
+Run:
 
 ```bash
 uip admin robot-accounts update <ROBOT_ACCOUNT_ID> --display-name "<NEW_DISPLAY_NAME>" --output json
 ```
 
-## Workflow: Delete a Robot Account
+## Delete a Robot Account
 
-1. Confirm exists: `uip admin robot-accounts get <ROBOT_ACCOUNT_ID> --output json`
-2. Confirm with user.
-3. Delete: `uip admin robot-accounts delete <ROBOT_ACCOUNT_ID> --output json`
+1. Run `uip admin robot-accounts get <ROBOT_ACCOUNT_ID> --output json` to confirm it exists.
+2. Confirm deletion with the user.
+3. Run `uip admin robot-accounts delete <ROBOT_ACCOUNT_ID> --output json`.
 
 ## Error Handling
 
 | Error | Cause | Fix |
-|-------|-------|-----|
+|---|---|---|
 | `already exists` | Robot account name taken | Choose a unique name |
 | `No fields to update` | No `--display-name` flag | Provide `--display-name` |
 | `not found` | Invalid robot account ID | Run `robot-accounts list` to find the correct ID |