@uipath/skills 1.201.0-preview.621 → 1.202.0-preview.635

package/skills/uipath-admin/references/smtp-management.md

@@ -2,22 +2,27 @@
 
 Workflows for managing SMTP email settings via `uip admin smtp`. For full command syntax and flags, see [identity-commands.md](identity-commands.md#smtp--uip-admin-smtp).
 
-SMTP settings control how the platform sends emails (invitations, notifications, password resets).
+SMTP settings control platform emails, including invitations, notifications, and password resets.
 
-## Workflow: View Current Settings
+## View Current Settings
+
+Run:
 
 ```bash
 uip admin smtp get --output json
 ```
 
-Returns host, port, SSL config, sender address, and display name. Password is never returned.
+The response includes host, port, SSL configuration, sender address, and display name. Password is never returned.
 
-## Workflow: Configure SMTP (Recommended)
+## Configure SMTP (Recommended)
 
-**Test first, then save.** This prevents saving broken settings that would disrupt platform emails.
+Test first, then save to avoid disrupting platform emails.
 
-1. Get current settings: `uip admin smtp get --output json`
-2. Test the new settings without saving — pass all SMTP options to `test`:
+1. Get current settings:
+   ```bash
+   uip admin smtp get --output json
+   ```
+2. Test the new settings without saving. Pass all SMTP options to `test`:
    ```bash
    uip admin smtp test \
      --recipient "admin@example.com" \
@@ -30,7 +35,7 @@ Returns host, port, SSL config, sender address, and display name. Password is ne
      --from-display-name "UiPath Platform" \
      --output json
    ```
-3. If test succeeds, save the settings:
+3. If the test succeeds, save the settings:
    ```bash
    uip admin smtp update \
      --host "smtp.example.com" \
@@ -42,23 +47,23 @@ Returns host, port, SSL config, sender address, and display name. Password is ne
      --from-display-name "UiPath Platform" \
      --output json
    ```
-4. If test fails, fix the settings and re-test before saving.
+4. If the test fails, fix the settings and re-test before saving.
 
 When custom options are provided to `test`, `--password` is required.
 
-> If user explicitly asks to update without testing first, proceed — but note this is not recommended as broken settings will disrupt platform emails until corrected.
+If the user explicitly asks to update without testing first, proceed, but note that broken settings will disrupt platform emails until corrected.
 
-## Workflow: Test Saved Settings
+## Test Saved Settings
 
-Test the currently saved SMTP configuration:
+Run:
 
 ```bash
 uip admin smtp test --recipient "admin@example.com" --output json
 ```
 
-## Workflow: Delete SMTP Settings
+## Delete SMTP Settings
 
-Removes custom SMTP configuration, reverting to platform defaults. Confirm with user first.
+Confirm with the user first. Deletion removes custom SMTP configuration and reverts to platform defaults.
 
 ```bash
 uip admin smtp delete --output json

package/skills/uipath-admin/references/tenant-management.md

@@ -248,7 +248,7 @@ Or, when you need a single service's status, filter the tenant record:
 uip admin tenants get <TENANT_ID> --output-filter "tenantServiceInstances[?serviceType=='<SVC>']" --output json
 ```
 
-Surface the resulting `status` to the user. For `disable`, confirm the row now reads `Disabled`; for `remove`, confirm it reads `Disabled` / `Deleted` rather than disappearing silently. See [tenants-commands.md — Concepts](tenants-commands.md#concepts) for the list of services where `disable` / `remove` is a no-op despite the Success code.
+Surface the resulting `status` to the user. For `disable`, confirm the row now reads `Disabled`; for `remove`, confirm it reads `Disabled` / `Deleted` rather than disappearing silently. See [tenants-commands.md — Concepts](tenants-commands.md#concepts-and-safety-rules) for the list of services where `disable` / `remove` is a no-op despite the Success code.
 
 ## Workflow: Soft-Remove Tenant Services
 

package/skills/uipath-admin/references/tenants-commands.md

@@ -1,54 +1,45 @@
 # Tenants CLI Command Reference
 
-Complete reference for all `uip admin tenants` commands — tenant lifecycle and tenant-level service provisioning (Organization Management Service / OMS).
+Reference for `uip admin tenants` tenant lifecycle and tenant-level service provisioning (Organization Management Service / OMS).
 
 For organization commands, see [organizations-commands.md](organizations-commands.md). For workflow-level guidance, see [tenant-management.md](tenant-management.md).
 
-## Global Flags
+## Global Flags and Prerequisites
 
-Every command accepts these flags (omitted from per-command tables):
+Every command accepts:
 
 | Flag | Description |
 |------|-------------|
-| `--output <format>` | Output format: `json`, `table`, `yaml`, `plain` (default: json) |
-| `--output-filter <expression>` | JMESPath expression to filter output |
-| `--log-level <level>` | Log level: `debug`, `info`, `warn`, `error` (default: info) |
-| `--log-file <path>` | Write logs to file instead of stderr |
-| `--login-validity <minutes>` | Override token validity — forces refresh if token expires within this window |
+| `--output <format>` | `json`, `table`, `yaml`, `plain` (default: json) |
+| `--output-filter <expression>` | JMESPath output filter |
+| `--log-level <level>` | `debug`, `info`, `warn`, `error` (default: info) |
+| `--log-file <path>` | Write logs instead of stderr |
+| `--login-validity <minutes>` | Force token refresh when expiry is within this window |
 
-Organization is resolved automatically from the active login session.
-
-## Prerequisites
+Organization is resolved from the active login session. Run:
 
 ```bash
 uip login status --output json
 ```
 
-If not logged in: `uip login`.
-
-## Concepts
-
-- **Async vs synchronous.** Tenant lifecycle (`create`, `update`, `delete`, `enable`, `disable`) is async — every mutation returns an `operationId`. `list` / `get` and all `services` subcommands are synchronous (200 OK with no body for service mutations).
-- **Single poll endpoint.** All async OMS operations are polled through `uip admin organizations operation get <OPERATION_ID>` — there is no `tenants operation get`.
-- **Soft-delete only.** `tenants delete` has no hard-delete flag. Reversible via the restore flow.
-- **Login-tenant default.** `tenants get`, `update`, `delete`, `enable`, `disable` accept the tenant id positionally — omit it to target the login tenant. Convenient for read ops; **always pass an explicit `<TENANT_ID>` for `delete`, `disable`, and `services remove`** to avoid targeting the wrong tenant.
-- **Region matters at create.** `tenants create` requires `--region`; run `organizations regions list` first to confirm acceptable values.
-- **Tenant service catalog is region-aware.** `tenants services list-available --region <REGION>` returns a per-region catalog.
-- **Service capability gaps — disable / remove are not universal.** Some services accept the call and return `Success` but the state never changes server-side:
-  - **Disable not honored** (no-op): Integration Service (`connections`), Data Fabric (`dataservice`), Insights (`insights`).
-  - **Remove not honored** (rejected or no-op): Orchestrator (`orchestrator`), Maestro (`maestro`), Integration Service (`connections`), Data Fabric (`dataservice`), Insights (`insights`), Test Manager (`testmanager`).
-
-  **Pre-flight: warn the user before submitting.** Don't silently issue a no-op. Render: *"Service `<X>` cannot be {disabled|removed} via the CLI — it's pinned by the platform. The call will return Success but the service will stay {Enabled|provisioned}. To deprovision, revoke the org entitlement via the UiPath Portal. Continue anyway, or skip `<X>`?"* Skip → drop from the call. Continue → run AND warn in the post-state summary.
+If not logged in, run `uip login`.
 
-  Because the CLI returns 200 OK either way, the success code is never proof of state change. After any `services disable` / `services remove`, verify with `tenants get <TENANT_ID> --output-filter "tenantServiceInstances[?serviceType=='<SVC>']"` and inspect the `status` field on the returned instance.
+## Concepts and Safety Rules
 
----
+- `create`, `update`, `delete`, `enable`, and `disable` are asynchronous and return an `operationId`. Poll each with `uip admin organizations operation get <OPERATION_ID>`; there is no `tenants operation get`. `list`, `get`, and all `services` commands are synchronous; service mutations return 200 OK with no body.
+- `delete` is soft-delete only and has no hard-delete flag. Restore through the support / restore flow.
+- `get`, `update`, `delete`, `enable`, and `disable` accept a positional tenant id and default to the login tenant. Always pass an explicit `<TENANT_ID>` to `delete`, `disable`, and `services remove`.
+- `create` requires `--region`. Run `organizations regions list`, then run `tenants services list-available --region <REGION>` because the catalog is region-aware.
+- Before `services add`, `enable`, `disable`, or `remove`, run `tenants get <ID> --output json`, resolve `<TENANT_ID>`, and echo the tenant name, especially for `remove`. These commands silently default `--tenant-id` to the login tenant.
+- Disable is not honored for Integration Service (`connections`), Data Fabric (`dataservice`), or Insights (`insights`). Remove is rejected or not honored for Orchestrator (`orchestrator`), Maestro (`maestro`), Integration Service (`connections`), Data Fabric (`dataservice`), Insights (`insights`), or Test Manager (`testmanager`).
+- Before submitting an unsupported disable/remove, warn: *"Service `<X>` cannot be {disabled|removed} via the CLI — it's pinned by the platform. The call will return Success but the service will stay {Enabled|provisioned}. To deprovision, revoke the org entitlement via the UiPath Portal. Continue anyway, or skip `<X>`?"* Skip it or continue only with the user's choice. If continuing, warn again in the post-state summary.
+- After every `services disable` or `services remove`, run `tenants get <TENANT_ID> --output-filter "tenantServiceInstances[?serviceType=='<SVC>']"` and inspect the instance `status`; HTTP 200 or `Success` does not prove a state change.
 
 ## Tenant Lifecycle — `uip admin tenants`
 
 ### `tenants list`
 
-List tenants in the caller's organization.
+Run:
 
 ```bash
 uip admin tenants list --output json
@@ -60,39 +51,33 @@ uip admin tenants list --include-services --output json
 | Flag | Required | Description |
 |------|----------|-------------|
 | `--filter <fragment>` | No | Case-insensitive substring match on tenant name (client-side) |
-| `--service <type>` | No | Only tenants with the given service provisioned |
-| `--status <status>` | No | Exact match on lifecycle status (`Enabled`, `Disabled`, `Updating`, `Deleted`) |
-| `--environment <env>` | No | Filter by environment tag (client-side) |
-| `--include-services` | No | Return each tenant's `services` array inline (saves a second call) |
+| `--service <type>` | No | Tenants with the service provisioned |
+| `--status <status>` | No | Exact status: `Enabled`, `Disabled`, `Updating`, `Deleted` |
+| `--environment <env>` | No | Environment tag filter (client-side) |
+| `--include-services` | No | Include each tenant's `services` array |
 
-**Output code:** `OmsTenantsList`.
+Output code: `OmsTenantsList`.
 
 ### `tenants get`
 
-Fetch a tenant by id (or the login tenant if omitted).
+Run:
 
 ```bash
 uip admin tenants get <TENANT_ID> --output json
 uip admin tenants get --output json
 ```
 
-| Argument | Required | Description |
-|----------|----------|-------------|
-| `<TENANT_ID>` | No | Tenant UUID — defaults to login tenant |
-
-**Output code:** `OmsTenantGet`.
+`<TENANT_ID>` is optional and defaults to the login tenant. Output code: `OmsTenantGet`.
 
 ### `tenants create`
 
-Create a new tenant. **Async** — returns both the new `id` and an `operationId`.
-
-> **`--file` is required in practice.** The server marks the `services` field required on `CreateTenantRequestDto`, but the inline path (`--name --region --environment`) does not populate it — a pure inline call returns `HTTP 400: The Services field is required.` Use a JSON file with the full body for any real create.
+Run `organizations regions list`, run `tenants services list-available --region <REGION>`, and create asynchronously with:
 
 ```bash
 uip admin tenants create --file ./tenant.json --output json
 ```
 
-`./tenant.json` (`CreateTenantRequestDto`):
+`--file` is required in practice because the server requires `services` on `CreateTenantRequestDto`; the inline `--name --region --environment` path omits it and returns `HTTP 400: The Services field is required.` Use:
 
 ```json
 {
@@ -105,19 +90,19 @@ uip admin tenants create --file ./tenant.json --output json
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `name` | Yes | Tenant display name. Alphanumeric, 2–32 chars, starts with a letter. |
-| `region` | Yes | Provisioning region — resolve via `organizations regions list`. |
-| `environment` | No | Environment tag: `Production`, `NonProduction`, or `Development`. |
-| `services` | **Yes** | **Plain string array of service names** to provision (catalog `name` field, e.g. `taskmining`, `du`). NOT a `{name: true}` map — that's the `services add` shape; OMS rejects it on create. Resolve via the **Default-provision filter** in the `services list-available` section below — the catalog is region-aware, never hardcode names. Platform-pinned services (`isAlwaysProvision === true`) are added automatically regardless. |
-| `customProperties` | No | Free-form key/value bag carried with the tenant. |
-| `color` | No | UI color tag. |
-| `isDefaultTenant` | No | Mark as the org's default tenant. |
+| `name` | Yes | Display name; alphanumeric, 2–32 chars, starts with a letter |
+| `region` | Yes | Value from `organizations regions list` |
+| `environment` | No | `Production`, `NonProduction`, or `Development` |
+| `services` | **Yes** | Plain string array of catalog `name` values, not the `{name: true}` map used by `services add`; resolve names with the default-provision filter below and never hardcode them. `isAlwaysProvision === true` services are automatic. |
+| `customProperties` | No | Free-form key/value bag |
+| `color` | No | UI color tag |
+| `isDefaultTenant` | No | Mark the organization's default tenant |
 
-**Output code:** `OmsTenantCreated`.
+Output code: `OmsTenantCreated`.
 
 ### `tenants update`
 
-Patch editable fields on a tenant. **Async** — returns `operationId`.
+Run:
 
 ```bash
 uip admin tenants update <TENANT_ID> \
@@ -129,72 +114,51 @@ uip admin tenants update <TENANT_ID> \
 
 | Argument/Flag | Required | Description |
 |---------------|----------|-------------|
-| `<TENANT_ID>` | No | Tenant UUID — defaults to login tenant |
+| `<TENANT_ID>` | No | Tenant UUID; defaults to login tenant |
 | `--name <name>` | No | New display name |
 | `--region <region>` | No | New region |
 | `--environment <env>` | No | New environment tag |
-| `--file <path>` | Alternative | Full `TenantUpdateDto` body (required for `services{}`, `customProperties`, `color`) |
+| `--file <path>` | Alternative | Full `TenantUpdateDto`; required for `services{}`, `customProperties`, or `color` |
 
-At least one field flag (or `--file`) is required. **Output code:** `OmsTenantUpdated`.
+Require at least one field flag or `--file`. Output code: `OmsTenantUpdated`.
 
 ### `tenants delete`
 
-Soft-delete a tenant. **Async** — returns `operationId`. No hard-delete flag.
+Confirm with the user, then run:
 
 ```bash
 uip admin tenants delete <TENANT_ID> --output json
 ```
 
-| Argument | Required | Description |
-|----------|----------|-------------|
-| `<TENANT_ID>` | No | Tenant UUID — defaults to login tenant. **Always pass explicitly for delete.** |
-
-Confirm with user. Restoration goes through the support / restore flow.
-
-**Output code:** `OmsTenantDeleted`.
+Always pass the tenant id. This is asynchronous, returns `operationId`, and has no hard-delete flag. Output code: `OmsTenantDeleted`.
 
 ### `tenants enable`
 
-Activate a tenant. **Async** — returns `operationId`.
+Run:
 
 ```bash
 uip admin tenants enable <TENANT_ID> --output json
 ```
 
-| Argument | Required | Description |
-|----------|----------|-------------|
-| `<TENANT_ID>` | No | Tenant UUID — defaults to login tenant |
-
-**Output code:** `OmsTenantEnabled`.
+This is asynchronous; `<TENANT_ID>` defaults to the login tenant. Output code: `OmsTenantEnabled`.
 
 ### `tenants disable`
 
-Disable a tenant. **Async** — returns `operationId`.
+Run:
 
 ```bash
 uip admin tenants disable <TENANT_ID> --reason "<FREE_TEXT_REASON>" --output json
 ```
 
-| Argument/Flag | Required | Description |
-|---------------|----------|-------------|
-| `<TENANT_ID>` | No | Tenant UUID — defaults to login tenant. **Always pass explicitly for disable.** |
-| `--reason <text>` | No | Free-text reason — recorded with the action for audit |
-
-**Output code:** `OmsTenantDisabled`.
-
----
+`<TENANT_ID>` is optional but defaults to the login tenant; always pass it explicitly. `--reason <text>` is optional free-text audit reason. This is asynchronous. Output code: `OmsTenantDisabled`.
 
 ## Tenant-Level Services — `uip admin tenants services`
 
-All service subcommands are **synchronous** (200 OK with no body, no polling).
-
-> **`list` vs `list-available` are different sets — never merge them.** `services list` returns the **currently provisioned** tenant instances (each with a `status`: `Enabled` / `Disabled` / `Deleted`). `services list-available --region <R>` returns the **region-aware catalog** of provisionable service types (no status). Always present them as two clearly labeled sections. See [tenant-management.md — List Tenant Services](tenant-management.md#workflow-list-tenant-services--provisioned-vs-available).
-
-> **Always name the tenant before any service mutation.** `services add/enable/disable/remove` default `--tenant-id` to the **login tenant** — silently. Resolve `<TENANT_ID>` to a name (`tenants get <ID> --output json`) and echo it to the user before running the command, especially for `remove`.
+`services list` reports provisioned instances and their `status`: `Enabled`, `Disabled`, or `Deleted`; surface the status and explicitly flag `Deleted`. `services list-available --region <R>` reports the region-aware provisionable catalog without lifecycle status. Keep these as separate, clearly labeled sections; see [tenant-management.md — List Tenant Services](tenant-management.md#workflow-list-tenant-services--provisioned-vs-available).
 
 ### `services list`
 
-List **currently provisioned** tenant-level service instances. Each row carries a lifecycle `status` — `Enabled`, `Disabled`, or `Deleted` (soft-deleted). Surface the status field in any presentation; flag `Deleted` entries explicitly.
+Run:
 
 ```bash
 uip admin tenants services list --output json
@@ -205,47 +169,41 @@ uip admin tenants services list --region "<REGION>" --output json
 
 | Flag | Required | Description |
 |------|----------|-------------|
-| `--tenant-id <id>` | No | Tenant UUID — defaults to login tenant |
-| `--service <type>` | No | Filter by service type (client-side) |
-| `--region <region>` | No | Filter by region (client-side) |
+| `--tenant-id <id>` | No | Tenant UUID; defaults to login tenant |
+| `--service <type>` | No | Service-type filter (client-side) |
+| `--region <region>` | No | Region filter (client-side) |
 
-All filters are client-side. **Output code:** `OmsTenantServicesList`.
+All filters are client-side. Output code: `OmsTenantServicesList`.
 
 ### `services list-available`
 
-List the **catalog** of services that can be provisioned for a tenant in a given region. **Region-aware** — the catalog varies by region. Catalog only: entries are not provisioned and have no lifecycle status. Do not show a status column when surfacing results.
+Run:
 
 ```bash
 uip admin tenants services list-available --region "<REGION>" --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--region <region>` | Yes | Provisioning region — required |
-
-Each catalog entry carries provisioning metadata. The agent uses these fields to decide what to propose by default on `tenants create`:
+`--region <region>` is required. Catalog entries have no lifecycle status. Use:
 
-| Field | Meaning | Effect on tenant-create defaults |
+| Field | Meaning | Default behavior |
 |---|---|---|
-| `provisioningMode` | `Implicit` (auto-provisioned when listed) or `Explicit` (must be deliberately added) | **Defaults set:** filter to `Implicit` only. `Explicit` services are optional opt-ins — offer only on user request. |
-| `isVisible` | `true` if the service is end-user-facing | **Defaults set:** filter to `true`. `false` services are platform-internal (don't surface in any user-facing list). |
-| `isAlwaysProvision` | `true` if the platform automatically provisions this service on every tenant | **Defaults set:** filter to `false`. `true` services are auto-provisioned by the platform — no need to include in the user's choice; they will be there regardless. |
-| `supportedRegions[]`, `defaultRegion`, `entitlement`, `serviceLicenseStatus` | informational | — |
+| `provisioningMode` | `Implicit` or `Explicit` | Include only `Implicit`; offer `Explicit` as opt-in |
+| `isVisible` | `true` for end-user-facing services | Include only `true`; do not surface `false` platform-internal services |
+| `isAlwaysProvision` | `true` for platform-auto-provisioned services | Exclude `true`; they appear automatically |
+| `supportedRegions[]`, `defaultRegion`, `entitlement`, `serviceLicenseStatus` | Informational | — |
 
-**Default-provision filter** (use for new-tenant proposals): `provisioningMode === "Implicit" && isVisible === true && isAlwaysProvision === false`. Run the filter command below for the target region to get the current set — the catalog is region-aware, never hardcode names. Render the result as the default services on `tenants create`; let the user remove unwanted entries and add Explicit services explicitly. Pass the confirmed catalog `name` values as a string array in the create body's `services` field (NOT the `id` field).
-
-Filter command (note: filter root is the `Data` array itself — use `[?...]`, NOT `Data[?...]`):
+Run this default-provision filter for the target region. The root is the `Data` array, so use `[?... ]`, not `Data[?... ]`:
 
 ```bash
 uip admin tenants services list-available --region "<REGION>" --output json \
   --output-filter "[?provisioningMode=='Implicit' && isVisible==\`true\` && isAlwaysProvision==\`false\`].name"
 ```
 
-**Output code:** `OmsTenantServicesAvailable`.
+Render results as create defaults, let the user remove unwanted entries or explicitly add services, and pass confirmed catalog `name` values—not `id` values—as the create body's string-array `services` field. Output code: `OmsTenantServicesAvailable`.
 
 ### `services add`
 
-Provision one or more services on a tenant. **Synchronous.**
+Provision synchronously. Before submission, resolve and echo the tenant as required above. Run:
 
 ```bash
 uip admin tenants services add \
@@ -256,23 +214,19 @@ uip admin tenants services add \
 
 | Flag | Required | Description |
 |------|----------|-------------|
-| `--tenant-id <id>` | No | Tenant UUID — defaults to login tenant. **Always pass explicitly for service mutations on non-login tenants.** |
+| `--tenant-id <id>` | No | Defaults to login tenant; always explicit for non-login tenants |
 | `--service <type>` | Yes (inline) | Single service type |
-| `--file <path>` | Alternative | JSON body for multiple services |
-
-`--file ./add-services.json`:
+| `--file <path>` | Alternative | Multiple-service JSON body |
 
 ```json
 { "services": { "orchestrator": true, "studio": true } }
 ```
 
-All file entries must be `true` (use `services remove` for `false`).
-
-**Output code:** `OmsTenantServicesAdded`.
+All file entries must be `true`; use `services remove` for `false`. Output code: `OmsTenantServicesAdded`.
 
 ### `services enable`
 
-Enable a single service instance on a tenant. **Synchronous.**
+Before submission, resolve and echo the tenant. Run:
 
 ```bash
 uip admin tenants services enable \
@@ -281,16 +235,11 @@ uip admin tenants services enable \
   --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--tenant-id <id>` | No | Tenant UUID — defaults to login tenant. **Always pass explicitly for non-login tenants.** |
-| `--service <type>` | Yes | Service type |
-
-**Output code:** `OmsTenantServiceEnabled`.
+`--tenant-id <id>` is optional, defaults to the login tenant, and is always explicit for non-login tenants. `--service <type>` is required. Output code: `OmsTenantServiceEnabled`.
 
 ### `services disable`
 
-Disable a single service instance on a tenant. **Synchronous.**
+Before submission, resolve and echo the tenant; apply the unsupported-service warning and post-state verification rules. Run:
 
 ```bash
 uip admin tenants services disable \
@@ -299,18 +248,11 @@ uip admin tenants services disable \
   --output json
 ```
 
-| Flag | Required | Description |
-|------|----------|-------------|
-| `--tenant-id <id>` | No | Tenant UUID — defaults to login tenant. **Always pass explicitly for non-login tenants.** |
-| `--service <type>` | Yes | Service type |
-
-**Output code:** `OmsTenantServiceDisabled`.
-
-> **Not supported on every service.** Integration Service (`connections`), Data Fabric (`dataservice`), and Insights (`insights`) accept the call and return `OmsTenantServiceDisabled` / `Success`, but the service-side `status` never flips to `Disabled`. Verify with `tenants get <TENANT_ID> --output-filter "tenantServiceInstances[?serviceType=='<SVC>']"` and warn the user upfront if they target one of these services.
+`--tenant-id <id>` is optional, defaults to the login tenant, and is always explicit for non-login tenants. `--service <type>` is required. Integration Service (`connections`), Data Fabric (`dataservice`), and Insights (`insights`) may return `OmsTenantServiceDisabled` / `Success` without changing `status` to `Disabled`. Output code: `OmsTenantServiceDisabled`.
 
 ### `services remove`
 
-Soft-remove one or more services from a tenant. **Synchronous.** Server-side soft-delete (no hard-delete option).
+Soft-remove synchronously; there is no hard-delete option. Before submission, resolve and echo the tenant, require explicit `<TENANT_ID>`, and apply the unsupported-service warning and post-state verification rules. Run:
 
 ```bash
 uip admin tenants services remove \
@@ -321,34 +263,26 @@ uip admin tenants services remove \
 
 | Flag | Required | Description |
 |------|----------|-------------|
-| `--tenant-id <id>` | No | Tenant UUID — defaults to login tenant. **Always pass explicitly for service-remove on non-login tenants.** |
+| `--tenant-id <id>` | No | Defaults to login tenant; always explicit for service-remove on non-login tenants |
 | `--service <type>` | Yes (inline) | Single service type |
-| `--file <path>` | Alternative | JSON body for multiple services |
-
-`--file ./remove-services.json`:
+| `--file <path>` | Alternative | Multiple-service JSON body |
 
 ```json
 { "services": { "orchestrator": false, "studio": false } }
 ```
 
-All file entries must be `false`.
-
-**Output code:** `OmsTenantServicesRemoved`.
-
-> **Not supported on every service.** Orchestrator (`orchestrator`), Maestro (`maestro`), Integration Service (`connections`), Data Fabric (`dataservice`), Insights (`insights`), and Test Manager (`testmanager`) cannot be soft-removed — the CLI may return `Success` but the service stays provisioned. Verify with `tenants get` and warn the user upfront if they target one of these services.
-
----
+All file entries must be `false`. Orchestrator (`orchestrator`), Maestro (`maestro`), Integration Service (`connections`), Data Fabric (`dataservice`), Insights (`insights`), and Test Manager (`testmanager`) cannot be soft-removed; the CLI may return `Success` while the service remains provisioned. Output code: `OmsTenantServicesRemoved`.
 
 ## Error Handling
 
 | Error | Cause | Fix |
 |-------|-------|-----|
 | `tenant not found` | Invalid tenant UUID | Resolve via `tenants list --filter <NAME>` |
-| `region not allowed` | `--region` not in available regions | Run `organizations regions list` and use a returned value |
-| `service not available in region` | Service type not in regional catalog | Run `tenants services list-available --region <REGION>` first |
-| `service already provisioned` | Trying to `add` a service that exists | Use `enable` instead, or list current state with `services list` |
-| Operation stuck `Updating` | Async op pending or failed | Poll `organizations operation get <OPERATION_ID>` for status / error |
-| Destructive op targeted login tenant unintentionally | `<TENANT_ID>` omitted | Always pass an explicit tenant id for `delete`, `disable`, `services remove` |
-| `services disable` returned `Success` but `status` still `Enabled` | Service does not support disable (Integration Service, Data Fabric, Insights) | Expected — service-side limitation, not a CLI bug. Inform the user the service cannot be disabled |
-| `services remove` returned `Success` but instance still present | Service does not support remove (Orchestrator, Maestro, Integration Service, Data Fabric, Insights, Test Manager) | Expected — service-side limitation. Inform the user the service cannot be soft-removed |
-| Auth error | Login expired | `uip login status`, then `uip login` |
+| `region not allowed` | `--region` unavailable | Run `organizations regions list` and use a returned value |
+| `service not available in region` | Service absent from regional catalog | Run `tenants services list-available --region <REGION>` first |
+| `service already provisioned` | `add` targets an existing service | Use `enable`, or run `services list` |
+| Operation stuck `Updating` | Async operation pending or failed | Poll `organizations operation get <OPERATION_ID>` for status / error |
+| Destructive op targeted login tenant unintentionally | `<TENANT_ID>` omitted | Always pass an explicit tenant id to `delete`, `disable`, and `services remove` |
+| `services disable` returned `Success` but `status` still `Enabled` | Service does not support disable: Integration Service, Data Fabric, or Insights | Expected service-side limitation; inform the user it cannot be disabled |
+| `services remove` returned `Success` but instance still present | Service does not support remove: Orchestrator, Maestro, Integration Service, Data Fabric, Insights, or Test Manager | Expected service-side limitation; inform the user it cannot be soft-removed |
+| Auth error | Login expired | Run `uip login status`, then `uip login` |