bt-cli 0.4.33__tar.gz → 0.4.35__tar.gz

{bt_cli-0.4.33/src/bt_cli/data → bt_cli-0.4.35/.claude}/skills/epml/SKILL.md

@@ -103,21 +103,32 @@ bt epml rbp cmdgrps create --name "Admin Tools" --description "..."
 bt epml rbp cmdgrps delete 12,13
 bt epml rbp cmdgrps commands list <cmdgrp_id>
 bt epml rbp cmdgrps commands add <cmdgrp_id> --commands "vi,less,cat"
-bt epml rbp cmdgrps commands remove <cmdgrp_id> --ids 1,2
+bt epml rbp cmdgrps commands clear <cmdgrp_id>            # NUKE all (no per-item delete)
+bt epml rbp cmdgrps commands replace <cmdgrp_id> --commands "vi,more"
 
-# Host groups
+# Host groups (`type` defaults to I=Internal)
 bt epml rbp hostgrps list
-bt epml rbp hostgrps create --name "Admin Hosts"
+bt epml rbp hostgrps create --name "Admin Hosts" --type I
 bt epml rbp hostgrps hosts add <hostgrp_id> --hosts "web-*,db-*"
+bt epml rbp hostgrps hosts clear <hostgrp_id>
+bt epml rbp hostgrps hosts replace <hostgrp_id> --hosts "web-01,web-02"
 
-# User groups
+# User groups (`type` defaults to I=Internal)
 bt epml rbp usergrps list
-bt epml rbp usergrps create --name "Helpdesk"
+bt epml rbp usergrps create --name "Helpdesk" --type I
+bt epml rbp usergrps create-multiple groups.json          # bulk create from JSON array
 bt epml rbp usergrps users add <usergrp_id> --users "alice,bob"
+bt epml rbp usergrps users clear <usergrp_id>
+bt epml rbp usergrps users replace <usergrp_id> --users "alice"
 
-# Time/date groups
+# Time/date groups + tmdates
 bt epml rbp tmdategrps list
 bt epml rbp tmdategrps create --name "Working Hours"
+bt epml rbp tmdategrps tmdates list <tmdategrp_id>
+bt epml rbp tmdategrps tmdates add <tmdategrp_id> --from 09:00 --to 17:00 -d "weekday"
+bt epml rbp tmdategrps tmdates add <tmdategrp_id> --file tmdates.json
+bt epml rbp tmdategrps tmdates clear <tmdategrp_id>
+bt epml rbp tmdategrps tmdates replace <tmdategrp_id> --file tmdates.json
 
 # Roles + assignments
 bt epml rbp roles list
@@ -179,6 +190,21 @@ bt epml quick tests-then-deploy --suite <suite_id>      # commits if pass; rollb
 - `bt epml rbp tx commit` — applies in-flight changes
 - `bt epml client-pkg ...` POST endpoints — triggers a real installer build
 
+## API quirks worth knowing (caught while building, not in the spec)
+
+- **Create-role `action`**: required despite spec saying optional. Must be exactly `"A"` (Allow) or `"R"` (Reject). CLI defaults to `A`.
+- **Create-hostgrp / create-usergrp `type`**: required. Must be `"I"` (Internal — static list) or `"E"` (External — directory-resolved). CLI defaults to `I`.
+- **Collection-level deletes** (cmdgrps/hostgrps/usergrps/tmdategrps/roles): the spec shows `id` as a query parameter, NOT a JSON body. Repeated `?id=A&id=B` is accepted at the HTTP layer but only the first value is honored — the CLI loops single-id requests under the hood.
+- **Child-collection deletes** (commands inside cmdgrp, hosts inside hostgrp, users inside usergrp, tmdates inside tmdategrp): there is **no per-item delete**. `DELETE /<parent>/{id}/<children>` clears the whole list. To remove one entry, use `replace` (CLI does GET + DELETE-all + POST under the hood).
+- **Add-children body shape**: each child item must be wrapped: commands → `[{"cmd": x}]`, hosts → `[{"host": x}]`, users → `[{"user": x}]`, tmdates → `{"tmdates": [...]}` (note the wrapper for tmdates; the spec doesn't document any of these wrappers).
+- **`POST /usergrps/multiple`** (bulk create): body is `{"usergroups": [...]}` — undocumented wrapper key.
+- **POST on child collections is additive**, not replacing. Calling `commands add` twice with the same command will get you a duplicate.
+- **Children share the parent's `id`** in GET responses — the listed `id` field is the cmdgrp/hostgrp/usergrp ID, not unique per child. The actual identifier is the `cmd`/`host`/`user` text.
+
+## Known gaps (TODO)
+
+- **`bt epml rbp roles get <id>`** — there is no GET-single-role in the v1 API. The detailed view (role with all child relations resolved) only exists at `/api/v6/pbul/{hostid}/rbp/roledetail/{id}`, which is on the IAM-only authorizer. Not callable with a PAT today. Workaround: use `bt epml rbp roles list` for the role row, then `bt epml rbp roles {cmdgrps,hostgrps,usergrps,tmdategrps} list <id>` to fetch each child relation.
+
 ## Path-version policy (CLI internal)
 
 Where the spec offers both legacy `/api/pbul/{hostid}/rbp/<x>` and newer

{bt_cli-0.4.33 → bt_cli-0.4.35}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.33**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.35**
 
 ## Setup
 

{bt_cli-0.4.33 → bt_cli-0.4.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.33
+Version: 0.4.35
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.33 → bt_cli-0.4.35}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.33"
+version = "0.4.35"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.33"
+__version__ = "0.4.35"

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/cli.py

@@ -382,10 +382,10 @@ def tree_command(
         epml.add("[green]external-apis[/green] list|get")
         epml.add("[green]iolog[/green] list")
         rbp = epml.add("[green]rbp[/green] - Role-Based Policy")
-        rbp.add("cmdgrps list|create|delete  + commands list|add|remove")
-        rbp.add("hostgrps list|create|delete + hosts list|add|remove")
-        rbp.add("usergrps list|create|delete + users list|add|remove")
-        rbp.add("tmdategrps list|create|delete")
+        rbp.add("cmdgrps list|create|delete  + commands list|add|clear|replace")
+        rbp.add("hostgrps list|create|delete + hosts list|add|clear|replace")
+        rbp.add("usergrps list|create|create-multiple|delete + users list|add|clear|replace")
+        rbp.add("tmdategrps list|create|delete + tmdates list|add|clear|replace")
         rbp.add("roles list|create|delete|duplicate")
         rbp.add("  + cmdgrps|hostgrps|usergrps|tmdategrps list|add|remove")
         rbp.add("entitlement run [--raw]")
@@ -515,22 +515,30 @@ def _get_all_commands() -> list[tuple[str, str]]:
         ("bt epml rbp cmdgrps delete", "Delete RBP command groups"),
         ("bt epml rbp cmdgrps commands list", "List commands within a cmdgrp"),
         ("bt epml rbp cmdgrps commands add", "Add commands to a cmdgrp"),
-        ("bt epml rbp cmdgrps commands remove", "Remove commands from a cmdgrp"),
+        ("bt epml rbp cmdgrps commands clear", "Clear ALL commands in a cmdgrp"),
+        ("bt epml rbp cmdgrps commands replace", "Replace cmdgrp's full command list"),
         ("bt epml rbp hostgrps list", "List RBP host groups"),
         ("bt epml rbp hostgrps create", "Create an RBP host group"),
         ("bt epml rbp hostgrps delete", "Delete RBP host groups"),
         ("bt epml rbp hostgrps hosts list", "List hosts within a hostgrp"),
         ("bt epml rbp hostgrps hosts add", "Add hosts to a hostgrp"),
-        ("bt epml rbp hostgrps hosts remove", "Remove hosts from a hostgrp"),
+        ("bt epml rbp hostgrps hosts clear", "Clear ALL hosts in a hostgrp"),
+        ("bt epml rbp hostgrps hosts replace", "Replace hostgrp's full host list"),
         ("bt epml rbp usergrps list", "List RBP user groups"),
         ("bt epml rbp usergrps create", "Create an RBP user group"),
+        ("bt epml rbp usergrps create-multiple", "Bulk-create user groups from a JSON file"),
         ("bt epml rbp usergrps delete", "Delete RBP user groups"),
         ("bt epml rbp usergrps users list", "List users within a usergrp"),
         ("bt epml rbp usergrps users add", "Add users to a usergrp"),
-        ("bt epml rbp usergrps users remove", "Remove users from a usergrp"),
+        ("bt epml rbp usergrps users clear", "Clear ALL users in a usergrp"),
+        ("bt epml rbp usergrps users replace", "Replace usergrp's full user list"),
         ("bt epml rbp tmdategrps list", "List RBP time/date groups"),
         ("bt epml rbp tmdategrps create", "Create an RBP time/date group"),
         ("bt epml rbp tmdategrps delete", "Delete RBP time/date groups"),
+        ("bt epml rbp tmdategrps tmdates list", "List time/date entries in a group"),
+        ("bt epml rbp tmdategrps tmdates add", "Add time/date entries"),
+        ("bt epml rbp tmdategrps tmdates clear", "Clear ALL time/dates in a group"),
+        ("bt epml rbp tmdategrps tmdates replace", "Replace the group's full tmdate list"),
         ("bt epml rbp roles list", "List RBP roles"),
         ("bt epml rbp roles create", "Create an RBP role"),
         ("bt epml rbp roles delete", "Delete RBP roles"),

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/data/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.33**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.35**
 
 ## Setup
 

{bt_cli-0.4.33/.claude → bt_cli-0.4.35/src/bt_cli/data}/skills/epml/SKILL.md

@@ -103,21 +103,32 @@ bt epml rbp cmdgrps create --name "Admin Tools" --description "..."
 bt epml rbp cmdgrps delete 12,13
 bt epml rbp cmdgrps commands list <cmdgrp_id>
 bt epml rbp cmdgrps commands add <cmdgrp_id> --commands "vi,less,cat"
-bt epml rbp cmdgrps commands remove <cmdgrp_id> --ids 1,2
+bt epml rbp cmdgrps commands clear <cmdgrp_id>            # NUKE all (no per-item delete)
+bt epml rbp cmdgrps commands replace <cmdgrp_id> --commands "vi,more"
 
-# Host groups
+# Host groups (`type` defaults to I=Internal)
 bt epml rbp hostgrps list
-bt epml rbp hostgrps create --name "Admin Hosts"
+bt epml rbp hostgrps create --name "Admin Hosts" --type I
 bt epml rbp hostgrps hosts add <hostgrp_id> --hosts "web-*,db-*"
+bt epml rbp hostgrps hosts clear <hostgrp_id>
+bt epml rbp hostgrps hosts replace <hostgrp_id> --hosts "web-01,web-02"
 
-# User groups
+# User groups (`type` defaults to I=Internal)
 bt epml rbp usergrps list
-bt epml rbp usergrps create --name "Helpdesk"
+bt epml rbp usergrps create --name "Helpdesk" --type I
+bt epml rbp usergrps create-multiple groups.json          # bulk create from JSON array
 bt epml rbp usergrps users add <usergrp_id> --users "alice,bob"
+bt epml rbp usergrps users clear <usergrp_id>
+bt epml rbp usergrps users replace <usergrp_id> --users "alice"
 
-# Time/date groups
+# Time/date groups + tmdates
 bt epml rbp tmdategrps list
 bt epml rbp tmdategrps create --name "Working Hours"
+bt epml rbp tmdategrps tmdates list <tmdategrp_id>
+bt epml rbp tmdategrps tmdates add <tmdategrp_id> --from 09:00 --to 17:00 -d "weekday"
+bt epml rbp tmdategrps tmdates add <tmdategrp_id> --file tmdates.json
+bt epml rbp tmdategrps tmdates clear <tmdategrp_id>
+bt epml rbp tmdategrps tmdates replace <tmdategrp_id> --file tmdates.json
 
 # Roles + assignments
 bt epml rbp roles list
@@ -179,6 +190,21 @@ bt epml quick tests-then-deploy --suite <suite_id>      # commits if pass; rollb
 - `bt epml rbp tx commit` — applies in-flight changes
 - `bt epml client-pkg ...` POST endpoints — triggers a real installer build
 
+## API quirks worth knowing (caught while building, not in the spec)
+
+- **Create-role `action`**: required despite spec saying optional. Must be exactly `"A"` (Allow) or `"R"` (Reject). CLI defaults to `A`.
+- **Create-hostgrp / create-usergrp `type`**: required. Must be `"I"` (Internal — static list) or `"E"` (External — directory-resolved). CLI defaults to `I`.
+- **Collection-level deletes** (cmdgrps/hostgrps/usergrps/tmdategrps/roles): the spec shows `id` as a query parameter, NOT a JSON body. Repeated `?id=A&id=B` is accepted at the HTTP layer but only the first value is honored — the CLI loops single-id requests under the hood.
+- **Child-collection deletes** (commands inside cmdgrp, hosts inside hostgrp, users inside usergrp, tmdates inside tmdategrp): there is **no per-item delete**. `DELETE /<parent>/{id}/<children>` clears the whole list. To remove one entry, use `replace` (CLI does GET + DELETE-all + POST under the hood).
+- **Add-children body shape**: each child item must be wrapped: commands → `[{"cmd": x}]`, hosts → `[{"host": x}]`, users → `[{"user": x}]`, tmdates → `{"tmdates": [...]}` (note the wrapper for tmdates; the spec doesn't document any of these wrappers).
+- **`POST /usergrps/multiple`** (bulk create): body is `{"usergroups": [...]}` — undocumented wrapper key.
+- **POST on child collections is additive**, not replacing. Calling `commands add` twice with the same command will get you a duplicate.
+- **Children share the parent's `id`** in GET responses — the listed `id` field is the cmdgrp/hostgrp/usergrp ID, not unique per child. The actual identifier is the `cmd`/`host`/`user` text.
+
+## Known gaps (TODO)
+
+- **`bt epml rbp roles get <id>`** — there is no GET-single-role in the v1 API. The detailed view (role with all child relations resolved) only exists at `/api/v6/pbul/{hostid}/rbp/roledetail/{id}`, which is on the IAM-only authorizer. Not callable with a PAT today. Workaround: use `bt epml rbp roles list` for the role row, then `bt epml rbp roles {cmdgrps,hostgrps,usergrps,tmdategrps} list <id>` to fetch each child relation.
+
 ## Path-version policy (CLI internal)
 
 Where the spec offers both legacy `/api/pbul/{hostid}/rbp/<x>` and newer

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/epml/client/base.py

@@ -313,22 +313,30 @@ class EPMLClient:
         h = self.host(host_id)
         return self.post(f"/api/pbul/{h}/rbp/cmdgrps", json=data)
 
-    def delete_cmdgrps(self, ids: List[int], host_id: Optional[int] = None) -> Any:
+    def delete_cmdgrps(self, ids: List[int], host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
-        # /api/pbul/{hostid}/rbp/cmdgrps DELETE deletes a list of IDs in body.
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/cmdgrps", ids)
+        for cid in ids:
+            self._delete_with_query(f"/api/pbul/{h}/rbp/cmdgrps", {"id": cid})
 
     def list_cmdgrp_commands(self, cmdgrp_id: int, host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/cmdgrps/{cmdgrp_id}/commands")
 
     def add_cmdgrp_commands(self, cmdgrp_id: int, commands: List[str], host_id: Optional[int] = None) -> Any:
+        """Append commands to a cmdgrp. POST is additive, not replacing."""
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/cmdgrps/{cmdgrp_id}/commands", json=commands)
+        body = [{"cmd": c} for c in commands]
+        return self.post(f"/api/pbul/{h}/rbp/cmdgrps/{cmdgrp_id}/commands", json=body)
 
-    def delete_cmdgrp_commands(self, cmdgrp_id: int, command_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def clear_cmdgrp_commands(self, cmdgrp_id: int, host_id: Optional[int] = None) -> None:
+        """DELETE all commands in a cmdgrp. The API has no per-item delete."""
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/cmdgrps/{cmdgrp_id}/commands", command_ids)
+        self._delete_no_body(f"/api/pbul/{h}/rbp/cmdgrps/{cmdgrp_id}/commands")
+
+    def replace_cmdgrp_commands(self, cmdgrp_id: int, commands: List[str], host_id: Optional[int] = None) -> Any:
+        """Atomic-ish replace: clear then add. Two requests; not server-atomic."""
+        self.clear_cmdgrp_commands(cmdgrp_id, host_id=host_id)
+        return self.add_cmdgrp_commands(cmdgrp_id, commands, host_id=host_id)
 
     # ----- RBP: host groups ---------------------------------------------
 
@@ -338,23 +346,34 @@ class EPMLClient:
 
     def create_hostgrp(self, data: Dict[str, Any], host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/hostgrps", json=data)
+        # Server requires `type` ∈ {"I","E"}. Default to Internal if omitted.
+        body = dict(data)
+        body.setdefault("type", "I")
+        return self.post(f"/api/pbul/{h}/rbp/hostgrps", json=body)
 
-    def delete_hostgrps(self, ids: List[int], host_id: Optional[int] = None) -> Any:
+    def delete_hostgrps(self, ids: List[int], host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/hostgrps", ids)
+        for hid in ids:
+            self._delete_with_query(f"/api/pbul/{h}/rbp/hostgrps", {"id": hid})
 
     def list_hostgrp_hosts(self, hostgrp_id: int, host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/hostgrps/{hostgrp_id}/hosts")
 
     def add_hostgrp_hosts(self, hostgrp_id: int, hosts: List[str], host_id: Optional[int] = None) -> Any:
+        """Append hostnames/patterns to a hostgrp. POST is additive."""
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/hostgrps/{hostgrp_id}/hosts", json=hosts)
+        body = [{"host": x} for x in hosts]
+        return self.post(f"/api/pbul/{h}/rbp/hostgrps/{hostgrp_id}/hosts", json=body)
 
-    def delete_hostgrp_hosts(self, hostgrp_id: int, host_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def clear_hostgrp_hosts(self, hostgrp_id: int, host_id: Optional[int] = None) -> None:
+        """DELETE all hosts in a hostgrp. The API has no per-item delete."""
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/hostgrps/{hostgrp_id}/hosts", host_ids)
+        self._delete_no_body(f"/api/pbul/{h}/rbp/hostgrps/{hostgrp_id}/hosts")
+
+    def replace_hostgrp_hosts(self, hostgrp_id: int, hosts: List[str], host_id: Optional[int] = None) -> Any:
+        self.clear_hostgrp_hosts(hostgrp_id, host_id=host_id)
+        return self.add_hostgrp_hosts(hostgrp_id, hosts, host_id=host_id)
 
     # ----- RBP: user groups ---------------------------------------------
 
@@ -364,23 +383,50 @@ class EPMLClient:
 
     def create_usergrp(self, data: Dict[str, Any], host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/usergrps", json=data)
+        # Server requires `type` ∈ {"I","E"}. Default to Internal if omitted.
+        body = dict(data)
+        body.setdefault("type", "I")
+        return self.post(f"/api/pbul/{h}/rbp/usergrps", json=body)
 
-    def delete_usergrps(self, ids: List[int], host_id: Optional[int] = None) -> Any:
+    def delete_usergrps(self, ids: List[int], host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/usergrps", ids)
+        for uid in ids:
+            self._delete_with_query(f"/api/pbul/{h}/rbp/usergrps", {"id": uid})
 
     def list_usergrp_users(self, usergrp_id: int, host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/usergrps/{usergrp_id}/users")
 
     def add_usergrp_users(self, usergrp_id: int, users: List[str], host_id: Optional[int] = None) -> Any:
+        """Append usernames to a usergrp. POST is additive."""
+        h = self.host(host_id)
+        body = [{"user": u} for u in users]
+        return self.post(f"/api/pbul/{h}/rbp/usergrps/{usergrp_id}/users", json=body)
+
+    def clear_usergrp_users(self, usergrp_id: int, host_id: Optional[int] = None) -> None:
+        """DELETE all users in a usergrp. The API has no per-item delete."""
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/usergrps/{usergrp_id}/users", json=users)
+        self._delete_no_body(f"/api/pbul/{h}/rbp/usergrps/{usergrp_id}/users")
 
-    def delete_usergrp_users(self, usergrp_id: int, user_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def replace_usergrp_users(self, usergrp_id: int, users: List[str], host_id: Optional[int] = None) -> Any:
+        self.clear_usergrp_users(usergrp_id, host_id=host_id)
+        return self.add_usergrp_users(usergrp_id, users, host_id=host_id)
+
+    def create_multiple_usergrps(self, groups: List[Dict[str, Any]], host_id: Optional[int] = None) -> Any:
+        """Bulk create user groups via /usergrps/multiple.
+
+        Each group dict needs at least `name` and `type` (`I` or `E`).
+        Body is wrapped: `{"usergroups": [...]}` — the spec doesn't document
+        the wrapper key.
+        """
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/usergrps/{usergrp_id}/users", user_ids)
+        # Default any missing types to "I"
+        normalized = []
+        for g in groups:
+            entry = dict(g)
+            entry.setdefault("type", "I")
+            normalized.append(entry)
+        return self.post(f"/api/pbul/{h}/rbp/usergrps/multiple", json={"usergroups": normalized})
 
     # ----- RBP: time/date groups ----------------------------------------
 
@@ -392,9 +438,30 @@ class EPMLClient:
         h = self.host(host_id)
         return self.post(f"/api/pbul/{h}/rbp/tmdategrps", json=data)
 
-    def delete_tmdategrps(self, ids: List[int], host_id: Optional[int] = None) -> Any:
+    def delete_tmdategrps(self, ids: List[int], host_id: Optional[int] = None) -> None:
+        h = self.host(host_id)
+        for tid in ids:
+            self._delete_with_query(f"/api/pbul/{h}/rbp/tmdategrps", {"id": tid})
+
+    # --- tmdates (children of tmdategrps) ---
+
+    def list_tmdategrp_tmdates(self, tmdategrp_id: int, host_id: Optional[int] = None) -> Any:
+        h = self.host(host_id)
+        return self.get(f"/api/pbul/{h}/rbp/tmdategrps/{tmdategrp_id}/tmdates")
+
+    def add_tmdategrp_tmdates(self, tmdategrp_id: int, tmdates: List[Dict[str, Any]], host_id: Optional[int] = None) -> Any:
+        """Append time/date entries to a tmdategrp. Body is wrapped: `{tmdates: [...]}`."""
+        h = self.host(host_id)
+        return self.post(f"/api/pbul/{h}/rbp/tmdategrps/{tmdategrp_id}/tmdates", json={"tmdates": tmdates})
+
+    def clear_tmdategrp_tmdates(self, tmdategrp_id: int, host_id: Optional[int] = None) -> None:
+        """DELETE all tmdates in a tmdategrp."""
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/tmdategrps", ids)
+        self._delete_no_body(f"/api/pbul/{h}/rbp/tmdategrps/{tmdategrp_id}/tmdates")
+
+    def replace_tmdategrp_tmdates(self, tmdategrp_id: int, tmdates: List[Dict[str, Any]], host_id: Optional[int] = None) -> Any:
+        self.clear_tmdategrp_tmdates(tmdategrp_id, host_id=host_id)
+        return self.add_tmdategrp_tmdates(tmdategrp_id, tmdates, host_id=host_id)
 
     # ----- RBP: roles ---------------------------------------------------
 
@@ -404,11 +471,15 @@ class EPMLClient:
 
     def create_role(self, data: Dict[str, Any], host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/roles", json=data)
+        # Server requires `action` ∈ {"A","R"} (Allow / Reject). Default Allow.
+        body = dict(data)
+        body.setdefault("action", "A")
+        return self.post(f"/api/pbul/{h}/rbp/roles", json=body)
 
-    def delete_roles(self, ids: List[int], host_id: Optional[int] = None) -> Any:
+    def delete_roles(self, ids: List[int], host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
-        return self._delete_with_body(f"/api/pbul/{h}/rbp/roles", ids)
+        for rid in ids:
+            self._delete_with_query(f"/api/pbul/{h}/rbp/roles", {"id": rid})
 
     def duplicate_role(self, role_id: int, host_id: Optional[int] = None) -> Any:
         h = self.host(host_id)
@@ -569,6 +640,32 @@ class EPMLClient:
         except ValueError:
             return response.text
 
+    def _delete_no_body(self, spec_path: str) -> None:
+        """DELETE with no params and no body.
+
+        RBP child collections (e.g. cmdgrps/{id}/commands, hostgrps/{id}/hosts,
+        usergrps/{id}/users, tmdategrps/{id}/tmdates) all behave as
+        "delete all" when this is called — there's no per-item delete in the
+        v1 API. To remove a single child, GET the list, clear, then re-add the
+        ones you want to keep.
+        """
+        response = self._client.delete(self._build_url(spec_path), headers=self._headers())
+        response.raise_for_status()
+
+    def _delete_with_query(self, spec_path: str, params: Dict[str, Any]) -> None:
+        """DELETE with query parameters (no body).
+
+        RBP collection deletes (`/pbul/{hostid}/rbp/{entity}`) take `id` as a
+        query param, not a JSON body. Repeated `?id=A&id=B` is accepted by the
+        server but only the first value is honored — callers should loop.
+        """
+        response = self._client.delete(
+            self._build_url(spec_path),
+            headers=self._headers(),
+            params=params,
+        )
+        response.raise_for_status()
+
     # ----- iologs --------------------------------------------------------
 
     def list_iologs(

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/epml/commands/rbp_cmdgrps.py

@@ -96,7 +96,7 @@ def list_commands(
             print_json(data)
         else:
             rows = data if isinstance(data, list) else (data.get("data", []) if isinstance(data, dict) else [])
-            print_table(rows, [("ID", "id"), ("Command", "command")], title=f"Commands in cmdgrp {cmdgrp_id}")
+            print_table(rows, [("Command", "cmd"), ("Description", "description"), ("Disabled", "disabled")], title=f"Commands in cmdgrp {cmdgrp_id}")
     except httpx.HTTPStatusError as e:
         print_api_error(e, "list commands"); raise typer.Exit(1)
     except Exception as e:
@@ -122,20 +122,44 @@ def add_commands(
         print_api_error(e, "add commands"); raise typer.Exit(1)
 
 
-@commands_app.command("remove")
-def remove_commands(
+@commands_app.command("clear")
+def clear_commands(
     cmdgrp_id: int = typer.Argument(..., help="Command group ID"),
-    ids: str = typer.Option(..., "--ids", help="Comma-separated command IDs"),
     host: Optional[int] = _host_opt(),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"),
 ):
-    """Remove commands from a command group."""
+    """Remove ALL commands from a command group.
+
+    The API has no per-item delete — DELETE on the children collection clears
+    everything. To selectively remove, use `replace`.
+    """
     from bt_cli.epml.client import get_client
+    if not yes:
+        typer.confirm(f"Clear all commands in cmdgrp {cmdgrp_id}?", abort=True)
     try:
-        id_list = [int(x.strip()) for x in ids.split(",") if x.strip()]
         with get_client() as c:
-            c.delete_cmdgrp_commands(cmdgrp_id, id_list, host_id=host)
-        typer.echo(f"Removed {len(id_list)} command(s) from cmdgrp {cmdgrp_id}")
+            c.clear_cmdgrp_commands(cmdgrp_id, host_id=host)
+        typer.echo(f"Cleared all commands from cmdgrp {cmdgrp_id}")
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, "clear commands"); raise typer.Exit(1)
+    except Exception as e:
+        print_api_error(e, "clear commands"); raise typer.Exit(1)
+
+
+@commands_app.command("replace")
+def replace_commands(
+    cmdgrp_id: int = typer.Argument(..., help="Command group ID"),
+    commands: str = typer.Option(..., "--commands", "-c", help="Comma-separated command strings — final list"),
+    host: Optional[int] = _host_opt(),
+):
+    """Replace the entire command list (clear + add). Two requests; not server-atomic."""
+    from bt_cli.epml.client import get_client
+    try:
+        cmds = [x.strip() for x in commands.split(",") if x.strip()]
+        with get_client() as c:
+            result = c.replace_cmdgrp_commands(cmdgrp_id, cmds, host_id=host)
+        print_json(result)
     except httpx.HTTPStatusError as e:
-        print_api_error(e, "remove commands"); raise typer.Exit(1)
+        print_api_error(e, "replace commands"); raise typer.Exit(1)
     except Exception as e:
-        print_api_error(e, "remove commands"); raise typer.Exit(1)
+        print_api_error(e, "replace commands"); raise typer.Exit(1)

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/epml/commands/rbp_hostgrps.py

@@ -45,13 +45,17 @@ def list_hostgrps(
 def create_hostgrp(
     name: str = typer.Option(..., "--name", "-n"),
     description: str = typer.Option("", "--description", "-d"),
+    type_: str = typer.Option("I", "--type", "-t", help="Group type: I=Internal, E=External"),
     host: Optional[int] = _host_opt(),
 ):
-    """Create a host group."""
+    """Create a host group. API requires `type` ∈ {I,E}; defaults to Internal."""
     from bt_cli.epml.client import get_client
+    if type_ not in ("I", "E"):
+        typer.echo(f"--type must be 'I' or 'E', got {type_!r}", err=True)
+        raise typer.Exit(2)
     try:
         with get_client() as c:
-            result = c.create_hostgrp({"name": name, "description": description}, host_id=host)
+            result = c.create_hostgrp({"name": name, "description": description, "type": type_}, host_id=host)
         print_json(result)
     except httpx.HTTPStatusError as e:
         print_api_error(e, "create hostgrp"); raise typer.Exit(1)
@@ -96,7 +100,7 @@ def list_hosts(
             print_json(data)
         else:
             rows = data if isinstance(data, list) else (data.get("data", []) if isinstance(data, dict) else [])
-            print_table(rows, [("ID", "id"), ("Host", "host")], title=f"Hosts in hostgrp {hostgrp_id}")
+            print_table(rows, [("Host", "host"), ("Description", "description"), ("Disabled", "disabled")], title=f"Hosts in hostgrp {hostgrp_id}")
     except httpx.HTTPStatusError as e:
         print_api_error(e, "list hostgrp hosts"); raise typer.Exit(1)
     except Exception as e:
@@ -122,20 +126,44 @@ def add_hosts(
         print_api_error(e, "add hostgrp hosts"); raise typer.Exit(1)
 
 
-@hosts_app.command("remove")
-def remove_hosts(
+@hosts_app.command("clear")
+def clear_hosts(
     hostgrp_id: int = typer.Argument(..., help="Host group ID"),
-    ids: str = typer.Option(..., "--ids", help="Comma-separated host IDs"),
     host: Optional[int] = _host_opt(),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"),
 ):
-    """Remove hosts from a host group."""
+    """Remove ALL hosts from a host group.
+
+    The API has no per-item delete — DELETE clears everything. Use `replace`
+    for selective removal.
+    """
     from bt_cli.epml.client import get_client
+    if not yes:
+        typer.confirm(f"Clear all hosts in hostgrp {hostgrp_id}?", abort=True)
     try:
-        id_list = [int(x.strip()) for x in ids.split(",") if x.strip()]
         with get_client() as c:
-            c.delete_hostgrp_hosts(hostgrp_id, id_list, host_id=host)
-        typer.echo(f"Removed {len(id_list)} host(s) from hostgrp {hostgrp_id}")
+            c.clear_hostgrp_hosts(hostgrp_id, host_id=host)
+        typer.echo(f"Cleared all hosts from hostgrp {hostgrp_id}")
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, "clear hostgrp hosts"); raise typer.Exit(1)
+    except Exception as e:
+        print_api_error(e, "clear hostgrp hosts"); raise typer.Exit(1)
+
+
+@hosts_app.command("replace")
+def replace_hosts(
+    hostgrp_id: int = typer.Argument(..., help="Host group ID"),
+    hosts: str = typer.Option(..., "--hosts", help="Comma-separated host name/glob expressions — final list"),
+    host: Optional[int] = _host_opt(),
+):
+    """Replace the entire host list (clear + add). Two requests; not server-atomic."""
+    from bt_cli.epml.client import get_client
+    try:
+        host_list = [x.strip() for x in hosts.split(",") if x.strip()]
+        with get_client() as c:
+            result = c.replace_hostgrp_hosts(hostgrp_id, host_list, host_id=host)
+        print_json(result)
     except httpx.HTTPStatusError as e:
-        print_api_error(e, "remove hostgrp hosts"); raise typer.Exit(1)
+        print_api_error(e, "replace hostgrp hosts"); raise typer.Exit(1)
     except Exception as e:
-        print_api_error(e, "remove hostgrp hosts"); raise typer.Exit(1)
+        print_api_error(e, "replace hostgrp hosts"); raise typer.Exit(1)

{bt_cli-0.4.33 → bt_cli-0.4.35}/src/bt_cli/epml/commands/rbp_roles.py

@@ -45,13 +45,21 @@ def list_roles(
 def create_role(
     name: str = typer.Option(..., "--name", "-n"),
     description: str = typer.Option("", "--description", "-d"),
+    action: str = typer.Option("A", "--action", "-a", help="Role verdict: A=Allow, R=Reject"),
     host: Optional[int] = _host_opt(),
 ):
-    """Create a role."""
+    """Create a role.
+
+    The API requires `action` to be exactly `A` (Allow) or `R` (Reject) —
+    not 'Allow'/'Reject'. Defaults to A.
+    """
     from bt_cli.epml.client import get_client
+    if action not in ("A", "R"):
+        typer.echo(f"--action must be 'A' or 'R', got {action!r}", err=True)
+        raise typer.Exit(2)
     try:
         with get_client() as c:
-            result = c.create_role({"name": name, "description": description}, host_id=host)
+            result = c.create_role({"name": name, "description": description, "action": action}, host_id=host)
         print_json(result)
     except httpx.HTTPStatusError as e:
         print_api_error(e, "create role"); raise typer.Exit(1)