bt-cli 0.4.70__tar.gz → 0.4.71__tar.gz

{bt_cli-0.4.70 → bt_cli-0.4.71}/.github/workflows/ci.yml

@@ -100,7 +100,9 @@ jobs:
           pip install -e ".[test]"
 
       - name: Run integration tests
-        run: pytest tests/integration -v -m integration
+        # --integration is the opt-in these tests now require; without it they
+        # skip, since credentials alone are no longer the trigger.
+        run: pytest tests/integration -v -m integration --integration
         env:
           BT_PWS_API_URL: ${{ secrets.BT_PWS_API_URL }}
           BT_PWS_CLIENT_ID: ${{ secrets.BT_PWS_CLIENT_ID }}

{bt_cli-0.4.70 → bt_cli-0.4.71}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.70**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.71**
 
 ## Setup
 
@@ -42,7 +42,7 @@ Use these slash commands for detailed product guidance:
 | Cross-product | `bt quick` | `pasm-onboard`, `pasm-offboard`, `pasm-search` |
 | Password Safe | `bt pws` | `systems`, `accounts`, `credentials`, `sessions`, `secrets`, `audit`, `quick` |
 | PRA | `bt pra` | `jump-items`, `vault`, `jump-groups`, `quick` |
-| Entitle | `bt entitle` | `integrations`, `resources`, `bundles`, `permissions` |
+| Entitle | `bt entitle` | `integrations`, `resources`, `bundles`, `permissions`, `jit`, `audit` |
 | EPM Windows | `bt epmw` | `computers`, `groups`, `policies`, `requests`, `quick` |
 | EPM Linux | `bt epml` | `rbp` (cmdgrps/hostgrps/usergrps/tmdategrps/roles/policy/tests/tx), `settings`, `users`, `audit`, `siems`, `quick` |
 | Secrets API | `bt secrets` | `folders`, `static`, `dynamic` (incl. `generate`), `leases`, `integrations` |
@@ -92,6 +92,8 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - **PWS session recording download = headless replay under `/pbsm/replay`** (there is **no** video-export API — `?video/?mp4/?webm` return JSON, not media). Flow: `GET /Sessions/{id}` for `Token`+`RecordKey`+`Protocol` → `POST /pbsm/replay` `{id:Token, record_key, protocol:"RDP"|"SSH", headless:true}` → `PUT /pbsm/replay/{rid}` `{offset:<ms>}` (seek) → `GET /pbsm/replay/{rid}?png=<scale>` (one PNG per offset) → `DELETE /pbsm/replay/{rid}`. **Warm-up:** the first `PUT` 404s (`"no such file or directory"`) until the renderer loads — retry ~0.5s. The seek response is state `{offset, next, eof, duration}`; **`next` = next recorded frame's offset**, enabling event-driven stepping. **`bt pws sessions analyze <id>` (or `--dir`)** preps a replay dump for LLM analysis without calling an LLM: reads `index.json`, selects **keyframes** (RDP frames whose PNG byte-size changed ≥`--threshold`%, dependency-free — no Pillow, UNION the frame that renders each **typed keystroke burst**, anchored via the recording `StartTime` → each keyframe tagged `screen-change`/`after-typing` with the `typed` text, so the model reads targeted spots not every frame), and prints a token/USD **cost estimate** (`--model opus|sonnet|haiku`) for focused (keyframes) vs all-frames; writes `analysis.json`. SSH → recommends the transcript over frames. Consumed by the `/session-analysis` skill (interactive; the model reads only the keyframes). Surfaced as `bt pws sessions replay <id>`. **Default = even coverage + dedup**: ~60 evenly-spaced frames across the whole session (`--frames N`) with consecutive-identical frames skipped (`--dedup`, sha1-based) — because event-driven over-samples RDP (it records many deltas as the screen paints, so `next`-stepping clusters at the login and burns the frame budget before covering the timeline). Modes are mutually exclusive: `--frames` (default) / `--fps` / `--interval` / `--all-frames` (event-driven forensic). Also `--from/--to`, `--scale`, `--max-frames`, `--no-dedup`; `--mp4` stitches via ffmpeg, else prints the command + install hint. Always `DELETE`s the replay in `finally`.
 - Entitle permissions: Use server-side filters (`--resource`, `--user`, `--integration`) - dataset can be 20k+ records
 - Entitle users: Use `--all` flag only when needed - default fetches first page only
+- **Entitle tokens are region-bound**: a token minted in one region 401s `"The token received doesn't exist"` on the others. Servers: `api.entitle.io`, `api.us.entitle.io`, `api.ca.entitle.io` — set `BT_ENTITLE_API_URL`/`entitle.api_url` to the tenant's region (that misleading 401 also = wrong-region config, not just a dead token). **No `GET /users/{id}`** — `users get` resolves via `list_users(search=...)`.
+- **Entitle `jit` / `audit`** (spec-derived, live-verified): `bt entitle jit list` wraps `GET /eligibleJitAccess` — with an org token `--user` is **required** (else 400), and the response is `{roles,bundles,pagination}` not the `result` envelope. `bt entitle audit search` wraps `POST /auditLogs/search` (Experimental) — **date window must be < 24h** (server 400s on ≥24h; CLI enforces client-side, default `--hours 24`), no pagination (returns all rows in range), each row's context is one of `integration`/`idp`/`ticket`/`user`. Full spec at `/projects/reference/entitle-api-reference.openapi.json`.
 - Windows builds: Rich must be pinned to `<14.0.0` (Rich 14 has PyInstaller unicode issues)
 - **EPML URL transform**: spec paths start with `/api/...` but real URL is `https://api.beyondtrust.io/site/<site-id>/epm/linux/<spec-path-minus-/api/>`. Encapsulated in client `_build_url` — never bypass it.
 - **EPML two authorizers**: spec claims `nomine-authorizer` (PAT) globally but the gateway has IAM-only routes (return 403 with AWS-flavored body). PAT cannot reach those. Documented per-op in `src/bt_cli/data/skills/epml/SKILL.md`. Where `/v6/pbul/rbp/...` exists alongside legacy `/pbul/{hostid}/rbp/...`, prefer legacy — v6 is mostly IAM-only.

{bt_cli-0.4.70 → bt_cli-0.4.71}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: bt-cli
-Version: 0.4.70
+Version: 0.4.71
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

bt_cli-0.4.71/bt-cli-cheatsheet.html

@@ -0,0 +1,229 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<title>BT-CLI Demo Flow — Working Commands (pf922288)</title>
+<style>
+  :root{
+    --bg:#0d1117;
+    --panel:#151b23;
+    --border:#2a323d;
+    --border-strong:#3a4452;
+    --text:#e6edf3;
+    --text-secondary:#9aa7b5;
+    --text-muted:#6b7684;
+    --accent:#3ea6ff;
+    --green:#3fb950;
+    --amber:#d29922;
+    --tag-bg:#1c2733;
+    --mono: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
+    --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  }
+  *{box-sizing:border-box}
+  body{background:var(--bg);color:var(--text);font-family:var(--sans);font-size:17px;margin:0;padding:38px 22px 72px}
+  .wrap{max-width:960px;margin:0 auto}
+  h1{font-size:30px;font-weight:600;margin:0 0 6px}
+  .sub{font-size:16px;color:var(--text-muted);margin:0 0 24px;line-height:1.5}
+  .legend{display:flex;flex-wrap:wrap;gap:18px;font-size:15px;color:var(--text-secondary);margin:0 0 26px;padding:15px 18px;border:1px solid var(--border);border-radius:8px;background:var(--panel)}
+  .legend span{display:inline-flex;align-items:center;gap:7px}
+  .dot{width:10px;height:10px;border-radius:50%}
+  .dot.v{background:var(--green)} .dot.s{background:var(--amber)} .dot.r{background:var(--accent)}
+  .refbox{border:1px solid var(--border-strong);border-radius:8px;padding:16px 18px;margin:0 0 30px;background:#0a0e14;font-family:var(--mono);font-size:15px;line-height:1.85;color:var(--text-secondary)}
+  .refbox b{color:var(--text)}
+  .step{font-size:14px;text-transform:uppercase;letter-spacing:.05em;color:var(--text-muted);margin:32px 0 12px;font-weight:600}
+  .step:first-of-type{margin-top:0}
+  .row{border:1px solid var(--border);border-radius:8px;padding:16px 18px;margin-bottom:12px;background:var(--panel)}
+  .row.state{border-color:#4a3d1a}
+  .hd{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px;gap:10px}
+  .lbl{font-size:17px;font-weight:500;color:var(--text)}
+  .tags{display:flex;gap:7px;flex-shrink:0}
+  .tag{font-size:13px;font-weight:600;letter-spacing:.03em;color:var(--accent);background:var(--tag-bg);border:1px solid var(--border-strong);border-radius:4px;padding:3px 10px;white-space:nowrap}
+  .tag.v{color:var(--green);border-color:#264a30}
+  .tag.s{color:var(--amber);border-color:#4a3d1a}
+  .cmdrow{display:flex;align-items:stretch;gap:9px;margin-bottom:7px}
+  .cmd{flex:1;font-family:var(--mono);font-size:15.5px;line-height:1.6;color:#c9e8ff;background:#0a0e14;border:1px solid var(--border);border-radius:6px;padding:11px 14px;overflow-x:auto;white-space:pre}
+  .cpy{flex-shrink:0;width:44px;font-size:18px;display:flex;align-items:center;justify-content:center;border-radius:6px;border:1px solid var(--border-strong);background:transparent;cursor:pointer;color:var(--text-secondary);transition:background .12s,color .12s}
+  .cpy:hover{background:var(--tag-bg);color:var(--text)}
+  .cpy.copied{color:var(--green);border-color:var(--green)}
+  .note{font-size:15px;color:var(--text-muted);margin-top:8px;line-height:1.6}
+  .note b{color:var(--text-secondary)}
+  .note code{font-family:var(--mono);font-size:14px;color:#c9e8ff}
+  .flag{border:1px dashed var(--border-strong);border-radius:8px;padding:16px 18px;font-size:16px;color:var(--text-secondary);line-height:1.7}
+  .flag b{color:var(--text)}
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>BT-CLI demo flow — working commands</h1>
+  <p class="sub">Verified live against tenant pf922288, 01 Jul 2026. Real IDs baked in. Ephemeral IDs (request/session) are captured at runtime, not hardcoded.</p>
+
+  <div class="legend">
+    <span><span class="dot r"></span>tag = docs bucket (BT-CLI / API)</span>
+    <span><span class="dot v"></span><b style="color:var(--green)">VERIFIED</b> — ran live, non-destructive, safe to demo</span>
+    <span><span class="dot s"></span><b style="color:var(--amber)">STATE-CHANGING</b> — correct syntax, changes/creates/deletes; run deliberately</span>
+  </div>
+
+  <div class="refbox">
+    <b>Real values (pf922288)</b><br>
+    system  ad.upm.academy .......... ID <b>19</b> (Active Directory)<br>
+    system  linhost2 ................ ID <b>6</b>  (Linux — used for the create demo)<br>
+    account svc_app ................. ID <b>18119</b> (exists; credential test PASSED)<br>
+    safe    GitHub - BTSolution-Engineering ... <b>9b56a95b-0a8a-4be6-de3c-08dd5118ea68</b><br>
+    folder  IaC-Demo ............... <b>bec2694b-994a-47cd-07c2-08de5e7a5e2d</b><br>
+    group   SecretsSafe_Access ..... ID <b>9</b>  (Dev_Ansible=10, API_Users=11)<br>
+    secret  path ................... <b>GitHub - BTSolution-Engineering/IaC-Demo/AWS</b><br>
+    perm flags ..................... None, Read, Create, Edit, Delete, Share, Manage
+  </div>
+
+  <div class="step">Setup — run once per session</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Session setup</span><span class="tags"><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c0">source .venv/bin/activate</div><button class="cpy" onclick="cp('c0',this)">⧉</button></div>
+    <div class="cmdrow"><div class="cmd" id="c2">bt whoami</div><button class="cpy" onclick="cp('c2',this)">⧉</button></div>
+    <div class="note">Credentials load from <b>~/.bt-cli/config.yaml</b> — no <code>source .env</code> needed. <code>bt whoami</code> should show Password Safe = Connected (user NH-Ansible, ID 120).</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Show the underlying REST call (demo toggle)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="cR">bt --show-rest pws accounts get 18119</div><button class="cpy" onclick="cp('cR',this)">⧉</button></div>
+    <div class="note">Prepend <b><code>bt --show-rest</code></b> to <b>any</b> command to print the REST request + response panels (method, URL, headers, body) — auth headers auto-redacted. Great for proving each command hits the public API. Also works as env: <code>export BT_SHOW_REST=1</code>.</div>
+  </div>
+
+  <div class="step">1 · Create account or secret — BT-CLI</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Create managed account (local, on a non-directory system)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c3">bt pws accounts create --system 6 --name "svc_demo01" --password 'PASSWORD' --change-frequency xdays --change-days 1 --change-time 02:00</div><button class="cpy" onclick="cp('c3',this)">⧉</button></div>
+    <div class="note"><b>--system takes the integer ID</b> (6 = linhost2, Linux). Sub a real PASSWORD. Note: directory accounts (like svc_app on ad.upm.academy) require a UserPrincipalName and are onboarded via <b>discovery</b>, not this manual create — so the create demo uses a local system.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Create secret (Secrets Safe)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c4">bt pws secrets secrets create --folder bec2694b-994a-47cd-07c2-08de5e7a5e2d --title "db-admin-demo" --username admin --password 'PASSWORD'</div><button class="cpy" onclick="cp('c4',this)">⧉</button></div>
+    <div class="note">--folder is a folder <b>GUID</b> (IaC-Demo). Creates a real secret in that folder.</div>
+  </div>
+
+  <div class="step">2 · Assign policy, ownership, permissions — API</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">List permission flags</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c5">bt pws secrets safes permissions-options</div><button class="cpy" onclick="cp('c5',this)">⧉</button></div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Show current grants on a safe</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c6">bt pws secrets safes permissions 9b56a95b-0a8a-4be6-de3c-08dd5118ea68</div><button class="cpy" onclick="cp('c6',this)">⧉</button></div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Grant permissions to a group</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c7">bt pws secrets safes grant 9b56a95b-0a8a-4be6-de3c-08dd5118ea68 --group 9 --permissions "Read, Create, Edit, Delete, Share, Manage"</div><button class="cpy" onclick="cp('c7',this)">⧉</button></div>
+    <div class="note"><b>Flags aren't freely combinable</b> — the server validates the whole set. Valid combos (verified live): <code>Read</code> · <code>Read, Edit</code> · <code>Read, Create, Edit, Delete, Share</code> · <code>Read, Create, Edit, Delete, Share, Manage</code> (full owner). <b>Manage only works with the full set</b> — <code>Read,Edit,Manage</code> is rejected as an "Invalid permission combination".</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Revoke all permissions for a group</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c8">bt pws secrets safes revoke 9b56a95b-0a8a-4be6-de3c-08dd5118ea68 --group 9</div><button class="cpy" onclick="cp('c8',this)">⧉</button></div>
+  </div>
+
+  <div class="step">3 · Trigger verification and rotation — BT-CLI</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Verify stored credential (non-destructive)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c9">bt pws quick test -s "ad.upm.academy" -a svc_app</div><button class="cpy" onclick="cp('c9',this)">⧉</button></div>
+    <div class="note">Ran live → <b>Credential test PASSED for svc_app@ad.upm.academy</b>. Quick commands accept the system <b>name</b>.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Rotate now</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c10">bt pws quick rotate -s "ad.upm.academy" -a svc_app</div><button class="cpy" onclick="cp('c10',this)">⧉</button></div>
+    <div class="note">Fires the platform rotation/propagation. Changes the live password.</div>
+  </div>
+
+  <div class="step">4 · Submit and approve access request — API</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Submit checkout request (capture the request ID)</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c11">bt pws credentials checkout --system "ad.upm.academy" --account "svc_app" --reason "demo" -o json</div><button class="cpy" onclick="cp('c11',this)">⧉</button></div>
+    <div class="note">Returns a <b>RequestID</b> in the JSON. <b>Requires the account to be under an access policy with a schedule your identity can use</b> — otherwise you get <code>"Could not find a schedule to use with this release request."</code> If so, use <b>quick checkout</b> (step 5), which lists only accounts you can actually request.</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">List pending requests</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c12">bt pws credentials list --status pending</div><button class="cpy" onclick="cp('c12',this)">⧉</button></div>
+    <div class="note">Ran live (currently "No requests found"). Also: <code>--all</code>, <code>--status approved</code>.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Approve a pending request</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c13">bt pws credentials approve REQUEST_ID</div><button class="cpy" onclick="cp('c13',this)">⧉</button></div>
+    <div class="note">REQUEST_ID is the integer from the checkout above / from <code>credentials list</code>.</div>
+  </div>
+
+  <div class="step">5 · Retrieve or broker access — API</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Quick checkout — the easy path (request + approve + retrieve)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c14b">bt pws quick checkout</div><button class="cpy" onclick="cp('c14b',this)">⧉</button></div>
+    <div class="note"><b>Run with no args to go interactive</b> — it lists only the accounts you're actually allowed to request, you pick one, and it does request → approve → show password in one step. This sidesteps the access-policy/schedule issue above.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Quick checkout — scripted, to a variable</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c14">PW=$(bt pws quick checkout -s "SYSTEM" -a "ACCOUNT" --raw)</div><button class="cpy" onclick="cp('c14',this)">⧉</button></div>
+    <div class="note">Same flow, non-interactive. Fill SYSTEM/ACCOUNT with one shown in the interactive list. <code>echo "$PW"</code> to view.</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Get a Secrets Safe secret value</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c15">bt pws quick get-secret "GitHub - BTSolution-Engineering/IaC-Demo/AWS" --raw</div><button class="cpy" onclick="cp('c15',this)">⧉</button></div>
+    <div class="note">Path is <b>Safe/Folder/SecretName</b>. Resolved live to Secret "AWS". Drop <code>--raw</code> for a table view.</div>
+  </div>
+
+  <div class="step">6 · Revoke access — API</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Check in + rotate on release</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c16">bt pws credentials checkin REQUEST_ID --rotate</div><button class="cpy" onclick="cp('c16',this)">⧉</button></div>
+    <div class="note">REQUEST_ID is an integer (from step 4/5).</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">List active sessions (capture the session ID)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c17">bt pws sessions list --active</div><button class="cpy" onclick="cp('c17',this)">⧉</button></div>
+    <div class="note">Ran live (currently "No sessions found"). The <b>ID</b> column is the SESSION_ID (integer) below.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Suspend session (resumable)</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c18">bt pws sessions suspend SESSION_ID</div><button class="cpy" onclick="cp('c18',this)">⧉</button></div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Terminate session (permanent)</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c19">bt pws sessions terminate SESSION_ID --force</div><button class="cpy" onclick="cp('c19',this)">⧉</button></div>
+  </div>
+
+  <div class="step">7 · Offboard the account — BT-CLI</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Offboard system (removes system + accounts + asset)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c20">bt pws quick offboard -s "ad.upm.academy"</div><button class="cpy" onclick="cp('c20',this)">⧉</button></div>
+    <div class="note"><b>Destructive:</b> deletes ad.upm.academy (ID 19) and all its accounts incl. svc_app. Don't run unless you mean it.</div>
+  </div>
+
+  <div class="step">8 · Export audit evidence — API</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Full evidence export (JSON)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c21">bt pws audit export --file ~/evidence.json</div><button class="cpy" onclick="cp('c21',this)">⧉</button></div>
+    <div class="note">Defaults to BOTH requests and sessions when no flag is given. <b>--file must be a writable path</b> — the CLI fetches the evidence then writes the file, so a "Permission denied" here means the directory isn't writable (use <code>~/</code> or <code>/tmp</code>, not a read-only checkout dir).</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Approved requests (CSV)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c22">bt pws audit export --requests --status approved --file ~/svc_app-evidence.csv --format csv</div><button class="cpy" onclick="cp('c22',this)">⧉</button></div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Session evidence (CSV)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c23">bt pws audit export --sessions --file ~/sessions.csv --format csv</div><button class="cpy" onclick="cp('c23',this)">⧉</button></div>
+  </div>
+
+  <div class="step">9-10 · Integrations + API auth — out of scope</div>
+  <div class="flag">
+    <b>ServiceNow / SailPoint</b> and <b>scoped-token API auth</b> (certs, rate limits, bulk ops) are UI/console config, not bt-cli commands — nothing to copy/paste here.
+  </div>
+</div>
+
+<script>
+function cp(id, btn){
+  const text = document.getElementById(id).innerText;
+  const done = () => { const o = btn.textContent; btn.textContent='✓'; btn.classList.add('copied'); setTimeout(()=>{btn.textContent=o;btn.classList.remove('copied');},1200); };
+  if (navigator.clipboard && navigator.clipboard.writeText) navigator.clipboard.writeText(text).then(done).catch(()=>fallbackCopy(text,done));
+  else fallbackCopy(text,done);
+}
+function fallbackCopy(text, done){
+  const ta=document.createElement('textarea'); ta.value=text; ta.style.position='fixed'; ta.style.opacity='0';
+  document.body.appendChild(ta); ta.select(); try{document.execCommand('copy');}catch(e){} document.body.removeChild(ta); done();
+}
+</script>
+</body>
+</html>

{bt_cli-0.4.70 → bt_cli-0.4.71}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.70"
+version = "0.4.71"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -75,3 +75,7 @@ packages = ["src/bt_cli"]
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]
+# Test the working tree, not whatever bt_cli happens to be installed in
+# site-packages. Without this a non-editable `pip install bt-cli` shadows
+# src/ and the suite silently tests a stale copy at the same version number.
+pythonpath = ["src"]

{bt_cli-0.4.70 → bt_cli-0.4.71}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.70"
+__version__ = "0.4.71"

{bt_cli-0.4.70 → bt_cli-0.4.71}/src/bt_cli/core/config.py

@@ -2,7 +2,7 @@
 
 import os
 import re
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, fields
 from typing import Any, Optional
 
 from dotenv import load_dotenv
@@ -10,16 +10,45 @@ from dotenv import load_dotenv
 from .config_file import get_layered_config, get_secret_from_keyring
 
 
-@dataclass
+# Field names holding credential material. Any dataclass field named here is
+# rendered as '***' by ProductConfig.__repr__ instead of in the clear, so that
+# a stray print(), a traceback, or a pytest failure dump can't spill a secret
+# into a log or CI artifact.
+_SECRET_FIELDS = frozenset({"api_key", "user_api_key", "client_secret", "pat"})
+
+
+@dataclass(repr=False)
 class ProductConfig:
-    """Base configuration shared by all products."""
+    """Base configuration shared by all products.
+
+    Subclasses must also use ``@dataclass(repr=False)`` so they inherit the
+    masking ``__repr__`` below rather than getting a generated one that
+    prints every field verbatim.
+    """
 
     api_url: str
     verify_ssl: bool = True
     timeout: float = 30.0
 
-
-@dataclass
+    def __repr__(self) -> str:
+        """Render the config with credential fields masked."""
+        parts = []
+        for f in fields(self):
+            if not f.repr:
+                continue
+            value = getattr(self, f.name)
+            # Only mask a secret that is actually set — showing '' or None
+            # tells you the credential is missing, which is the usual reason
+            # you're looking at a config repr in the first place.
+            if f.name in _SECRET_FIELDS and value:
+                shown = "'***'"
+            else:
+                shown = repr(value)
+            parts.append(f"{f.name}={shown}")
+        return f"{type(self).__name__}({', '.join(parts)})"
+
+
+@dataclass(repr=False)
 class PWSConfig(ProductConfig):
     """Password Safe configuration.
 
@@ -53,7 +82,7 @@ class PWSConfig(ProductConfig):
             )
 
 
-@dataclass
+@dataclass(repr=False)
 class EntitleConfig(ProductConfig):
     """Entitle configuration.
 
@@ -74,7 +103,7 @@ class EntitleConfig(ProductConfig):
             raise ValueError("BT_ENTITLE_API_URL is required")
 
 
-@dataclass
+@dataclass(repr=False)
 class PRAConfig(ProductConfig):
     """Privileged Remote Access configuration.
 
@@ -95,7 +124,7 @@ class PRAConfig(ProductConfig):
             )
 
 
-@dataclass
+@dataclass(repr=False)
 class EPMWConfig(ProductConfig):
     """EPM Windows configuration.
 
@@ -117,7 +146,7 @@ class EPMWConfig(ProductConfig):
             )
 
 
-@dataclass
+@dataclass(repr=False)
 class SecretsConfig(ProductConfig):
     """BeyondTrust Secrets API configuration.
 
@@ -146,7 +175,7 @@ class SecretsConfig(ProductConfig):
             raise ValueError("BT_SECRETS_PAT is required")
 
 
-@dataclass
+@dataclass(repr=False)
 class PFConfig(ProductConfig):
     """Pathfinder platform (Nomine auth service) configuration.
 
@@ -173,7 +202,7 @@ class PFConfig(ProductConfig):
             raise ValueError("BT_PF_PAT is required")
 
 
-@dataclass
+@dataclass(repr=False)
 class EPMLConfig(ProductConfig):
     """EPM Linux configuration.
 

{bt_cli-0.4.70 → bt_cli-0.4.71}/src/bt_cli/data/skills/entitle/SKILL.md

@@ -164,6 +164,58 @@ the list by substring, `n` / `p` to page, or blank to cancel.
 - The token used must have a user identity (personal API token). Pure read-only
   org keys return `request.unauthenticated` on POST.
 
+## Eligible JIT Access
+
+Show the roles and bundles a user is **eligible to request** (the menu behind
+`requests create`), sourced from `GET /public/v1/eligibleJitAccess`.
+
+```bash
+# What can this user request? (org token REQUIRES --user)
+bt entitle jit list --user <user_id>
+
+# Restrict to roles or bundles, filter by name
+bt entitle jit list -u <user_id> --type bundle
+bt entitle jit list -u <user_id> --search "EC2"
+
+# Raw envelope for scripting
+bt entitle jit list -u <user_id> -o json   # -> {"roles":[...], "bundles":[...], "pagination":{...}}
+```
+
+**Gotchas:**
+- With an **org/admin token, `--user` is mandatory** — omitting it returns
+  `400 userId is required when using an organization token`. An admin *personal*
+  token may omit `--user` to query itself.
+- The response is **not** the usual `{"result": [...]}` envelope — it's
+  `{"roles": [...], "bundles": [...], "pagination": {...}}`, so the table prints
+  two sections and `-o json` returns that object as-is.
+
+## Audit Logs
+
+Search the org audit trail via `POST /public/v1/auditLogs/search` (flagged
+**Experimental** by the API).
+
+```bash
+# Last 24h (default)
+bt entitle audit search
+
+# Shorter lookback / explicit window
+bt entitle audit search --hours 6
+bt entitle audit search --from 2026-07-16T00:00:00Z --to 2026-07-16T12:00:00Z
+
+# Filter by event type (repeatable), JSON out
+bt entitle audit search --type ticket.created --type ticket.finalApproved -o json
+```
+
+**Gotchas:**
+- **The window must be shorter than 24 hours** — the server 400s on anything
+  `>= 24h`. The CLI enforces this client-side (default lookback is 24h; a wider
+  `--from/--to` is refused before any API call).
+- No pagination — the endpoint returns every row in the window (can be ~1000+
+  for a busy day). Use `--limit N` to cap the *displayed* rows.
+- Each row is `{createdAt, type, <context>}` where context is exactly one of
+  `integration` / `idp` / `ticket` / `user` depending on the event type; the
+  table's **Context** column resolves whichever is present.
+
 ## Roles & Policies
 
 ```bash

{bt_cli-0.4.70 → bt_cli-0.4.71}/src/bt_cli/entitle/client/base.py

@@ -388,9 +388,10 @@ class EntitleClient:
         """List users with optional pagination limit."""
         return self.paginate("/users", {"search": search}, page_size=limit, max_pages=max_pages)
 
-    def get_user(self, user_id: str) -> dict[str, Any]:
-        """Get a user by ID."""
-        return self.get(f"/users/{user_id}")
+    # NOTE: The Entitle API has no GET /users/{id} route (live-verified 2026-07-17:
+    # a valid user id 404s identically to a bogus path — Express "Cannot GET ...").
+    # To resolve a single user, use list_users(search=...) — see the `users get`
+    # command. Do not re-add a get-by-id method here.
 
     # =========================================================================
     # Permissions
@@ -508,6 +509,77 @@ class EntitleClient:
         """Get an access request by ID."""
         return self.get(f"/accessRequests/{request_id}")
 
+    # =========================================================================
+    # Eligible JIT Access
+    # =========================================================================
+
+    def get_eligible_jit_access(
+        self,
+        user_id: Optional[str] = None,
+        access_type: Optional[str] = None,
+        search: Optional[str] = None,
+        page: int = 1,
+        per_page: int = 100,
+    ) -> dict[str, Any]:
+        """Get the roles and bundles a user is eligible to request (JIT).
+
+        Args:
+            user_id: User to query on behalf of. **Required when authenticating
+                with an organization token** (the server 400s without it); an
+                admin personal token may omit it to query itself.
+            access_type: Restrict to ``"role"`` or ``"bundle"``.
+            search: Free-text filter on role/bundle name.
+            page: 1-indexed page number.
+            per_page: Page size (1-100).
+
+        Returns:
+            ``{"roles": [...], "bundles": [...], "pagination": {...}}``. Note
+            this endpoint does NOT use the standard ``result`` envelope, so it
+            is fetched directly rather than through ``paginate``.
+        """
+        params = {
+            "userId": user_id,
+            "type": access_type,
+            "search": search,
+            "page": page,
+            "perPage": per_page,
+        }
+        return self.get("/eligibleJitAccess", params)
+
+    # =========================================================================
+    # Audit Logs
+    # =========================================================================
+
+    def search_audit_logs(
+        self,
+        min_date: str,
+        max_date: str,
+        types: Optional[list[str]] = None,
+    ) -> list[dict[str, Any]]:
+        """Search audit logs within a date range (Experimental API).
+
+        Args:
+            min_date: ISO-8601 start of the window (inclusive).
+            max_date: ISO-8601 end of the window (exclusive).
+            types: Optional list of event ``type`` strings to filter on.
+
+        Returns:
+            The list of audit-log rows. Each row has ``createdAt`` and ``type``
+            plus one context field (``integration``/``idp``/``ticket``/``user``)
+            depending on the event.
+
+        Note:
+            The server rejects windows of 24 hours or longer with a 400; callers
+            should keep ``max_date - min_date`` under a day.
+        """
+        body: dict[str, Any] = {"minDate": min_date, "maxDate": max_date}
+        if types:
+            body["type"] = types
+        resp = self.post("/auditLogs/search", json=body)
+        if isinstance(resp, dict):
+            return resp.get("result", [])
+        return resp if isinstance(resp, list) else []
+
 
 def get_client(user_token: bool = False) -> EntitleClient:
     """Create a configured Entitle client.

{bt_cli-0.4.70 → bt_cli-0.4.71}/src/bt_cli/entitle/commands/__init__.py

@@ -11,6 +11,7 @@ app = typer.Typer(
 # Import and register command groups
 from . import auth, integrations, resources, roles, bundles
 from . import workflows, users, permissions, policies, accounts, requests
+from . import jit, audit
 
 app.add_typer(auth.app, name="auth", help="Authentication commands")
 app.add_typer(integrations.app, name="integrations", help="Manage integrations")
@@ -23,3 +24,5 @@ app.add_typer(permissions.app, name="permissions", help="Manage permissions")
 app.add_typer(policies.app, name="policies", help="Manage policies")
 app.add_typer(accounts.app, name="accounts", help="Manage accounts")
 app.add_typer(requests.app, name="requests", help="Manage access requests")
+app.add_typer(jit.app, name="jit", help="Eligible JIT access")
+app.add_typer(audit.app, name="audit", help="Search audit logs")