vgs-cli 1.33.0.dev3__py3-none-any.whl → 1.34.0.dev2__py3-none-any.whl

vgs_cli-1.34.0.dev2.data/data/vgscli/credentials-admin.yaml

@@ -0,0 +1,26 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read
+    - name: cards:write
+    - name: card-attributes:read
+    - name: network-tokens:read
+    - name: network-tokens:write
+    - name: 3ds:write
+    - name: 3ds:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgs_cli-1.34.0.dev2.data/data/vgscli/notification-integration-schema.yaml

@@ -0,0 +1,89 @@
+---
+"$schema": http://json-schema.org/draft-07/schema#
+type: object
+properties:
+  apiVersion:
+    type: string
+    enum:
+      - 1.0.0
+  kind:
+    type: string
+    enum:
+      - NotificationIntegration
+  data:
+    type: object
+    properties:
+      id:
+        type: string
+        minLength: 1
+      provider:
+        type: string
+        minLength: 1
+      name:
+        type: string
+        minLength: 1
+        pattern: ^[a-zA-Z0-9-_ ]+$
+      description:
+        type: string
+      enabled:
+        type: boolean
+      providerParameters:
+        type: array
+        minItems: 1
+        items:
+          type: object
+          properties:
+            name:
+              type: string
+              minLength: 1
+            value:
+              type: string
+              minLength: 1
+          required:
+            - name
+            - value
+          additionalProperties: false
+      events:
+        type: array
+        items:
+          type: object
+          properties:
+            id:
+              type: string
+              minLength: 1
+            enabled:
+              type: boolean
+            resourceIds:
+              oneOf:
+                - type: "null"
+                - type: array
+                  minItems: 1
+                  uniqueItems: true
+                  items:
+                    type: string
+                    minLength: 1
+          required:
+            - id
+            - enabled
+          additionalProperties: false
+    required:
+      - provider
+      - name
+      - providerParameters
+    allOf:
+      - if:
+          not:
+            required:
+              - id
+        then:
+          required:
+            - events
+          properties:
+            events:
+              minItems: 1
+    additionalProperties: false
+required:
+  - apiVersion
+  - kind
+  - data
+additionalProperties: false

vgs_cli-1.33.0.dev3.data/data/vgscli/calm.yaml → vgs_cli-1.34.0.dev2.data/data/vgscli/public-credential-collect.yaml

@@ -1,7 +1,10 @@
 apiVersion: 1.0.0
 kind: ServiceAccount
 data:
-  name: calm
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
   {%- if vaults | length == 0 %}
       {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
   {% elif vaults | length == 1 %}
@@ -12,5 +15,7 @@ data:
   {% endif %}
   scopes:
     - name: cards:write
+    - name: card-attributes:read
     - name: network-tokens:write
-    - name: merchants:write
+    - name: 3ds:write
+    - name: 3ds:read

vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-no-pci.yaml

@@ -0,0 +1,22 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read
+    - name: cards-attributes:read
+    - name: network-tokens:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-with-pci.yaml

@@ -0,0 +1,23 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  {%- if name | length == 0 or name | length > 20 %}
+      {{ cli_fail("Service Account name must contain between 1 and 20 characters. Use '--var name=<NAME>' to specify it.") }}
+  {%- endif %}
+  name: {{ name }}
+  {%- if vaults | length == 0 %}
+      {{ cli_fail("This template needs one tenant. Use '--tenant <TENANT_ID>' to specify it.") }}
+  {% elif vaults | length == 1 %}
+  vaults:
+    - {{ vaults[0] }}
+  {%- else %}
+      {{ cli_fail("This template doesn't allow multiple tenants.") }}
+  {% endif %}
+  scopes:
+    - name: cards:read-pci
+    - name: cards:read
+    - name: card-attributes:read
+    - name: network-tokens:read
+    - name: account-validations:write
+    - name: account-validations:read
+    - name: account-reference-numbers:read

{vgs_cli-1.33.0.dev3.dist-info → vgs_cli-1.34.0.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vgs-cli
-Version: 1.33.0.dev3
+Version: 1.34.0.dev2
 Summary: VGS Client
 Home-page: https://github.com/verygoodsecurity/vgs-cli
 Author: Very Good Security
@@ -64,9 +64,11 @@ Command Line Tool for programmatic configurations on VGS.
 - [Commands](#commands)
   - [Authentication](#authentication)
   - [Organizations and tenants](#organizations-and-tenants)
+  - [Organization notifications](#organization-notifications)
   - [Routes](#routes)
   - [Collect Forms](#collect-forms)
   - [Access credentials and logs](#access-credentials-and-logs)
+  - [Service accounts](#service-accounts)
   - [Certificates](#certificates)
 - [Automation with VGS CLI](#automation-with-vgs-cli)
 
@@ -100,7 +102,7 @@ Check our [official documentation](https://docs.verygoodsecurity.com/vault/devel
 Install the agent skill:
 
 ```bash
-npx skills add verygoodsecurity/vgs-cli --skill vgs-cli-guide
+npx skills add verygoodsecurity/skills --skill vgs-cli-guide
 ```
 
 The guide covers Dashboard-assisted onboarding, the complete built-in command
@@ -139,9 +141,31 @@ Use **tenant** and `--tenant/-T` in new commands. Legacy vault commands and
 | Command | Purpose |
 | --- | --- |
 | `vgs get organizations` | List accessible organizations. |
-| `vgs get tenants` | List accessible tenants. |
+| `vgs get tenants` | List all tenants visible to the authenticated identity. |
 | `vgs generate tenant > tenant.yaml` | Generate a tenant template. |
 | `vgs apply tenant -f tenant.yaml` | Create a tenant from a reviewed template. |
+| `vgs apply tenant -O <ORGANIZATION_ID> -f tenant.yaml` | Create a tenant when `organizationId` is omitted from the template. |
+| `vgs apply tenant-resources -T <TENANT_ID> -f resources.yaml --dry-run true` | Validate tenant resources without applying them. |
+| `vgs apply tenant-resources -T <TENANT_ID> -f resources.yaml` | Apply reviewed resources to a tenant. |
+
+`vgs get tenants` does not take an organization option. `vgs apply tenant`
+requires the organization ID either in `tenant.yaml` as `data.organizationId`
+or through `-O/--organization`; if both are present, they must match.
+
+### Organization notifications
+
+| Command | Purpose |
+| --- | --- |
+| `vgs get notification-providers` | List supported notification providers. |
+| `vgs get notifications -O <ORGANIZATION_ID>` | List notification integrations. |
+| `vgs get notification-events -O <ORGANIZATION_ID> <INTEGRATION_ID>` | List configured events for a notification integration. |
+| `vgs apply notification -O <ORGANIZATION_ID> -f notification.yaml` | Create or update a notification integration from a file. |
+| `vgs apply notification -O <ORGANIZATION_ID> --enable <INTEGRATION_ID>` | Enable a notification integration. |
+| `vgs apply notification -O <ORGANIZATION_ID> --disable <INTEGRATION_ID>` | Disable a notification integration. |
+| `vgs delete notification -O <ORGANIZATION_ID> <INTEGRATION_ID>` | Delete a notification integration. |
+
+Notification management requires an active organization, organization-admin
+access. The CLI masks generated webhook secrets in its output.
 
 ### Routes
 
@@ -170,6 +194,35 @@ Use **tenant** and `--tenant/-T` in new commands. Legacy vault commands and
 | `vgs logs access -T <TENANT_ID>` | View tenant access logs. |
 | `vgs logs operations -T <TENANT_ID> -R <REQUEST_ID>` | View request operation logs. |
 
+### Service accounts
+
+Generate a service-account resource for exactly one tenant. Names must contain
+1–20 characters. Save the generated YAML so you can review it before applying
+it.
+
+```bash
+vgs generate service-account --template <TEMPLATE> -T <TENANT_ID> --var name=<NAME> > service-account.yaml
+```
+
+| Template | Purpose |
+| --- | --- |
+| `public-credential-collect` | Collect payment credentials without read access. |
+| `read-credentials-no-pci` | Read tokenized credentials without PCI data. |
+| `read-credentials-with-pci` | Read credentials including PCI data. |
+| `credentials-admin` | Read and write payment credentials. |
+
+After reviewing the generated scopes, apply the resource to the organization:
+
+```bash
+vgs apply service-account -O <ORGANIZATION_ID> -f service-account.yaml
+```
+
+The apply response contains a one-time client secret. Run the command only in
+your private terminal, store the secret in an approved secret manager, and do
+not commit or share the response. See the
+[service-account documentation](https://docs.verygoodsecurity.com/vault/developer-tools/vgs-cli/service-account)
+for the full workflow.
+
 ### Certificates
 
 | Command | Purpose |

{vgs_cli-1.33.0.dev3.dist-info → vgs_cli-1.34.0.dev2.dist-info}/RECORD

@@ -1,20 +1,20 @@
-vgs_cli-1.33.0.dev3.data/data/vgscli/calm.yaml,sha256=HyCIHO5LZdPaeczNw_IOSGxzBBhrSa42lWtGm3GF4mY,448
-vgs_cli-1.33.0.dev3.data/data/vgscli/checkout.yaml,sha256=O2hfGAmgLcM9BGvo4tjIhMe8DX1x6Tbj0Ep6dSxmu2I,555
-vgs_cli-1.33.0.dev3.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
-vgs_cli-1.33.0.dev3.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
-vgs_cli-1.33.0.dev3.data/data/vgscli/http-route-template.yaml,sha256=HHKoTF4pSGWUTR1lsw6CIBNdTvTyqNjkeocco80_K38,1663
-vgs_cli-1.33.0.dev3.data/data/vgscli/mft-route-template.yaml,sha256=3TwiVS6yDir3uc0g0G_p5Hj4Gje2aq8Zi6vnnRa4j5Q,142
-vgs_cli-1.33.0.dev3.data/data/vgscli/payments-admin.yaml,sha256=zMTRLAeuSrMdDZau7AdHr2GVBbvblwxrj1hCZfR4zE8,700
-vgs_cli-1.33.0.dev3.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
-vgs_cli-1.33.0.dev3.data/data/vgscli/sub-account-checkout.yaml,sha256=bTYscQeNxU2nfNzSeZ3ffmVFni4Iuigh1rxd2_uKn3M,629
-vgs_cli-1.33.0.dev3.data/data/vgscli/tenant-template.yaml,sha256=Q0z5_ds5UWign6ndBodLtXVZHWWCV-VsUVMnvJAhqPM,388
-vgs_cli-1.33.0.dev3.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
-vgs_cli-1.33.0.dev3.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.33.0.dev3.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
-vgs_cli-1.33.0.dev3.data/data/vgscli/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
-vgs_cli-1.33.0.dev3.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
+vgs_cli-1.34.0.dev2.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
+vgs_cli-1.34.0.dev2.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
+vgs_cli-1.34.0.dev2.data/data/vgscli/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
+vgs_cli-1.34.0.dev2.data/data/vgscli/http-route-template.yaml,sha256=HHKoTF4pSGWUTR1lsw6CIBNdTvTyqNjkeocco80_K38,1663
+vgs_cli-1.34.0.dev2.data/data/vgscli/mft-route-template.yaml,sha256=3TwiVS6yDir3uc0g0G_p5Hj4Gje2aq8Zi6vnnRa4j5Q,142
+vgs_cli-1.34.0.dev2.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
+vgs_cli-1.34.0.dev2.data/data/vgscli/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
+vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-no-pci.yaml,sha256=7-31MJewfRI8VVveobdLjeusYE1Edk1xRrWplU3VMow,770
+vgs_cli-1.34.0.dev2.data/data/vgscli/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
+vgs_cli-1.34.0.dev2.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
+vgs_cli-1.34.0.dev2.data/data/vgscli/tenant-template.yaml,sha256=Q0z5_ds5UWign6ndBodLtXVZHWWCV-VsUVMnvJAhqPM,388
+vgs_cli-1.34.0.dev2.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
+vgs_cli-1.34.0.dev2.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
+vgs_cli-1.34.0.dev2.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
+vgs_cli-1.34.0.dev2.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
 vgscli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-vgscli/_version.py,sha256=fEZhDhsdgs73-mUrVWYLJTeZdBnM7u6CDGSyxS9EqNE,1681
+vgscli/_version.py,sha256=LLDTvaySlCanrTjEZQVXiEcbLIGJtg9ZoJOV79fURSM,1681
 vgscli/access_logs.py,sha256=G0GjlLjWiC-N6OzK6-RCvWddcVGQlLCLAcyO9pLWIOM,1928
 vgscli/audits_api.py,sha256=6FjpS1yTALio-DejgIS2eDw75ChjDp4GoAGXh4uZExU,3211
 vgscli/auth.py,sha256=vdUZ12nqtefIuSHNmwCFvxoqwS3m6ZP5TqLZFNwKnSU,2104
@@ -23,25 +23,27 @@ vgscli/auth_utils.py,sha256=aC1VI0dFdFeupLS9Okz4uDz-wHhhFabqiLUg2R5vO2s,600
 vgscli/callback_server.py,sha256=oFFF5AGbbwhF7Hsc5fzS7jeGFzIMbebc9Qdq8uEl1PY,1055
 vgscli/cert_manager_api.py,sha256=ek25BcyGeUo0pBoqineMTYMgmQaYJfimFFHMljZh5yA,1646
 vgscli/cli_utils.py,sha256=NzXK29_yIDrB-3T_XdLLB8NCWneQ-cpZFi9mazQL9tQ,3810
-vgscli/click_extensions.py,sha256=1E0yyAMBn1xmZvi9Gz3FNAp1ir1JTZIVC6eUHz2gPh0,6667
+vgscli/click_extensions.py,sha256=VoaBJpR_ZVNQYTX1x-TZrGAyLiuAGXQq_ZkLU7Y6sZ0,6678
 vgscli/collect_forms.py,sha256=HAg-tvpXxmVq5Zns4v8G0cP-tgYKuWmVFwzuNjieu-A,4619
 vgscli/collect_forms_api.py,sha256=JHnnsOUyStD7yR92LfGqn8DOpnu0l0yqTUMQnWE_NGs,1246
 vgscli/config_file.py,sha256=HB8lANU0qoO09Wnkf-QDzPh2qtrnFcqcetnCaQgtQ3U,1543
-vgscli/errors.py,sha256=vzB-dfrzveNUBZ4QIIn-0JpW1iGizsx00tQDyxTXLvE,10359
+vgscli/errors.py,sha256=6ENjyWFV6kenwYqOfLMDCuLcHb8GL5Xo_K_uViRQUMc,10385
 vgscli/file_token_util.py,sha256=537b54paMGw0u5PL5VJgQqQ7awKa9lQP88n3tUc_lyw,771
 vgscli/id_generator.py,sha256=3CbvSOUSyLON76p6M8wUhVQVig8j75_rnWdpxLhBifM,1510
 vgscli/keyring_token_util.py,sha256=cnR72-0AInzujUsIwHoXwPbgprbkllgAXN-AAI3qsPM,4632
+vgscli/notifications.py,sha256=6D8HFDEl3X4V0V9fYZT-9nWYe2KYVahfhRLMF0pbh4I,6252
+vgscli/notifications_api.py,sha256=1EXmRb2fOJrU1QOAZ6gmq8yMjBLhNZGSVs3kRtD2Dfw,2342
 vgscli/testing.py,sha256=MLrsvy3mEwvjtqyuG0UjwEX-rDkbWUo52aXvu2H2sTk,1437
 vgscli/text.py,sha256=c2d1As7awq8PlEF9NiI6JrjsYYousj9YT0o1xOQ2MQM,172
 vgscli/token_handler.py,sha256=MvtmlicqnGrcopNkTr8Q2RlKE7IDj_sJFxF_39Jd7W8,183
 vgscli/vgs.py,sha256=BiQuHeOuH25zbTdwNOsW_O69YuKsZFTYA2jr9JFRZng,6262
-vgscli/cli/__init__.py,sha256=y6rnaI0aRFn0KZbEGEukfrOLK5Jay_cqjTG5KV05kpM,971
+vgscli/cli/__init__.py,sha256=VRKz8oZF1OhAzkZHZGFYJEQgu3oMHk2nSld3lCoJtuQ,1624
 vgscli/cli/commands/__init__.py,sha256=8ptc9-Vzdx0HU3ZeMcKERYjmJyuB5IMjBSF3Igx5yQ4,206
-vgscli/cli/commands/apply.py,sha256=IMixlZFgZ9hUvJpbqOMigfOQ006IMExnMgzDNpN8zSw,14943
+vgscli/cli/commands/apply.py,sha256=D3YwW9vNxyq25IuObfd_jPM0m-U_GmrNauN0wS1LL0U,20049
 vgscli/cli/commands/certificate.py,sha256=xQV-G8ZWP9uPFqrczlCpCZkHUt2aJflBP2cc5hjobIw,22930
-vgscli/cli/commands/delete.py,sha256=39RfiBg3NL6aLqAQpzQ2Z-yr33bUqBT6Jwd2IG8l4JY,2667
-vgscli/cli/commands/generate.py,sha256=nkS5--kBHbJhUo7QvslGza5c8Cu2ue-bVitDVGwUYFE,4025
-vgscli/cli/commands/get.py,sha256=bl55fMe_xgLuwFJNmIVOxcZp4p-lrMfG5cNAnQydE9Q,6183
+vgscli/cli/commands/delete.py,sha256=2nuYKhp0FhoGTcmJUECjRnlYrKLdAgIoIp-y25ViwDg,3873
+vgscli/cli/commands/generate.py,sha256=k0bw3Cu8Y6qs0sHHnC-CBtlvnl7Rzx2rjlCwTCFaWes,4117
+vgscli/cli/commands/get.py,sha256=5X9CS8FdC33JUwGn-0qaZYDPeNakhfxSU8aX40LPW-M,8818
 vgscli/cli/types/__init__.py,sha256=a-P-SoGHpLzMg7CL1hhg5x_nf6sHq0qAuGm_AtIITmw,107
 vgscli/cli/types/resource_id.py,sha256=7JILR-KjoVGQDHB40tXJfTcU53iR8wM9Zr24fY5le3o,1172
 vgscli/cli/types/variable.py,sha256=IVcszPoWmTjeo_evDsLN06LuUZGTLL-wcZCVfBNBP8I,414
@@ -49,18 +51,18 @@ vgscli/resource-templates/http-route-template.yaml,sha256=HHKoTF4pSGWUTR1lsw6CIB
 vgscli/resource-templates/mft-route-template.yaml,sha256=3TwiVS6yDir3uc0g0G_p5Hj4Gje2aq8Zi6vnnRa4j5Q,142
 vgscli/resource-templates/tenant-template.yaml,sha256=Q0z5_ds5UWign6ndBodLtXVZHWWCV-VsUVMnvJAhqPM,388
 vgscli/resource-templates/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
-vgscli/resource-templates/service-account/calm.yaml,sha256=HyCIHO5LZdPaeczNw_IOSGxzBBhrSa42lWtGm3GF4mY,448
-vgscli/resource-templates/service-account/checkout.yaml,sha256=O2hfGAmgLcM9BGvo4tjIhMe8DX1x6Tbj0Ep6dSxmu2I,555
-vgscli/resource-templates/service-account/payments-admin.yaml,sha256=zMTRLAeuSrMdDZau7AdHr2GVBbvblwxrj1hCZfR4zE8,700
-vgscli/resource-templates/service-account/sub-account-checkout.yaml,sha256=bTYscQeNxU2nfNzSeZ3ffmVFni4Iuigh1rxd2_uKn3M,629
-vgscli/resource-templates/service-account/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
+vgscli/resource-templates/service-account/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
+vgscli/resource-templates/service-account/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
+vgscli/resource-templates/service-account/read-credentials-no-pci.yaml,sha256=7-31MJewfRI8VVveobdLjeusYE1Edk1xRrWplU3VMow,770
+vgscli/resource-templates/service-account/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
 vgscli/validation-schemas/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
 vgscli/validation-schemas/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
+vgscli/validation-schemas/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
 vgscli/validation-schemas/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
 vgscli/validation-schemas/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
 vgscli/validation-schemas/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.33.0.dev3.dist-info/METADATA,sha256=e8Qpg3hzYyODNHD-CzbAQK1UJoNHt16HXcPU-B56zfc,5404
-vgs_cli-1.33.0.dev3.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-vgs_cli-1.33.0.dev3.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
-vgs_cli-1.33.0.dev3.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
-vgs_cli-1.33.0.dev3.dist-info/RECORD,,
+vgs_cli-1.34.0.dev2.dist-info/METADATA,sha256=xUPQHj1GSm6f6bBcNqliRrHQEDwNBgnx_elm2S38jWg,8226
+vgs_cli-1.34.0.dev2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+vgs_cli-1.34.0.dev2.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
+vgs_cli-1.34.0.dev2.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
+vgs_cli-1.34.0.dev2.dist-info/RECORD,,

vgscli/_version.py

@@ -6,7 +6,7 @@ from packaging.version import InvalidVersion, Version
 
 from vgscli.text import bold, green
 
-__version__ = "1.33.0.dev3"
+__version__ = "1.34.0.dev2"
 
 
 # noinspection PyBroadException

vgscli/cli/__init__.py

@@ -4,6 +4,8 @@ from vgs.sdk.vault_mgmt import VaultMgmtAPI
 
 from vgscli.auth import handshake, token_util
 from vgscli.collect_forms_api import create_api as create_collect_forms_api_client
+from vgscli.notifications import resolve_organization
+from vgscli.notifications_api import create_api as create_notifications_api_client
 
 
 def create_account_mgmt_api(ctx: click.Context) -> AccountMgmtAPI:
@@ -31,3 +33,18 @@ def create_collect_forms_api(ctx: click.Context, vault_id: str):
     access_token = token_util.get_access_token()
 
     return create_collect_forms_api_client(vault_id, environment, access_token)
+
+
+def create_notifications_api(ctx: click.Context, organization_id: str = None):
+    environment = ctx.obj.env
+
+    handshake(ctx, environment)
+    access_token = token_util.get_access_token()
+    organization_internal_id = None
+    if organization_id:
+        account_mgmt = AccountMgmtAPI(access_token, environment)
+        organization_internal_id = resolve_organization(account_mgmt, organization_id)
+
+    return create_notifications_api_client(
+        environment, access_token, organization_internal_id
+    )

vgscli/cli/commands/apply.py

@@ -14,6 +14,7 @@ from vgscli.auth import handshake, token_util
 from vgscli.cli import (
     create_account_mgmt_api,
     create_collect_forms_api,
+    create_notifications_api,
     create_vault_mgmt_api,
 )
 from vgscli.cli.types import ResourceId, ResourceIdParamType
@@ -41,6 +42,13 @@ from vgscli.errors import (
     get_error_details,
     handle_errors,
 )
+from vgscli.notifications import (
+    event_request_data,
+    integration_request_data,
+    provider_input_parameters,
+    redact_notification_integration,
+    validate_notification_configuration,
+)
 
 logger = logging.getLogger()
 
@@ -152,6 +160,150 @@ def apply_service_account(ctx: click.Context, org_id: ResourceId, file) -> None:
     )
 
 
+def _notification_apply_mode(file, enable, disable):
+    selected = [file is not None, enable is not None, disable is not None]
+    if sum(selected) != 1:
+        raise click.UsageError("Use exactly one of --file, --enable, or --disable.")
+
+
+def _notification_error_message(error):
+    details = get_error_details(error)
+    return details[0] if details else "API error occurred"
+
+
+@apply.command("notification")
+@click.option(
+    "-O",
+    "--organization",
+    "org_id",
+    type=ResourceIdParamType(prefix="AC"),
+    required=True,
+    help="Organization ID that owns the notification integration.",
+)
+@click.option(
+    "--file",
+    "-f",
+    type=click.File(),
+    help="Notification integration configuration to apply.",
+)
+@click.option(
+    "--enable",
+    "integration_id_to_enable",
+    metavar="INTEGRATION_ID",
+    help="Enable an existing notification integration.",
+)
+@click.option(
+    "--disable",
+    "integration_id_to_disable",
+    metavar="INTEGRATION_ID",
+    help="Disable an existing notification integration.",
+)
+@click.pass_context
+@handle_errors()
+def apply_notification_integration(
+    ctx: click.Context,
+    org_id: ResourceId,
+    file,
+    integration_id_to_enable,
+    integration_id_to_disable,
+):
+    """
+    Create, update, enable, or disable a notification integration.
+    """
+    _notification_apply_mode(file, integration_id_to_enable, integration_id_to_disable)
+    organization_id = org_id.base58
+
+    if file is not None:
+        document = validate_yaml(
+            file, "validation-schemas/notification-integration-schema.yaml"
+        )
+        data = document["data"]
+        integration_id = data.get("id")
+
+        api = create_notifications_api(ctx, organization_id)
+        providers = api.notification_providers.list().body.get("data", [])
+        supported_events = api.supported_notification_events.list().body.get("data", [])
+        validate_notification_configuration(data, providers, supported_events)
+
+        current = None
+        if integration_id:
+            current = api.notification_integrations.retrieve(
+                organization_id, integration_id
+            ).body["data"]
+
+        request_data = integration_request_data(data, current=current)
+        if integration_id:
+            response = api.notification_integrations.update(
+                organization_id,
+                integration_id,
+                body={"data": request_data},
+            )
+            action = "updated"
+        else:
+            response = api.notification_integrations.create(
+                organization_id, body={"data": request_data}
+            )
+            integration_id = response.body["data"]["id"]
+            action = "created"
+
+        applied_events = []
+        for event in data.get("events", []):
+            try:
+                event_response = api.notification_integration_events.update(
+                    organization_id,
+                    integration_id,
+                    event["id"],
+                    body={"data": event_request_data(event)},
+                )
+            except (exceptions.ClientError, exceptions.ServerError) as error:
+                raise VgsCliError(
+                    f"Notification integration {integration_id} was {action}, but "
+                    f"event {event['id']} failed: {_notification_error_message(error)}."
+                ) from error
+            applied_events.append(event_response.body["data"])
+
+        output = redact_notification_integration(response.body["data"], providers)
+        output["events"] = applied_events
+        click.echo(
+            dump_camelized_yaml(
+                {
+                    "apiVersion": "1.0.0",
+                    "kind": "NotificationIntegration",
+                    "data": output,
+                }
+            )
+        )
+        return
+
+    integration_id = integration_id_to_enable or integration_id_to_disable
+    enabled = integration_id_to_enable is not None
+    api = create_notifications_api(ctx, organization_id)
+    providers = api.notification_providers.list().body.get("data", [])
+    current = api.notification_integrations.retrieve(
+        organization_id, integration_id
+    ).body["data"]
+    request_data = {
+        "provider": current["provider"],
+        "name": current["name"],
+        "description": current.get("description") or "",
+        "enabled": enabled,
+        "provider_parameters": provider_input_parameters(current, providers),
+    }
+    response = api.notification_integrations.update(
+        organization_id, integration_id, body={"data": request_data}
+    )
+    output = redact_notification_integration(response.body["data"], providers)
+    click.echo(
+        dump_camelized_yaml(
+            {
+                "apiVersion": "1.0.0",
+                "kind": "NotificationIntegration",
+                "data": output,
+            }
+        )
+    )
+
+
 def _apply_tenant(
     ctx: click.Context,
     org_id: Optional[ResourceId],

vgscli/cli/commands/delete.py

@@ -3,7 +3,12 @@ from click_plugins import with_plugins
 from vgs.sdk.vaults_api import create_api as create_vaults_api
 
 from vgscli.auth import handshake, token_util
-from vgscli.cli import create_account_mgmt_api, create_collect_forms_api
+from vgscli.cli import (
+    create_account_mgmt_api,
+    create_collect_forms_api,
+    create_notifications_api,
+)
+from vgscli.cli.types import ResourceId, ResourceIdParamType
 from vgscli.cli_utils import iter_entry_points
 from vgscli.click_extensions import tenant_option
 from vgscli.collect_forms import validate_collect_form_identifier
@@ -32,6 +37,43 @@ def delete_service_account(ctx, organization, client_id):
     account_mgmt.service_accounts.delete(organization, client_id)
 
 
+@delete.command("notification")
+@click.option(
+    "--organization",
+    "-O",
+    "org_id",
+    type=ResourceIdParamType(prefix="AC"),
+    required=True,
+    help="Organization ID that owns the notification integration.",
+)
+@click.argument("integration_id", type=click.STRING)
+@click.option("--confirm", "-y", is_flag=True, help="Skip confirmation prompt")
+@click.pass_context
+@handle_errors()
+def delete_notification_integration(
+    ctx: click.Context,
+    org_id: ResourceId,
+    integration_id: str,
+    confirm: bool,
+):
+    """
+    Delete a notification integration from an organization.
+    """
+    organization_id = org_id.base58
+    if not confirm:
+        click.confirm(
+            f"Are you sure you want to delete notification integration "
+            f"{integration_id} from organization {organization_id}?",
+            abort=True,
+        )
+
+    api = create_notifications_api(ctx, organization_id)
+    api.notification_integrations.delete(organization_id, integration_id)
+    click.secho(
+        f"Notification integration {integration_id} deleted successfully", fg="green"
+    )
+
+
 @delete.command("routes")
 @tenant_option
 @click.argument("route_id", type=click.STRING)