@uipath/apms-tool

APMS Tool

CLI plugin for the UiPath Access Policy Management Service (APMS), surfaced as the ip-restriction command group.

Composed under admin-tool, so commands are invoked as uip admin ip-restriction <subject> <verb>.

Command tree

uip admin ip-restriction
├── ip-ranges
│   ├── list [--filter <fragment>]
│   ├── get [<id>] [--cidr <cidr>]
│   ├── create [--file <path> | --name --cidr [--cidr ...] | --name --start-ip --end-ip] [--expires <duration>]
│   ├── update <id> [--file <path> | --name | --cidr | --start-ip | --end-ip]
│   └── delete [<id>] [--cidr <cidr>] --confirm
├── enforcement
│   ├── get
│   ├── enable --confirm
│   └── disable
├── bypass-rules
│   ├── list [--filter <fragment>]
│   ├── get <id>
│   ├── create --file <path>
│   ├── update <id> [--file <path> | --regex-entry <pattern>]
│   └── delete <id>
└── my-ip

Subjects

• ip-ranges — list / get / create / update / delete IP range allowlist entries (CIDR or start/end IP).
• enforcement — get / enable / disable the singleton IP-range enforcement switch.
• bypass-rules — list / get / create / update / delete URL-pattern exceptions to IP allowlisting.
• my-ip — show the public IP the platform sees for the current caller.

Conventions

• Authenticated via uip login (or --s2s-token once wired through).
• Most mutating commands accept inline flags for common cases and --file <path> for full-body control. The two paths are mutually exclusive — pick one. bypass-rules create is file-only because the request has 4 required business fields.
• --filter <fragment> is a client-side, case-insensitive substring filter (on name for ip-ranges, on regexEntry/appName for bypass-rules).
• ip-ranges delete accepts either a positional UUID or --cidr <cidr> and runs a lockout-safety pre-flight when enforcement is enabled.
• enforcement enable runs an IP pre-flight (compares my-ip against the allowlist) before flipping the switch.