CLI guide

Your company access and service data

Your connection is limited to the current company permissions and the scopes you approved. Internal registrar identities and object IDs are excluded from customer responses, including field selection and filters. Company ownership does not grant platform-administrator access. DNS integrations you choose yourself remain visible where needed to manage DNS.

• managed_by_binadit: whether Binadit manages the domain registration, as shown in the portal.
• invoice_number / invoice_id: the invoice number and the local invoice ID associated with an order.
• billing_mode: managed: an existing managed billing agreement for a domain, without naming the underlying billing system.

Historical results follow the same public-field rules. You can only read an operation submitted through your own connection. Its result can be null when the current permissions do not allow the payload or the original action cannot be verified. A restricted connection also receives status without a historical payload. This is not permission to submit a replacement request.

Install the CLI

minisign -Vm SHA256SUMS -p binadit-release.pub

Build locally from source

The CLI is built and checked locally. Use a binary and checksum published by your administrator, or build from the reviewed repository’s cli directory. GitHub builds are not used for this.

cd cli
cargo build --locked
./target/debug/binadit --help

The CLI is written in Rust and supports macOS (Apple Silicon and Intel), Linux x64 and Windows x64. Linux ARM64 is not published. Released binaries need no Rust, PHP or Node.js. For local source builds, use the pinned cli/rust-toolchain.toml.

Sign in and choose a company

The CLI opens your normal browser. Sign in to Binadit, select the company and confirm the requested permissions. Return to the terminal after approval. The CLI uses the operating system’s credential store and does not save tokens in its config file. Ordinary commands refresh their access token automatically and do not ask for your passkey each time; reuse your existing profile. The personal connection expires after at most 30 days or 7 days without use, or upon revocation.

binadit login
binadit accounts list
binadit context use --account 123
binadit whoami

Check the company shown by whoami before making a change. A profile selects your connection and environment; the company remains an explicit context.

Everyday commands

Use --help on a command to see the exact parameters supported by your installed version. The endpoint reference describes the server capabilities.

binadit dns records list example.com --account 123
binadit workspace accounts list --workspace 12 --account 123
binadit billing invoices list --status open --account 123
binadit capabilities --account 123
binadit completion zsh

Addresses, public DNS and domain extensions

These read-only commands use the same lookup services as the portal. Postcode lookup requires account:read, public MX lookup spam:read and the extension catalog products:read. MX results contain hostnames and priorities; the portal never connects to those mailservers. The catalog omits internal purchase costs and uses cursor pagination; featured returns the same ordered top-50 selection as registration. Check active and enabled together; the order quote confirms actual availability.

binadit api /lookups/addresses/1234AB --account 123
binadit api /lookups/mx/example.nl --account 123
binadit api /catalog/domain-extensions --account 123
binadit api /catalog/domain-extensions/featured --account 123

Preview changes first

Use --dry-run where supported. A local --yes only confirms the CLI prompt; it cannot bypass account permissions, payment requirements or server-side verification. Use --wait to follow accepted work to a final result.

binadit dns records create example.com \
  --type TXT --name _verification --value example \
  --account 123 --dry-run

Workspace documents and Book

Setup PDFs omit passwords by default. Save documents and images to a new private file; existing files are never overwritten. Book uploads and deletes use workspace:write and the workspace version from book theme. DNS exports also require workspace:write because they can include ownership-verification records.

binadit workspace accounts setup pdf 7 --workspace 3 --file setup.pdf --account 123
binadit workspace book theme --workspace 3 --account 123
binadit workspace book download logo --workspace 3 --file logo.png --account 123
binadit workspace domains dns export 9 --workspace 3 --format bind --file workspace.bind --account 123

A password-bearing PDF additionally requires workspace.credentials:read, enabled sensitive actions and strong human verification within 5 minutes. Its one-time claim expires after 2 minutes; never automatically retry consumption after an ambiguous failure. Sending setup instructions requires workspace.mailboxes:write. Sharing a password additionally requires the credential scope, recent verification and the explicit --share-password option.

Review an offer before ordering

Prepare one product offer with orders quote, inspect its current prices and expiry, then confirm that quote separately with orders commit. Viewing or previewing an offer creates no paid order. A confirmed quote is one order intent; separate confirmations are separate orders and do not promise a combined invoice.

binadit orders quote --kind workspace_mailbox --from-file mailbox.json --account 123
binadit orders quote get QUOTE_ID --account 123
binadit orders commit QUOTE_ID --account 123

For workspace_mailbox, mailbox.json contains workspace_id, domain_id, product_id, local_part and optional display_name. Select current company resources and an eligible product from the API. Optional passwords belong only in a protected file or stdin.

Webhooks

Configure a company-wide status receiver using protected JSON input. The CLI reserves a new private signing-key file before creating the paused webhook. Configure your receiver first, then read its current version and enable it. An existing destination file is never overwritten.

binadit webhooks create --from-file receiver.json --file webhook-key.txt --account 123
binadit webhooks list --account 123
binadit webhooks update WEBHOOK_ID --set enabled=true --version VERSION --account 123
binadit webhooks deliveries WEBHOOK_ID --account 123

Use in scripts

Use an explicitly selected account and profile, JSON output and --no-input. Store machine credentials in your secret manager. A scheduled job should have its own integration rather than a personal CLI session.

binadit dns records list example.com \
  --account 123 --profile automation --output json --no-input

Output and exit codes

Results go to stdout; progress and diagnostic messages go to stderr. Request JSON explicitly when another program reads the result. A non-zero exit code means the command requires attention; inspect the structured error and request ID.