Skip to content

Client operations commands

Common global behavior is documented in the CLI hub. The complete session-management command contracts follow.

gdsgate session list

Lists the live sessions you are permitted to terminate (filtered by the Cedar killSession action), with the session id, principal, resource, start time, and, under HOLDS, what the session was opened on: key where the holder proved possession of one, cookie for a person who arrived through the clientless browser entry. The two read alike in every other column, and they are not the same thing to whoever is deciding whether to end one: a browser session's whole credential lives in the gateway, so ending it ends that person's access until they sign in again, while a keystore session's holder still has their certificate afterwards.

gdsgate --config client.toml session list

gdsgate session kill [<id>] [--principal <p>] [--resource <r>]

Terminates live sessions and audits each one. Pass exactly one selector: a single <id> from session list, or every session of a --principal, or every session on a --resource. Only the sessions the policy permits are ended.

SESSION_ID=5f3c1234  # replace with an id from `session list`
gdsgate --config client.toml session kill "$SESSION_ID"
gdsgate --config client.toml session kill --principal alice
gdsgate --config client.toml session kill --resource prod-db
Argument Default Purpose
<id> none A single session id. Mutually exclusive with the selectors below.
--principal <p> none Every live session owned by this principal.
--resource <r> none Every live session on this backend resource.

gdsgate session watch

Streams live-session opens and closes you may act on, as they happen, until interrupted.

list kill watch