ork idp

6 min read

Inspect and validate Internal Developer Platform (IDP) configurations.

The IDP is the contract between platform teams and developers. These commands let you inspect and validate IDP configurations without needing to run the gateway or access a cluster.

Commands

CommandDescription
validateValidate IDP configuration in a Katalog
schemaShow the flat schema for an IDP target
fieldsList all IDP fields with their paths and types
tokensShow token permissions for a CRD
targetsList all IDP targets in a Katalog
can-iCheck if a token can perform an operation
responseShow the IDP response configuration

ork idp validate

Validate IDP configuration in a Katalog.

This runs the same IDP-specific validations as ork validate, but only for IDP concerns: fields, paths, tokens, response config, and namespace rules. It does not check the full Katalog schema — only the IDP portions.

ork idp validate

Flags

FlagShortDescription
--fullShow a detailed breakdown of the IDP configuration for each IDP-enabled CRD.

Examples

# Validate IDP configuration
ork idp validate

Output

✓ IDP configuration is valid

With --full

# Validate IDP configuration with detailed breakdown
ork idp validate --full

Output

IDP Configuration Summary
──────────────────────────────────────────────────────────────────────

✅ application
  target: smartapp  /  kind: AppRequest
  name:      "{{ repoSlug .spec.repository }}"
  namespace: "{{ teamName }}-{{ environmentName }}"
  fields:    12 total (spec: 8, labels: 2, annotations: 2)
  nested:    5 path(s)
  tokens:    4 token(s) with restrictions
  response:  default: true, payload: 4, exclude: 3
  poll:      url, field

✅ database
  target: db  /  kind: Database
  name:      "{{ repoSlug .spec.repository }}"
  namespace: "{{ teamName }}"
  fields:    6 total (spec: 4, labels: 1, annotations: 1)
  tokens:    none (all tokens allowed)
  response:  none (default CR response)

──────────────────────────────────────────────────────────────────────
✓ IDP configuration is valid
  2 IDP-enabled CRD(s)

ork idp schema

Show the flat schema for an IDP target.

This displays the fields that callers can submit for a target, including their labels, types, enums, and paths. The output is the same flat field structure returned by the gateway’s GET /api/v1/schema?target=<t> endpoint.

ork idp schema [flags]

Flags

FlagShortDescription
--target-tTarget to show schema for
--kind-kKind to show schema for
--name-nCRD name to show schema for

One of --target, --kind, or --name is required.

Examples

# Show schema by target
ork idp schema --target smartapp

# Show schema by kind
ork idp schema --kind AppRequest

# Show schema by CRD name
ork idp schema --name application

Output

Schema for: application (target: smartapp)
──────────────────────────────────────────────────────────────────────
FIELD           LABEL            TYPE    PATH                    REQUIRED
repository      Repository       string  app.repository          ✓
image           Container Image  string  app.image               ✓
cpu             CPU Request      string  app.resources.cpu
replicas        Replicas         integer scaling.replicas

ork idp fields

List IDP fields with their paths and types.

This shows fields declared in idp.fields and idp.additionalFields across all IDP-enabled CRDs. With --target, --kind, or --name, shows fields for a specific CRD.

ork idp fields

Flags

FlagShortDescription
--target-tTarget to show fields for
--kind-kKind to show fields for
--name-nCRD name to show fields for
--sort-bySort fields by "name" (default) or "order"

Examples

# List all fields across all CRDs
ork idp fields

# List fields for a specific target
ork idp fields --target smartapp

# List fields for a specific kind
ork idp fields --kind AppRequest

# List fields for a specific CRD name
ork idp fields --name application

# Sort fields by order (as declared in the Katalog)
ork idp fields --target smartapp --sort-by order

Output (All fields)

IDP Fields
──────────────────────────────────────────────────────────────────────

CRD: application (target: smartapp)
  FIELD           TYPE    PATH                    SOURCE
  cpu             string  app.resources.cpu       spec
  environment     string                          label
  image           string  app.image               spec
  repository      string  app.repository          spec
  team            string                          label

Total: 5 fields across 1 CRD

Output (Specific CRD)

Fields for: application (target: smartapp)
──────────────────────────────────────────────────────────────────────
FIELD           TYPE    PATH                    SOURCE      REQUIRED
cpu             string  app.resources.cpu       spec
environment     string                          label
image           string  app.image               spec        ✓
repository      string  app.repository          spec        ✓
team            string                          label       ✓

Output (Sorted by order)

Fields for: application (target: smartapp)
──────────────────────────────────────────────────────────────────────
FIELD           TYPE    PATH                    SOURCE      REQUIRED  ORDER
repository      string  app.repository          spec        ✓         1
image           string  app.image               spec        ✓         2
team            string                          label       ✓         3
cpu             string  app.resources.cpu       spec                  4
environment     string                          label                 5

ork idp tokens

Show token permissions for an IDP-enabled CRD.

This displays the allowedTokens configuration, including which tokens have access, their permissions (../global/schema/resources), and namespace restrictions.

ork idp tokens [flags]

Flags

FlagShortDescription
--target-tTarget to show tokens for
--kind-kKind to show tokens for
--name-nCRD name to show tokens for

One of --target, --kind, or --name is required.

Examples

# Show tokens by target
ork idp tokens --target smartapp

Output

Token permissions for CRD: application (target: smartapp)
──────────────────────────────────────────────────────────────────────
TOKEN            GLOBAL  SCHEMA  RESOURCES           NAMESPACES
control-center   *       *       *                   *
ci-pipeline              get,list create,update,get,list staging
monitoring               get,list get,list           *

ork idp targets

List all IDP-enabled targets in a Katalog.

This shows each target, its CRD kind, and whether it has fields defined.

ork idp targets

Examples

# List all targets
ork idp targets

Output

IDP Targets
──────────────────────────────────────────────────────────────────────
TARGET      KIND        FIELDS  TOKENS
smartapp    AppRequest  12      yes
database    Database    8       no

2 target(s)

ork idp can-i

Check if a token can perform an operation.

This evaluates the same permission checks that the gateway applies to incoming Apply API requests. It considers token existence, permissions (global/schema/resources scopes), namespace restrictions, and target existence.

ork idp can-i [flags]

Flags

FlagShortDescription
--token-TToken name to check (required)
--target-tTarget to check
--kind-kKind to check
--name-nCRD name to check
--operation-oOperation to check (required)
--namespace-NNamespace to check (default: all namespaces)
--class-cEndpoint class to check (resources, schema)

One of --target, --kind, or --name is required.

Examples

# Check if token can create
ork idp can-i --token control-center --target smartapp --operation create

# Check if token can delete in a namespace
ork idp can-i --token ci-pipeline --target smartapp --operation delete --namespace staging

# Check if token can list
ork idp can-i --token monitoring --target smartapp --operation list

Output (Allowed)

✓ control-center can create on "smartapp"

Output (Denied)

✗ ci-pipeline cannot delete on "smartapp" in namespace "staging"
  Reason: token "ci-pipeline" does not have "delete" permission for resources class
  Available: 
    - schema:    get
    - resources: create,update,list,get

ork idp response

Show the IDP response configuration.

This displays what callers will see in the Apply API response based on idp.config.response. It shows default: true/false, payload fields (with their template expressions), excluded paths, and poll URL configuration.

No cluster access is required — this reads the Katalog directly.

ork idp response [flags]

Flags

FlagShortDescription
--target-tTarget to show response for
--kind-kKind to show response for
--name-nCRD name to show response for
--preview-pShow a sample response preview

One of --target, --kind, or --name is required.

Examples

# Show response config
ork idp response --target smartapp

# Show response config with preview
ork idp response --target smartapp --preview

Output

Response configuration for: application (target: smartapp)
──────────────────────────────────────────────────────────────────────

default: true

Payload fields:
  FIELD         EXPRESSION
  phase         '{{ .status.phase }}'
  serviceURL    '{{ serviceURL }}'
  queueDepth    '{{ .external.queueDepth.value | default 0 }}'
  nextSteps     '{{ nextSteps }}'

Excluded paths:
  ✗ metadata.managedFields
  ✗ status.observedGeneration
  ✗ metadata.name

Poll URL:
  url:   "{{ devServerURL }}"
  field: "status.phase"

With --preview

──────────────────────────────────────────────────────────────────────

Response preview (templates shown as-is, not resolved):

{
  "phase": "{{ .status.phase }}",
  "serviceURL": "{{ serviceURL }}",
  "queueDepth": "{{ .external.queueDepth.value | default 0 }}",
  "nextSteps": "{{ nextSteps }}"
}

Excluded fields:
  ✗ metadata.managedFields
  ✗ status.observedGeneration
  ✗ metadata.name