Repository navigation
the cli cannot list an mssp's client tenants or iterate over them in a single command #54
Description
Measured
openapi/v1.jsonhas no operation that lists tenants.- Each credential covers a single tenant (
README.md:104-107), so reading a portfolio requires one session or key per client and a custom script.
Why it matters
MSSP: their main use case is seeing the posture of their whole portfolio. Today they have to sign in once per client and repeat each command per profile, which does not scale beyond a handful of clients.
Acceptance criteria
- A single MSSP credential (OAuth session or API key) is enough; no profile per client is required.
- There is a command that lists the client tenants the credential is authorized for.
- Read commands accept a client selection (one client, or all of them) and the output identifies the tenant on each row, in table form and with
--json. - Selecting a client the credential is not authorized for fails with a clear message and a non-zero exit code.
- It is documented in the MSSP guide (no guide for an MSSP reading several client tenants with the CLI #45).
Depends on
A change in the public /v1 API: a credential with portfolio scope, an operation that lists the authorized client tenants, and a way to select the client on data operations.
Activity
d0ubl3g commentedon Oct 12, 2026
Done in 0.4.0 (https://github.com/Hodeitek/hodeishield-cli/releases/tag/v0.4.0), by #134, on main at 3405f04.
hodeishield tenants listlists the client tenants the key may read.--tenant <slug|id>selects one client on any read command, and--all-tenantsreads every client on a list command, with the tenant on each row (TENANTcolumn;tenant_id,tenant_slug,tenant_namein--jsonand--csv).Tested against the live API with two client tenants of a test MSSP account: the output for one client equals what that client's own key returns, and data from another tenant is never shown.