Skip to content

Command line

The databaas command signs you in for local use and deploys DAGs from CI. See Laptop login and Deploying DAGs for the walkthroughs.

databaas login [URL] [--client-id ID] [--project-id ID] [--profile NAME]
               [--issuer URL] [--catalog-url URL] [--warehouse NAME]
               [--region NAME] [--device]
databaas logout [--profile NAME] [--all]
databaas whoami [--profile NAME]
databaas token [--profile NAME]
databaas profile list
databaas profile use NAME
databaas profile delete NAME
databaas dag validate [-t TARGET] [--dev-key KEY] [--config PATH] [-v]
databaas dag deploy [-t TARGET] [--dev-key KEY] [--dry-run] [-v]
                    [--config PATH] [--bucket NAME] [--endpoint-url URL]
databaas dag destroy [-t TARGET] [--dev-key KEY] [--force]
                     [--config PATH] [--bucket NAME] [--endpoint-url URL]
Command Does
login Sign in and save the profile. See login below.
logout Revoke and forget the session. --all covers every profile.
whoami Show the signed-in email and Lakekeeper user id.
token Print a fresh access token, e.g. for curl or DuckDB.
profile list List saved profiles.
profile use NAME Make a profile the default.
profile delete NAME Log out and remove the profile and its keychain entry from this machine.
dag validate Parse the target's DAGs with Airflow, as they would be deployed. Needs Airflow installed, no key.
dag deploy Upload artifacts.dags from databaas.yml to the target's prefix in the DAG bucket. --dry-run only lists the changes.
dag destroy Delete a target's prefix. Production needs --force.

dag deploy and dag destroy need the environment's DAG deployment key in AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, and no login. See Deploying DAGs.

Errors print as error: ... on stderr and exit with status 1.

login

databaas login https://<your-databaas-domain>

URL is the address you open the portal on. Everything else is derived from it, so the flags are only needed for an environment set up differently. See Laptop login for the walkthrough.

Flag Default Use it to
--profile first part of the domain Name the saved profile, for example acme-prod
--client-id read from the portal Sign in when the portal does not serve its client id
--issuer https://auth.<host> Use another Zitadel address
--catalog-url https://catalog.<host> Use another catalog address
--warehouse databaas-lakehouse Use another warehouse
--project-id none Add another Zitadel project to the token's audience
--region nl-ams Use another storage region
--device off Sign in with a device code; the provisioned Zitadel app does not support this

Without a URL, pass --issuer, --client-id and --catalog-url yourself.