Command Line Interface (CLI)

The ZTLayer CLI is a powerful tool designed for developers and DevOps engineers. It allows you to manage Zero Trust security policies, deploy edge functions, and tail Web Application Firewall (WAF) logs directly from your terminal.

The CLI is heavily optimized for integration into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins) enabling Infrastructure as Code (IaC) workflows for your security posture.

Installation

The CLI is distributed as a global npm package.

npm install -g @ztlayer/cli
# or using yarn
yarn global add @ztlayer/cli
# or using bun
bun add -g @ztlayer/cli

Verify the installation:

ztlayer --version
# Output: @ztlayer/cli v1.4.2

Authentication

Before running commands, you must authenticate the CLI. There are two ways to do this:

Interactive Login (Local Development)

Run the login command to open a browser window and authorize your local machine.

ztlayer login

Headless Login (CI/CD)

For automated environments, generate a Personal Access Token (PAT) from the ZTLayer Dashboard (Settings > API Keys) and provide it via a flag or environment variable.

# Using a flag
ztlayer login --token $ZTLAYER_PAT
 
# Or implicitly via Environment Variable (Recommended for CI)
export ZTLAYER_TOKEN="zt_live_1234567890abcdef"

Core Commands

ztlayer init

Initializes a new ZTLayer configuration file (ztlayer.yaml) in your current directory. This file serves as the single source of truth for your routing and firewall rules.

ztlayer init --project "prod-api"

ztlayer rules sync

Synchronize your local ztlayer.yaml ruleset to the ZTLayer edge network. Changes propagate globally in under 5 seconds.

# Sync to production
ztlayer rules sync --env production
 
# Preview changes without deploying (Dry Run)
ztlayer rules sync --env production --dry-run

ztlayer logs tail

Stream live WAF and traffic logs directly to your terminal. This is invaluable for debugging false positives or monitoring an active attack.

# Tail all logs for a specific project
ztlayer logs tail --project prod-api
 
# Filter logs by action (e.g., only blocked requests)
ztlayer logs tail --project prod-api --filter "action=blocked"
 
# Filter by specific threat type
ztlayer logs tail --project prod-api --filter "threat=sqli"

ztlayer cache purge

If you are using ZTLayer's Edge Caching in tandem with security rules, you can invalidate the cache globally.

ztlayer cache purge --url "https://api.example.com/v1/products"

CI/CD Pipeline Example (GitHub Actions)

You can manage your security rulesets exactly like you manage application code. Here is an example of syncing rules automatically when code is merged to the main branch.

name: Deploy Security Rules
 
on:
  push:
    branches:
      - main
    paths:
      - 'ztlayer.yaml'
 
jobs:
  deploy-waf:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
          
      - name: Install ZTLayer CLI
        run: npm install -g @ztlayer/cli
        
      - name: Sync Rules to Edge
        run: ztlayer rules sync --env production
        env:
          ZTLAYER_TOKEN: ${{ secrets.ZTLAYER_PRODUCTION_TOKEN }}

Next Steps

• API Reference: Automate everything you can do in the CLI via our REST API.
• SDK Integration: Install the runtime middleware for your specific framework.