Entropy Data CLI

The Entropy Data CLI is a command-line tool for interacting with the Entropy Data platform. It allows you to manage data products, data contracts, access agreements, teams, source systems, definitions, certifications, classifications, tags, assets, and more — directly from your terminal or CI/CD pipeline. The CLI is written in Python and can be used standalone or integrated into scripts and automation pipelines.

Installation

Requires Python 3.11 or newer.

Install with uv (recommended):

uv tool install entropy-data
entropy-data --help

Or with pip:

pip install entropy-data
entropy-data --help

Docker

docker run --rm entropydata/entropy-data-cli --help

Configuration

The CLI resolves credentials from four sources, in order of precedence:

CLI options (--api-key, --host)
The named connection selected with --connection
Environment variables or a .env file (ENTROPY_DATA_API_KEY, ENTROPY_DATA_HOST)
The default connection in ~/.entropy-data/config.toml

Note that an explicit --connection overrides environment variables, while the default connection only applies when neither CLI options nor environment variables supply a value. The API key and host are resolved independently, so you can, for example, set the host through ENTROPY_DATA_HOST and let the default connection supply the API key.

Connections

Generate an API key in the Entropy Data UI under organization settings, then add a connection:

entropy-data connection add prod
# prompts for API key and host

Connections are stored in ~/.entropy-data/config.toml:

default_connection_name = "prod"

[connections.prod]
api_key = "ed_abc123..."
host = "https://api.entropy-data.com"

[connections.dev]
api_key = "ed_xyz789..."
host = "https://localhost:8080"

Switch the active connection with --connection:

entropy-data --connection dev dataproducts list

Manage connections:

entropy-data connection list
entropy-data connection set-default prod
entropy-data connection test
entropy-data connection remove dev

Environment Variables

export ENTROPY_DATA_API_KEY="your-api-key"
export ENTROPY_DATA_HOST="https://app.entropy-data.com"

# Optional: verify TLS against the OS trust store instead of the bundled CA certificates
export ENTROPY_DATA_SYSTEM_TRUSTSTORE=1

# Optional: seconds to wait for each API response (default 30)
export ENTROPY_DATA_TIMEOUT=120

`.env` File Support

The CLI automatically loads a .env file from the current working directory:

.env

ENTROPY_DATA_API_KEY=your-api-key
ENTROPY_DATA_HOST=https://app.entropy-data.com

Values from .env do not override already-set environment variables.

CLI Options

entropy-data --api-key your-api-key --host https://app.entropy-data.com <command>

TLS behind a corporate proxy or internal CA

By default the CLI verifies TLS certificates against the CA certificates bundled with Python (certifi). In a corporate network with a TLS-inspecting proxy or an internal certificate authority, requests fail with CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate, because the root CA is installed in the operating system's trust store but not in the bundled list.

Pass the global --system-truststore option to verify against the operating system's trust store (macOS Keychain, the Windows certificate store, or the system CA certificates on Linux) instead:

entropy-data --system-truststore datacontracts list

To enable it for every invocation, set the environment variable:

export ENTROPY_DATA_SYSTEM_TRUSTSTORE=1

This keeps certificate verification switched on while trusting your corporate root CA, and applies to every command that makes HTTPS requests.

Request timeouts

Each API request waits 30 seconds for a response by default; some commands wait longer by themselves (datacontracts test, datacontracts generate). A large document, such as a semantic ontology with a thousand concepts, can take the server longer than that. The global --timeout option sets the wait for every request of the invocation, and overrides the longer waits those commands choose for themselves:

entropy-data --timeout 120 semantics branches put sales add-credit-limit --file ontology.yaml

To raise it for every invocation, set ENTROPY_DATA_TIMEOUT instead.

Usage

Explore your data platform

# List teams
entropy-data teams list

# Get a specific data product
entropy-data dataproducts get my-data-product

# List data contracts as JSON
entropy-data datacontracts list --output json

Manage resources

# Create or update a team from a YAML file
entropy-data teams put marketing --file team.yaml

# Approve an access agreement
entropy-data access approve 640864de-83d4-4619-afba-ccea8037ed3a

# Search across all resources
entropy-data search query "customer orders"

Data contract branches

Draft a change to a data contract on a branch, review and test it there, and land it on the contract when it is ready. The branch's ODCS document is read and written as YAML, byte for byte, so the author's formatting survives the round trip.

# Cut a branch and replace its document
entropy-data datacontracts branches create orders add-status
entropy-data datacontracts branches put orders add-status --file orders.yaml

# What the branch changes against main, element by element
entropy-data datacontracts branches changes orders add-status

# Test the branch's document instead of the contract's
entropy-data datacontracts test orders --branch add-status

# Land the branch with the version the data contract gets
entropy-data datacontracts branches merge orders add-status --version 1.1.0

merge lands the branch, or — where the data contract's git branch only takes reviewed changes — prints the pull request opened from it and leaves the branch open; --route land|pull_request picks the route where both are open. --update-ports also sets the landed version on the output ports implementing the data contract; it is off by default, because those ports belong to other data products.

datacontracts yaml and datacontracts generate take --branch as well, and test-results publish --data-contract-id <id> --branch <branch> publishes a run onto a branch, which test-results list --branch narrows to.

Semantic namespace branches

The same for a branch of a semantic namespace, where put replaces the branch with an OSI ontology YAML document and changes lists what it changes, one entry per concept.

entropy-data semantics branches create sales add-credit-limit
entropy-data semantics branches put sales add-credit-limit --file ontology.yaml
entropy-data semantics branches changes sales add-credit-limit
entropy-data semantics branches merge sales add-credit-limit

Classifications

Manage classification schemes and their levels. The argument is the scheme's external ID (for example classification).

# List all classification schemes
entropy-data classifications list

# Get one scheme with its levels
entropy-data classifications get confidentiality --output yaml

# Create or update a scheme from a file
entropy-data classifications put confidentiality --file confidentiality.yaml

# Delete a scheme
entropy-data classifications delete confidentiality

Star data products

Stars let users bookmark the data products they care about. Starring requires a user-scoped API key, because a star belongs to the user behind the key.

# Star and unstar a data product
entropy-data dataproducts star my-data-product
entropy-data dataproducts unstar my-data-product

# Show the star count and whether you starred it
entropy-data dataproducts star-status my-data-product

# List the users who starred it (organization owners only)
entropy-data dataproducts stargazers my-data-product --output json

API keys

Create a team-scoped API key carrying only the permissions a pipeline needs. Without --permission or --read-only the key carries everything your own key holds on the team.

# A key that may only write data products and data contracts
entropy-data api-keys create --team-id checkout --display-name ci-pipeline \
  --permission DATAPRODUCT_EDIT --permission DATACONTRACT_EDIT

# A key that reads what the team sees and changes nothing
entropy-data api-keys create --team-id checkout --read-only

--permission takes a permission name as shown on the roles page and can be repeated; --read-only creates a key with an empty permission list. The two exclude each other, and --scope defaults to team.

Team roles

Read and write the organization's team roles configuration. The configuration is a single resource carrying both the mode and the role catalog.

# Show the current mode and roles
entropy-data settings team-roles get

Switch back to the built-in roles with {"mode": "default"}, or supply a custom catalog. With custom-team-roles the roles you list replace the entire catalog, and an empty list is rejected with a 409 so you cannot lock yourself out.

team-roles.yaml

mode: "custom-team-roles"
team-roles:
  - name: "Data Steward"
    rank: 20
    permissions:
      - "DATAPRODUCT_EDIT"
      - "DATACONTRACT_EDIT"
      - "DATAPRODUCT_CHANGE_REQUEST_SUBMIT"
      - "DATACONTRACT_CHANGE_REQUEST_SUBMIT"

entropy-data settings team-roles put --file team-roles.yaml

Email templates

Read and write the organization's email templates as one document: every email type with its enabled state and the effective subject and body per language, each marked as built-in or customized.

entropy-data settings email-templates get --output yaml > email-templates.yaml
# edit the wording, then
entropy-data settings email-templates put --file email-templates.yaml

put replaces the whole setup — types and languages you leave out revert to the built-in email, and wording identical to the built-in text stays uncustomized, so a get written back unchanged customizes nothing.

Integration runs

# Trigger a run and wait for it to finish
entropy-data integrations run snowflake-prod --wait

# Fetch the most recent run for an integration
entropy-data integrations runs-latest snowflake-prod

Integrations are addressed by external ID or display name.

Schemas

Fetch the JSON Schemas that data contracts (ODCS) and data products (ODPS) validate against. By default the current base schema is printed raw to stdout so redirects and piping stay byte-faithful.

# Print the current ODCS schema
entropy-data schemas get odcs

# Compose the organization's customization overlay onto the base ODPS schema
entropy-data schemas get odps --custom

# Pin a specification version and write to a file
entropy-data schemas get odcs --version 3.1.0 --file odcs-3.1.0.schema.json

Sync environments between instances

Promote the portable organization state (teams, policies, data contracts, data products, assets, the semantics graph, and more) from one instance to another — for example test to prod. sync exports the source and applies it to the target in one idempotent step; export dir + apply dir do the same in two reviewable steps (apply dir works like kubectl apply -f <dir>). sync copies nothing by default — name the resources with --include.

# Preview a test -> prod sync without writing anything
entropy-data sync --source test --target prod --include datacontracts,dataproducts --dry-run

# Promote the selected resources test -> prod
entropy-data sync --source test --target prod --include datacontracts,dataproducts

See Sync Environments for the full walkthrough, the list of what is and isn't copied, the directory (folder-as-kind) layout, and the --prune mirror mode.

Commands

entropy-data [--version|-v] [--connection|-c NAME] [--api-key KEY] [--host URL]
             [--output|-o table|json|yaml] [--system-truststore] [--timeout SECONDS] [--debug]

  connection      list | get | add | remove | set-default | test
  dataproducts    list | get | put | delete | import-from-git | gitconnection ...
                  star | unstar | star-status | stargazers
  datacontracts   list | get | put | test | delete | yaml | generate | import-from-git | gitconnection ...
                  branches list | create | get | put | yaml | changes | rebase | merge | delete
  access          list | get | put | delete | approve | reject | cancel | request
  teams           list | get | put | delete | git-credentials ... | notifications ...
  sourcesystems   list | get | put | delete
  definitions     list | get | put | delete
  certifications  list | get | put | delete
  classifications list | get | put | delete
  policies        list | get | put | delete
  example-data    list | get | put | delete
  test-results    list | get | publish | delete
  costs           list | add | delete
  assets          list | get | put | delete | tags ...
  tags            list | get | put | delete
  api-keys        create | delete
  connectors      list | get | put | delete
  integrations    list | get | runs | runs-get | runs-latest | run | cancel
  organization    get | members ... | git-credentials ...
  settings        get-customization | put-customization | get-scim-mapping | put-scim-mapping
                  team-roles ... | email-templates ...
  events          poll
  lineage         list | submit | delete
  schemas         get
  search          query
  semantics       namespaces ... | concepts ... | relationships ... | search
                  branches list | create | get | put | yaml | changes | rebase | merge | delete
  usage           list | submit | delete
  export          dir
  apply           dir [--include] [--exclude] [--prune] [--dry-run]
  import          zip
  sync            --source SRC --target TGT --include a,b [--exclude] [--prune] [--dry-run] [--keep DIR]