CLI

parity is a single static binary. Commands that talk to Parity read PARITY_API (set it to https://api.parity.ninja; there is no default) and PARITY_TOKEN, print JSON on stdout and progress on stderr, and exit non-zero on failure. Commands that take a sandbox default to the one named after your git branch; --sandbox picks another.

parity approve

Approve a block step that waits: a release's, or a rollout's in an environment.

parity approve <step> [--release N | --env <environment>]

approve decides a block step. Without --env, a block of a release (release.steps): the newest release waiting at that step, or --release N. With --env, a block job of the environment's current rollout (jobs: with block:). It prints the step's prompt and asks you to confirm, unless --yes. Approve lets the steps after it run; reject ends the release (or fails the rollout). Only people decide: a sandbox token or an agent can't.

parity auth

Manage the users of a sandbox's auth resource and mint sign-in links.

parity auth user

Create, list, update and delete users.

parity auth user create

Create a user (email verified, no MFA); prints {id, email, password, orgs}.

parity auth user create <email>

Create a user. The email is verified and there is no MFA. Without --password, one is generated and printed once.

Give memberships as pairs: --org acme --role admin --org beta --role viewer. An --org without its --role gets the role "member".

parity auth user delete

Delete a user and revoke its tokens.

parity auth user delete <email|id>

parity auth user get

Show one user.

parity auth user get <email|id>

parity auth user list

List users.

parity auth user list

parity auth user update

Change a user's email, password or memberships.

parity auth user update <email|id>

Change a user. Only the flags given change. --org and --role replace the whole membership list; --no-orgs clears it. --password "" generates a new password and prints it.

parity check

Check parity.yaml and show what each service gets (no cluster needed)

parity check

check reads parity.yaml, reports every problem it finds at once, and prints what the platform will run: each service's image, port and public URL, every env variable with where its value comes from (including the PORT and the standard variables that depends_on adds), and when each job runs. It needs no cluster and no images. It exits 1 when the manifest has a problem.

With --env staging or --env production, it prints what that environment runs: the base with environments.<name> merged in, each value the environment sets marked (environments.<name>).

A manifest may include other files (include:). check then cites every problem as file:line, names the file each entry comes from, and warns about each parity.yaml or *.parity.yaml under the root's directory that nothing includes. --merged prints the one merged manifest that parity up and promote send, each entry marked with the file and line it comes from.

parity down

Delete a sandbox and everything in it.

parity down

parity environments

List the project's environments, or show one with its steps.

parity environments [environment]

environments lists the environments the project's manifest declares: where each takes its builds from, whether it is frozen, its current rollout and status, and the block steps waiting for a person, with their prompts. With an environment, it shows that one in full (services, steps, conditions).

parity exec

Run a command in a service or resource and print its output.

parity exec <service> -- <command>...

exec runs a command in a running container of a service or resource (such as psql in db) and prints its stdout and stderr; parity exits with the command's exit code. --json prints {exit_code, stdout, stderr} instead.

parity freeze

Hold deploys to an environment, with a note; no argument lists the freezes.

parity freeze [staging|production]

freeze holds deploys to staging or production until someone runs parity unfreeze or the freeze reaches --for or --until. A deploy it stops (parity promote, the console's Promote) fails with the note, who set it and when. Rollback is never frozen. Freezing again replaces the note.

With no environment, freeze prints the project's freezes. Setting and lifting needs a project token with environments.deploy; a sandbox token can read them but not change them.

parity import

Start a parity.yaml from another app format.

parity import score

Write a parity.yaml from Score workload files (score.dev/v1b1)

parity import score [file or dir]...

import score reads Score workload files (one workload per file; a directory means every score*.yaml under it) and writes a parity.yaml: each workload is a service, postgres, redis and s3 resources are managed entries, route is expose, and ${resources.<r>.<output>} placeholders become ${<entry>.<attr>}. What it can't map is printed on stderr, then the result is checked as parity check would. Without --out it prints the manifest on stdout.

parity inbox

Read the sandbox's email.

parity inbox attachment

List a message's attachments, or download one (-o file, - for stdout)

parity inbox attachment <msg> [part-or-name]

parity inbox list

List messages, newest first, with their links, codes and attachments.

parity inbox list

parity inbox read

Read one message: text, links, codes, attachments (--html for the HTML part)

parity inbox read <msg>

parity inbox wait

Wait for a message and print it (--none: assert that none arrives)

parity inbox wait

wait prints the first message that matches, as soon as there is one.

Without --after it is the newest match, which may have arrived before the wait. With --after <id|now> it is the oldest match received after that message: chain waits with --after set to the last message's id to see each message once.

--none asserts the opposite: that no match arrives after the cursor (default now) for --timeout. It prints {"none": true, ...} with the window and exits 0, or prints the message that came and exits 1. The calls are in calls.jsonl, so the proof holds the negative evidence.

Each API call waits at most about 50 s; parity calls again, after Retry-After, until --timeout.

parity logs

Print logs of a service, a job, or the whole sandbox.

parity logs [service|job]

parity mcp

Serve the Parity MCP tools on stdin and stdout, for a local agent (needs PARITY_API and PARITY_TOKEN)

parity mcp

mcp serves the sandbox tools (sandbox_status, auth_user_create, inbox_wait, job_run, sandbox_logs, sandbox_exec, proof_add, proof_export, ...) over MCP's stdio transport. Every call goes to Parity's API at PARITY_API with PARITY_TOKEN, so the agent can do exactly what its token allows. Register it with an agent, for example: claude mcp add parity -e PARITY_API=... -e PARITY_TOKEN=pst_... -- parity mcp

parity open

Print the app's URL (with --browser, open it)

parity open

parity promote

Make this manifest the project's current one, which staging and production follow.

parity promote [environment]

promote makes this parity.yaml the project's current manifest, which staging and production will follow, and keeps it as a revision. Sandboxes don't follow it: each pins the manifest it was created from, so promoting never changes a running sandbox. Prints {project, generation, revision}. It needs a project token; a sandbox token can't promote. While production is frozen (parity freeze) it is refused with the freeze's note.

With an environment, promote ships a release's build into it by hand, outside the release's steps: the newest release, or --release N. It is how a hotfix skips a step, and how an environment a rollback pinned is unpinned. It asks you to confirm, unless --yes.

parity proof

Attach evidence to the sandbox's proof bundle, and export it (needs PARITY_API)

parity proof add

Attach files (screenshots, test output) with a note, in one call.

parity proof add <file|dir>...

add attaches files to the proof bundle, in one call: each file, and the files directly in each directory given (not hidden ones, not subdirectories). The note is every file's note. Parity records each file's content type, from its extension or its first bytes.

parity proof export

Export the proof bundle as a zip.

parity proof export

parity proof verify

Check that a proof bundle was signed by Parity and not changed since.

parity proof verify <proof.zip>

verify checks signature.json: the ed25519 signature over the manifest of every file in the zip, then each file's size and SHA-256. Any edited, added or removed file fails it.

Offline, pass the public key with --key (a file or text holding the JSON of GET /v0/keys, or one base64 key). Online, with PARITY_API set, the keys come from Parity's GET /v0/keys, and with PARITY_TOKEN too, Parity is asked whether it holds this very bundle. parity exits 1 when the bundle fails.

parity reject

Reject a block step that waits: a release's, or a rollout's in an environment.

parity reject <step> [--release N | --env <environment>]

reject decides a block step. Without --env, a block of a release (release.steps): the newest release waiting at that step, or --release N. With --env, a block job of the environment's current rollout (jobs: with block:). It prints the step's prompt and asks you to confirm, unless --yes. Approve lets the steps after it run; reject ends the release (or fails the rollout). Only people decide: a sandbox token or an agent can't.

parity releases

List the project's releases, or show one with its steps.

parity releases [number]

releases lists the project's releases, newest first: each is one build moving through the manifest's release steps (promote, block, wait, run, group), with where it is and what it waits for. With a number, it shows that release's steps in full: each promote's environments, each block's prompt and decisions, each wait's end.

parity render

Print a sandbox's Kubernetes objects as multi-document YAML, by phase.

parity render

render prints the Kubernetes objects Parity would apply for one sandbox, in three phases, each introduced by a "# phase: N" comment:

1 namespace, network policy, secrets and managed services 2 deploy jobs, then seed jobs, then start jobs, in order 3 services and public routes

Nothing is applied. Generated values are kept in --seed-file when given, so re-renders keep them. With --env staging or --env production, it prints what that environment would run.

parity retry

Roll out an environment's current build again (after a failure, reject or timeout)

parity retry <environment>

parity rollback

Roll an environment back to a build it ran before.

parity rollback <environment>

rollback makes the environment run one of its last 5 builds again: the previous one, or --to a commit or App revision. Its block steps pass (the build passed them before), and it is never frozen. A branch environment stays there, pinned, until someone promotes it: releases hold their promotes into it meanwhile. It asks to confirm, unless --yes.

parity run

Run a manifest job now and wait for it.

parity run <job>

run starts one of the manifest's jobs now, from the manifest revision the sandbox pins, waits for it, and prints its status and log tail. This is how a schedule fires in a sandbox, where its CronJob is suspended.

parity sandbox

Inspect, list and extend sandboxes.

parity sandbox extend

Push a sandbox's expiry back, up to max_ttl.

parity sandbox extend <duration>

parity sandbox list

List sandboxes.

parity sandbox list

parity sandbox status

Print a sandbox's status as JSON.

parity sandbox status

parity scale

Set how many replicas a service runs in the sandbox (0 stops it)

parity scale <service> <replicas>

scale sets a service's replica count in the sandbox: 0 stops it, 1 is the manifest's default. It lasts for the sandbox's life and is not a rollout, so deploy jobs don't rerun. Use it to quiet a service whose process runs its own schedule (Plane's beat, say): the manifest's own { schedule } jobs are already suspended in sandboxes, and parity run <job> fires one.

parity signin

Mint a one-time sign-in link; prints {url, expires_at}.

parity signin <email|id>

Mint a one-time sign-in link for a user. Opening it in a browser signs the user in at the auth resource and starts the app's own OIDC login (its initiate_login_uri), so the app's callback runs and the app sets its own session. The link works once and expires after 15 minutes.

parity skip

Skip a step of a release (a block, a wait, a held promote), saying why.

parity skip <step> -m <reason> [--release N]

skip passes over a step of a release that hasn't finished: a block nobody will approve, a soak you don't need, a promote held by a freeze. The reason is kept in the release's record. A promote whose rollouts started can't be skipped: they finish. Without --release, the newest release at that step.

parity ui

Open the web console in your browser.

parity ui

parity unfreeze

Lift an environment's deploy freeze.

parity unfreeze <staging|production>

parity up

Create a sandbox, or bring an existing one up to date, and wait until it is ready.

parity up

up creates a sandbox from parity.yaml, or brings an existing one up to date, and waits until it is ready: managed services up, deploy, seed and start jobs done, services healthy. While it waits it prints what the sandbox is waiting for, such as an image being pulled or a job running. It stops early with the reason when something needs a change from you, such as an image that can't be pulled or a job that failed.

Rerunning it is safe: the sandbox keeps its generated values, its creation time and its token, a changed manifest rolls out, and a failed sandbox retries what failed. A job whose container never started is replaced by the new manifest's job.

In a git checkout the sandbox is named after the branch (feature/orders runs as feature-orders), and --ref and --commit default to the branch and HEAD. With a sandbox token, up updates that token's own sandbox.

While it waits, it prints each outbound call the sandbox blocked (a host missing from externals). When something is stuck: parity sandbox status shows each service's and job's state and reason and the blocked hosts (egress.blocked), and parity logs <service or job> shows its log, or why it has none yet.