Release notes

administrative API CORS settings

audit log settings

authentication policies settings

bulk configuration export

bulk configuration import

CA certificates

CAPTCHA provider settings

CAPTCHA providers

certificate group certificates

cluster settings

config store settings

log settings

OAuth access token manager settings

OAuth access token managers

OAuth authorization detail types

OAuth virtual issuers

signing key pairs

SP adapters

SP connections, including credentials certificates, decryption keys, and signing settings

SP IdP connections, including certificates, decryption keys, and signing settings

SSL client key pairs

Added read-only commands for captcha provider descriptors

Added import, export, CSR, and rotation settings management commands for signing key pairs

Authorize application resources

bill of materials

branding settings

certificates

credential type versions

forms

gateway role assignments

language localization status

notifications settings phone delivery settings

notifications settings SMTP email delivery configuration

organizations, license names, and license active identity counts

population default identity provider

resource attributes

resource client secrets

trusted email addresses

user enabled status

Added read commands for flow policies

Updated polymorphic resources like applications to accept the same JSON shape as that returned by the API from GET calls, rather than a shape that is custom to the CLI. The prior template shape is deprecated. The template command for these resources now supports a --template-type flag to retrieve a template for the desired type (for example: oidc, saml, etc. for applications). If not provided, --template-type will be set to a default for the resource (oidc for applications).

flow versions

Added enable and disable action commands for flows

Added clone action for connector instances

Added DaVinci flow-policy/flow-policy-events list command

Added CLI flags for common request body fields

Added send-logs and update-nickname action commands to mfa user-devices

Added CLI flags for common request body fields

Removed the --template output flag and its custom text/template rendering

Fix some API error detail not being returned by the CLI for PingOne Authorize and PingOne Verify endpoints.

Add support for the apply command to all singleton resources as an alias for replace. Also add apply to the PingFederate data-stores and PingOne application-resource-permissions resources where it was missing.

Renamed several nested subcommands to drop the redundant parent prefix (for example, group group-nestings is now group nestings, verify verify-policies is now verify policies, etc), while keeping the previous names available as aliases

authentication policy fragments

federation info

OAuth client registration policies

OAuth client settings

OAuth/OpenID Connect policies

OAuth/OpenID Connect settings

session quotas

session settings

alert channels

credential issuance rule usage counts and usage details

email domains

identity propagation plans

images

integrations

rate limit IP configurations

reCAPTCHA v2 configuration

Added gateways gateway-credentials get command to read a single gateway credential

Added a list command for resource application permissions

Added notifications-settings management commands

Added pingone applications attribute-mappings management commands

Failing paged export read operations now attach the HTTP response so --debug renders the response body and JSON error output reports the failing request’s status and request ID

Added credential-issuer-profile resource to the PingOne Credentials connector, supporting get, replace, and template commands

auth: Added a connector section header to each auth status block so statuses for multiple services are clearly distinguishable

Fixed template command example text for replace-only resources to show replace --from-file instead of create --from-file

Updated output schema reference generator with editorial fixes and subfolder restructure

administrative accounts

authentication API applications

authentication API settings

data stores

extended properties

IdP adapters

local identity profiles

OAuth clients

password credential validators

server settings

virtual host names

Removed the --pingfederate-* and --as-pingfederate-* authentication CLI flags (such as --pingfederate-client-id); configure PingFederate authentication via environment variables, the configuration file, or the init wizard instead

The accessTokenAuth authentication type is deprecated and will be removed in a future release; use the basicAuth or oauth authentication type instead

Added management command for version

admin config

credential issuance rules

custom domains

FIDO2 policies

user digital wallets

Fixed the --template flag on pingone api so template field traversal works against JSON response data

Fixed template for application resources to correctly omit server-set read-only fields (apiKey.value, oauth.clientSecret) that were previously included in the generated template skeleton

decision endpoints

risk policy sets

Both PINGCLI_PINGONE_* and bare PINGONE_* environment variable names are now fully supported (e.g. both PINGCLI_PINGONE_ENVIRONMENT_ID and PINGONE_ENVIRONMENT_ID resolve), fixing a silent breaking change for pipelines using the pre-v1 names. PINGCLI_LOGIN_STORAGE_TYPE is honoured alongside PINGCLI_AUTH_STORAGE_TYPE.

Config migration now correctly relocates PingFederate clientCredentialsAuth credentials (client ID, client secret, token URL, scopes) to the canonical oauth.clientCredentials.* keys and removes the legacy subtree, including for configs written all-lowercase by older (v0.8.x) Ping CLI versions, which were previously left untouched.

Config migration now preserves PingOne authentication values written by older (v0.8.x) Ping CLI versions: the legacy service.pingone.* worker layout (worker client credentials, regioncode, type: worker) is migrated to the current service.pingOne.* schema instead of being silently dropped, with regioncode translated to the equivalent endpoint.rootDomain. The PingOne environment ID and authorization-code redirectUri path/port are also relocated to their canonical keys rather than being lost.

Config migration now removes the deprecated export.* configuration subtree, which is no longer persisted to the configuration file (the export command’s settings are flag/environment-only).

1.0

0.8