What is WEB-CLI; which command branches does it offer?

Short answer

WEB-CLI is an in-browser terminal that is opened with the WEB-CLI button at the bottom right corner of the panel; it gives command line access without connecting to the device separately over SSH. It offers a hierarchical command tree with Tab autocompletion; the same commands can also be reached by connecting to the device over SSH. There are three command branches: the API commands list, display, add, update and delete the resources (lb, waf, ags, gtm, network, settings…), that is, they are the command equivalent of the work the panel does; the system commands run network and diagnostic tools such as ping, dig, tcpdump and curl with sys-cmd on the route table selected in the title bar and are open only to users of the Admin type; the pipe commands process the output with filters such as grep, jq and to-file. The WEB-CLI button is visible only if the Access CLI over WEB option of the user is on.

Where It Is Used in TR7

Where	Field / label	What for
Bottom right corner of the panel	WEB-CLI button (terminal window)	Opening and hiding the terminal; hiding it does not close the session
Title bar of the TR7 WEB-CLI window	Route table indicator with the gear icon (terminal window)	Selecting the route table on which the sys-cmd commands run; the selection is saved to the user account
Settings → User Management → Device Users → user form	Access CLI over WEB	The WEB-CLI button being visible; it is on by default for a new user
The same form	Access CLI over SSH	Access to the same commands over SSH; it is an option independent of WEB-CLI

Command Branches

Branch	What it does	Who uses it
API commands	Lists, displays, adds, updates and deletes the resources (lb, waf, ags, gtm, network, settings, users…)	Each branch opens according to the permission of the user in that area (permission: the role scope)
System commands (sys-cmd)	Network and diagnostic tools such as ping, dig, tcpdump, curl, ss and traceroute	Only users of the Admin type
Pipe commands	Filters or transforms the command output, or writes it to a temporary file; at most 8 filters in a single line	On the output of the API and system commands

Examples:

lb service list
sys-cmd ping -c 4 192.0.2.10
lb service list | grep web

The grouping of the Load Balancer commands and the scope of WEB-CLI in the WAF are explained on separate pages: How are the lb commands grouped in the Web CLI (service, backend, backend-group, hc, certificate, ...)? · Can I manage the WAF with WEB-CLI; which operations are not available in WEB-CLI?. The field-by-field breakdown of the command tree is in the REST API documentation.

Common Misconceptions

• "WEB-CLI and SSH offer different commands." Both use the same command tree; the session limits (2 sessions per user, 15 sessions per device) are also common to both (sessions and limits).
• "SSH access must be turned on for WEB-CLI." For WEB-CLI, Access CLI over WEB alone is enough; Access CLI over SSH is a separate access path.
• "Every user can run the system commands." sys-cmd is only for users of the Admin type; the other commands open according to the area permissions of the user, and a command outside the permissions does not run.

How it is done in the documentation

• WEB-CLI
• WEB-CLI · The Three Command Branches
• WEB-CLI · Access and Permissions
• Device Users · Access CLI over WEB

Related questions

• Can I manage the Load Balancer configuration via CLI or API?
• How are the lb commands grouped in the Web CLI (service, backend, backend-group, hc, certificate, ...)?
• Can I manage the WAF with WEB-CLI; which operations are not available in WEB-CLI?
• What is a REST API; what does it offer for managing TR7 programmatically?