Platform
Use the Harness CLI to manage the Harness Platform module, including organizations, projects, users, roles, connectors, secrets, delegates, OPA governance policies, and audit events.
The Platform module manages the foundational resources in your Harness account, including the organization-project hierarchy, RBAC, connectors, secrets, delegates, governance policies, and audit data. Most other Harness modules depend on these resources being configured correctly.
What you will learn in this topic
By the end of this page, you will know how to:
List and inspect organizations, projects, and the account itself.
View users, user groups, roles, and role assignments across scopes.
Create, update, and delete connectors and secrets.
Manage delegates and delegate tokens.
Work with multi-level resources using the
--levelflag.Create, update, and enforce OPA governance policies and policy sets.
Query the account-wide audit trail for historical actions.
Before you begin
Harness CLI installed and authenticated: For setup steps, see Install and upgrade and Authenticate.
Scope configured: Ensure your profile has a default org and project set, or pass
--organd--projecton each command. For more information, see Authenticate.
Account
Your Harness account is the top-level container that holds all organizations, projects, and resources. Use get account to view account details such as the account name, ID, and license information.
Organizations
Organizations group related projects under a shared administrative and governance boundary. They sit directly below the account level and provide a way to separate teams, business units, or product lines. Each organization has its own set of RBAC, connectors, and secrets that its child projects can inherit.
Create a new organization:
Update an organization (the CLI fetches the current state, applies your changes, and saves the result):
Delete an organization:
Projects
Projects are the primary unit of work in Harness. They live inside an organization and contain your pipelines, services, environments, connectors, and other module-specific resources. Most day-to-day operations happen at the project level.
Create a project:
Update a project:
Delete a project:
Projects support multi-level listing to view all projects across the account or narrow down to a specific org:
Users and user groups
Users are the individual identities that interact with your Harness account. User groups bundle users together for role assignments and notification preferences.
Both are multi-level resources, meaning they can exist at account, org, or project scope.
Roles, role assignments, and resource groups
Roles define a set of permissions (what actions are allowed). Role assignments bind a role to a user or user group at a specific scope. Resource groups define which resources a role can act on. Together, these three resources form the Harness RBAC model.
List all available permissions in the system:
Service accounts
Service accounts are non-human identities used for API access and automation. They hold their own API keys and role bindings, independent of individual users.
Use service accounts for CI runners, scripts, and integrations that need long-lived credentials.
Connectors
Connectors are integrations that connect Harness to external services such as cloud providers, source code repositories, container registries, and secret managers.
They are multi-level resources, meaning you can create them at account, organization, or project scope for different inheritance patterns.
Create a connector:
Update a connector:
Test connector connectivity (verifies that Harness can reach the external service through a delegate):
Delete a connector:
Secrets
Secrets store sensitive values such as API tokens, passwords, certificates, and SSH keys. They are multi-level resources, so you can define them at account scope (shared across everything), organization scope (shared within an organization), or project scope (limited to one project).
Secrets are referenced by connectors, pipelines, and other resources that need credentials at runtime.
Create a secret:
Update a secret:
Delete a secret:
Delegates
Delegates are lightweight agents that run in your infrastructure (Kubernetes cluster, VM, or Docker host) and execute tasks on behalf of Harness. They handle operations like deploying services, running pipelines, verifying connectivity, and pulling artifacts.
Delegate tokens authenticate a delegate instance with your Harness account.
Manage delegate tokens:
Settings
Account and project settings control platform-wide behaviors such as session timeout, default connectors, and feature toggles. Use the CLI to view current settings values. The --category flag is required when listing settings.
Available categories: CD, CI, CE, CV, CF, STO, CORE, PMS, TEMPLATESERVICE, GOVERNANCE, CHAOS, SCIM, GIT_EXPERIENCE, CONNECTORS, NOTIFICATIONS, AR.
Entity usage
Entity usage shows you where a specific resource is referenced across your account. Use it to check dependencies before deleting a connector, secret, or other shared resource. Pass the entity as <type>/<identifier>.
Governance policies
Governance enforces organizational standards through OPA (Open Policy Agent) policies. A policy is a Rego rule that evaluates against Harness resources such as pipelines, connectors, or secrets at runtime. Use policies to codify your team's guardrails so they are automatically enforced rather than manually reviewed.
List policies:
Get policy details:
Create a policy:
Update a policy:
Delete a policy:
Policy sets
A policy set groups one or more policies and binds them to a trigger event (such as "on pipeline save" or "on pipeline run"). Use policy sets to control when and where your governance rules evaluate, and whether violations block the action or only warn.
List policy sets:
Get policy set details:
Create a policy set:
Update a policy set:
Delete a policy set:
Policy evaluations
A policy evaluation is the recorded result of policies running against a resource. Every time a policy set fires, Harness stores the evaluation outcome. View evaluations to debug why a resource was blocked, confirm compliance, or investigate policy failures.
Audit events
The audit trail records every action taken on any Harness resource across your entire account: creates, updates, deletes, logins, and pipeline executions. Use audit events for compliance investigations, security analysis, and debugging who changed what and when.
List audit events
View recent audit events across your account or filter by time range, user, or resource type.
Get audit event details
Retrieve the full details of a specific audit event, including the before and after state of the resource that was modified.
Related articles
Continuous Delivery: Manage pipelines and executions.
Supported resources and actions: Review the full capability matrix.
Last updated
Was this helpful?