Skip to main content
Every service and backup belongs to an organization, so every postgres and backup command acts in exactly one. This page explains how the CLI picks that organization, which this documentation calls the effective organization.

How the effective organization is chosen

The CLI decides in this order:
1

Is SABAOTH_API_KEY set?

If yes, the CLI ignores everything saved locally and asks the API which organizations the key covers.
  • With --org, that organization is used, but only if the key covers it. Otherwise the command fails with ORGANIZATION_MISMATCH.
  • Without --org, the key’s organization is used. If the key covers more than one, the command fails with AMBIGUOUS_ORGANIZATION and lists them.
2

Was --org passed?

If yes, that organization is used, provided you have signed in to it on this machine. Otherwise the command fails with ORGANIZATION_NOT_REGISTERED.
3

Is an organization selected?

If yes, the selected organization is used, with its key from the keychain.
4

Nothing to use

The command fails with NOT_AUTHENTICATED and asks you to run sabaoth login or set SABAOTH_API_KEY.

Work with several organizations

Sign in to each organization once:
See which ones you have, with the selected one marked *:
Switch the selection:
Or run a single command against another organization without changing the selection:

Switching checks your access first

sabaoth org use doesn’t just edit a file. It checks the stored key with the API first, and the organization must still be one the key covers. If your access has been removed or the key revoked, the selection stays as it was. This means a stale entry in your context file can never quietly become the target of later commands. See sabaoth org use.

Services in other organizations

If you ask for a service that exists but belongs to a different organization, the CLI reports it exactly as if it didn’t exist (CLUSTER_NOT_FOUND). This is deliberate: telling the two apart would confirm that an ID exists somewhere you can’t see. sabaoth postgres delete goes further. It always reads the service first, even with --yes, and refuses to delete anything outside the effective organization.

See the current context

Shows the credential source, the selected organization and every organization you have signed in to, without making a network call. See sabaoth config.