zuke.tools.az

← Python API reference

@zuke/az 1.2.1: @zuke/az — typed Azure CLI tasks, readers, and a canary platform and analysis.

zuke on PyPI ↗ 46 symbols

Symbols

#

AzAccountGetAccessTokenSettings

class 
class AzAccountGetAccessTokenSettings(AzSettings)

Settings for az account get-access-token.

The answer is a bearer token, so the command always runs quietly — captured, never streamed — with --output json pinned whatever the settings or the user's config say, and the token is registered with the run's redactor once it returns.

  • resource(uri: str) -> Self

    The resource the token is for, as a Microsoft Entra v1.0 endpoint (--resource).

  • resource_type(type_: Literal['oss-rdbms', 'arm', 'aad-graph', 'ms-graph', 'batch', 'media', 'data-lake']) -> Self

    A well-known resource the token is for (--resource-type).

  • scope(*scopes: str) -> Self

    Microsoft Entra v2.0 scopes for the token (--scope); repeatable.

  • tenant(tenant: str) -> Self

    The tenant to get the token from (--tenant).

#

AzAccountListSettings

class 
class AzAccountListSettings(AzSettings)

Settings for az account list.

  • all() -> Self

    Include subscriptions from every cloud and in every state (--all).

  • refresh() -> Self

    Read the subscriptions from the server, not the cache (--refresh).

#

AzAccountSetSettings

class 
class AzAccountSetSettings(AzSettings)

Settings for az account set: make a subscription the default. Name it with the global .subscription(nameOrId), which account set requires.

#

AzAccountShowSettings

class 
class AzAccountShowSettings(AzSettings)

Settings for az account show: the current (or the given) subscription.

#

AzAcrBuildSettings

class 
class AzAcrBuildSettings(AzSettings)

Settings for az acr build: build an image in the registry from a local directory, a git URL or a tarball, and push it.

--build-arg values are visible to the ACR team for debugging, as the CLI warns; pass a credential with secretBuildArg, whose value is also registered with the run's redactor.

  • registry(name: str) -> Self

    The registry to build in (--registry).

  • source(location: str) -> Self

    The build context: a directory, a git URL or a tarball URL (the positional source).

  • image(name_and_tag: str) -> Self

    A name:tag to give the image (--image); repeatable.

  • file(path: str) -> Self

    The Dockerfile, relative to the source (--file).

  • build_arg(name: str, value: str) -> Self

    A build argument (--build-arg name=value); repeatable. Never a credential.

  • secret_build_arg(name: str, value: str) -> Self

    A build argument the ACR team does not see (--secret-build-arg name=value); repeatable. The value is registered with the run's redactor; it is still part of the argv.

  • platform(platform: str) -> Self

    The platform to build for (--platform), e.g. "linux/arm64".

  • target(stage: str) -> Self

    The Dockerfile stage to build (--target).

  • timeout(seconds: float) -> Self

    The build's timeout in seconds (--timeout).

  • resource_group(name: str) -> Self

    The registry's resource group (--resource-group).

  • no_push() -> Self

    Build without pushing (--no-push).

  • no_logs() -> Self

    Do not stream the build's logs (--no-logs).

  • no_wait() -> Self

    Return once the build is queued (--no-wait).

#

AzAcrLoginSettings

class 
class AzAcrLoginSettings(AzSettings)

Settings for az acr login.

Without exposeToken the CLI logs the local Docker client in itself. With it, the CLI prints a registry refresh token instead — for docker login with the user 00000000-0000-0000-0000-000000000000 — so the command always runs quietly with --output json pinned, and the token is registered with the run's redactor once it returns.

  • name(name: str) -> Self

    The registry's name (--name).

  • expose_token() -> Self

    Print a token instead of logging Docker in (--expose-token).

  • username(name: str) -> Self

    A registry user, instead of the signed-in identity (--username).

  • password(secret: str) -> Self

    The registry user's password (--password), sent on standard input as --password=@- so it never enters the argv, and registered with the run's redactor.

  • suffix(suffix: str) -> Self

    The tenant suffix of the registry's login server (--suffix).

#

AzAcrRepositoryDeleteSettings

class 
class AzAcrRepositoryDeleteSettings(AzSettings)

Settings for az acr repository delete: one image, by tag or digest, or a whole repository. The CLI asks for confirmation unless yes is set.

  • name(name: str) -> Self

    The registry's name (--name).

  • image(image: str) -> Self

    The image to delete, repo:tag or repo@digest (--image).

  • repository(name: str) -> Self

    Delete the whole repository, every tag in it (--repository).

  • yes() -> Self

    Delete without asking (--yes).

#

AzAcrRepositoryShowTagsSettings

class 
class AzAcrRepositoryShowTagsSettings(AzSettings)

Settings for az acr repository show-tags.

  • name(name: str) -> Self

    The registry's name (--name).

  • repository(name: str) -> Self

    The repository whose tags to list (--repository).

  • top(count: float) -> Self

    At most this many tags (--top).

  • orderby(order: Literal['time_asc', 'time_desc']) -> Self

    Order by time, oldest or newest first (--orderby); by name otherwise.

  • detail() -> Self

    Each tag's details, not only its name (--detail).

#

AzAksGetCredentialsSettings

class 
class AzAksGetCredentialsSettings(AzResourceSettings)

Settings for az aks get-credentials. The credentials go to a file — ~/.kube/config unless file says otherwise. Printing them (--file -) would put a cluster credential in the build log, so a - is refused.

  • admin() -> Self

    Get the cluster-admin credentials (--admin).

  • file(path: str) -> Self

    The kubeconfig file to write (--file); ~/.kube/config by default.

  • overwrite_existing() -> Self

    Replace an existing entry of the same name (--overwrite-existing).

  • context(name: str) -> Self

    The context name to write, instead of the cluster's (--context).

  • public_fqdn() -> Self

    Point the kubeconfig at the cluster's public FQDN (--public-fqdn).

  • format(format: Literal['azure', 'exec']) -> Self

    The credential format (--format): azure or exec (kubelogin).

#

AzAksShowSettings

class 
class AzAksShowSettings(AzResourceSettings)

Settings for az aks show.

#

AzContainerappIngressTrafficSetSettings

class 
class AzContainerappIngressTrafficSetSettings(AzResourceSettings)

Settings for az containerapp ingress traffic set: the share of traffic each revision — or each label — receives. The weights must add up to 100; the CLI checks.

  • revision_weight(revision: str, weight: float) -> Self

    A revision's share of traffic, in percent (--revision-weight revision=weight); repeatable. "latest" is the newest revision.

  • label_weight(label: str, weight: float) -> Self

    A label's share of traffic, in percent (--label-weight label=weight); repeatable.

#

AzContainerappRevisionListSettings

class 
class AzContainerappRevisionListSettings(AzResourceSettings)

Settings for az containerapp revision list.

  • all() -> Self

    Include inactive revisions (--all).

#

AzContainerappRevisionSettings

class 
class AzContainerappRevisionSettings(AzResourceSettings)

Settings for az containerapp revision activate and deactivate: the app, and the revision to switch.

  • revision(name: str) -> Self

    The revision to activate or deactivate (--revision).

#

AzContainerappShowSettings

class 
class AzContainerappShowSettings(AzResourceSettings)

Settings for az containerapp show. Secrets stay out: --show-secrets is not typed.

#

AzContainerappUpdateSettings

class 
class AzContainerappUpdateSettings(AzResourceSettings)

Settings for az containerapp update: a new image, environment or scale, which makes a new revision.

  • image(image: str) -> Self

    The container image (--image), e.g. "myregistry.azurecr.io/api:1.4.0".

  • container_name(name: str) -> Self

    The container to update, when the app has several (--container-name).

  • revision_suffix(suffix: str) -> Self

    A suffix for the new revision's name (--revision-suffix).

  • set_env_var(name: str, value: str) -> Self

    Add or update an environment variable (--set-env-vars name=value); repeatable. A value of secretref:<secret> reads one of the app's secrets.

  • remove_env_vars(*names: str) -> Self

    Remove environment variables (--remove-env-vars); repeatable.

  • cpu(cores: float) -> Self

    CPU cores for the container (--cpu), e.g. 0.5.

  • memory(amount: str) -> Self

    Memory for the container (--memory), e.g. "1.0Gi".

  • min_replicas(count: float) -> Self

    The fewest replicas (--min-replicas).

  • max_replicas(count: float) -> Self

    The most replicas (--max-replicas).

  • yaml(path: str) -> Self

    Take the whole configuration from a YAML file (--yaml); other options are ignored.

#

AzDeploymentGroupCreateSettings

class 
class AzDeploymentGroupCreateSettings(AzDeploymentGroupTemplateSettings)

Settings for az deployment group create.

  • no_wait() -> Self

    Return once the deployment has started (--no-wait).

#

AzDeploymentGroupShowSettings

class 
class AzDeploymentGroupShowSettings(AzResourceSettings)

Settings for az deployment group show.

#

AzDeploymentGroupTemplateSettings

class 
class AzDeploymentGroupTemplateSettings(AzResourceSettings)

The template, parameters and mode a deploying deployment group command shares — create and what-if read them identically. The deployment's --name is optional here; the CLI defaults it to the template file's name.

  • template_file(path: str) -> Self

    A local ARM template or Bicep file (--template-file).

  • template_uri(uri: str) -> Self

    A template at a URL (--template-uri).

  • template_spec(id: str) -> Self

    A template spec, by resource id (--template-spec).

  • parameters_file(path: str) -> Self

    A parameters file — JSON or .bicepparam (--parameters <path>); repeatable, later values winning.

  • parameter(name: str, value: str | float | bool) -> Self

    One parameter (--parameters name=value); repeatable. The value is converted to the type the template declares. It is part of the argv, so a secure value belongs in a parameters file or a Key Vault reference.

  • mode(mode: Literal['Incremental', 'Complete']) -> Self

    Incremental (the default) or Complete, which deletes what the template omits (--mode).

#

AzDeploymentGroupWhatIfSettings

class 
class AzDeploymentGroupWhatIfSettings(AzDeploymentGroupTemplateSettings)

Settings for az deployment group what-if: what a deployment would change.

  • result_format(format: Literal['FullResourcePayloads', 'ResourceIdOnly']) -> Self

    How much of each change to show (--result-format).

  • exclude_change_types(*types: Literal['Create', 'Delete', 'Deploy', 'Ignore', 'Modify', 'NoChange', 'Unsupported']) -> Self

    Leave these kinds of change out (--exclude-change-types); repeatable.

  • no_pretty_print() -> Self

    Print the result as JSON rather than the formatted diff (--no-pretty-print).

#

AzFunctionappDeploymentSourceConfigZipSettings

class 
class AzFunctionappDeploymentSourceConfigZipSettings(AzResourceSettings)

Settings for az functionapp deployment source config-zip: deploy a zip package to a function app. This is the generally available command; az functionapp deploy is still in preview.

  • src(path: str) -> Self

    The zip package (--src).

  • build_remote(value: bool) -> Self

    Build the package on the service — install dependencies there (--build-remote).

  • timeout(seconds: float) -> Self

    How long to wait for the deployment's status, in seconds (--timeout).

  • slot(name: str) -> Self

    A slot instead of production (--slot).

#

AzGroupCreateSettings

class 
class AzGroupCreateSettings(AzSettings)

Settings for az group create.

  • name(name: str) -> Self

    The resource group's name (--name).

  • location(location: str) -> Self

    The region to create it in (--location), e.g. "westeurope".

  • tag(key: str, value: str) -> Self

    A tag (--tags key=value); repeatable.

  • managed_by(id: str) -> Self

    The id of the resource that manages the group (--managed-by).

#

AzGroupDeleteSettings

class 
class AzGroupDeleteSettings(AzSettings)

Settings for az group delete. The CLI asks for confirmation unless yes is set — and fails, without a terminal to ask on.

  • name(name: str) -> Self

    The resource group's name (--name).

  • yes() -> Self

    Delete without asking (--yes).

  • no_wait() -> Self

    Return once the deletion has started (--no-wait).

  • force_deletion_types(type_: Literal['Microsoft.Compute/virtualMachines', 'Microsoft.Compute/virtualMachineScaleSets', 'Microsoft.Databricks/workspaces']) -> Self

    Force-delete the group's resources of this type (--force-deletion-types).

#

AzGroupExistsSettings

class 
class AzGroupExistsSettings(AzSettings)

Settings for az group exists, which prints true or false.

  • name(name: str) -> Self

    The resource group's name (--name).

#

AzGroupShowSettings

class 
class AzGroupShowSettings(AzSettings)

Settings for az group show.

  • name(name: str) -> Self

    The resource group's name (--name).

#

AzKeyvaultSecretSetSettings

class 
class AzKeyvaultSecretSetSettings(AzSettings)

Settings for az keyvault secret set.

The value comes from a file — read exactly, with its encoding — or from value, which is sent on standard input as --value=@- so it never enters the argv. The CLI strips trailing line breaks from what it reads that way; use a file for a value that must keep them.

  • vault_name(name: str) -> Self

    The vault's name (--vault-name).

  • name(name: str) -> Self

    The secret's name (--name).

  • value(secret: str) -> Self

    The value, sent on standard input as --value=@- and registered with the run's redactor.

  • file(path: str) -> Self

    Read the value from a file (--file) — the way to keep it exact.

  • encoding(encoding: Literal['utf-8', 'utf-16le', 'utf-16be', 'ascii', 'base64', 'hex']) -> Self

    How the file is encoded (--encoding); utf-8 by default. Refused without a file: the CLI saves it as a file-encoding tag that keyvault secret download later decodes with.

  • content_type(type_: str) -> Self

    What the value is, e.g. "password" (--content-type).

  • expires(time: str) -> Self

    When the secret expires (--expires): a Date, or a string such as 2027-01-01T00:00:00Z — the CLI takes UTC to the second, no fractions.

  • not_before(time: str) -> Self

    When the secret becomes usable (--not-before), in the same form as expires.

  • disabled(value: bool) -> Self

    Create the secret disabled, or enabled (--disabled).

  • tag(key: str, value: str) -> Self

    A tag (--tags key=value); repeatable.

#

AzKeyvaultSecretShowSettings

class 
class AzKeyvaultSecretShowSettings(AzSettings)

Settings for az keyvault secret show.

  • vault_name(name: str) -> Self

    The vault's name (--vault-name).

  • name(name: str) -> Self

    The secret's name (--name).

  • version(version: str) -> Self

    A specific version; the latest when omitted (--version).

  • id(identifier: str) -> Self

    The secret's full identifier, instead of vault and name (--id).

#

AzLoginSettings

class 
class AzLoginSettings(AzSettings)

Settings for az login, for the non-interactive forms a build uses. The interactive browser and device-code forms are left to .command("login").

Exactly one credential is sent: a secret (password), a certificate or a federatedToken for a service principal, or identity for a managed identity. A service principal without one would make the CLI prompt for a password, so it is refused here.

az login reads the global .subscription(...) as the subscription to make the default once it has signed in. Its output lists the account's subscriptions — no credential — so it is not masked.

  • service_principal() -> Self

    Log in as a service principal (--service-principal).

  • username(client_id: str) -> Self

    The service principal's client id (--username).

  • tenant(tenant: str) -> Self

    The Microsoft Entra tenant, required for a service principal (--tenant).

  • password(secret: str) -> Self

    The service principal's client secret (--password), sent on standard input as --password=@- so it never enters the argv, and registered with the run's redactor. Prefer federatedToken (no long-lived secret) or certificate.

  • federated_token(token: str) -> Self

    A federated token (OIDC) to exchange for the service principal's access (--federated-token), sent on standard input as --federated-token=@- and registered with the run's redactor.

  • certificate(path: str) -> Self

    A PEM file with the service principal's key and certificate (--certificate).

  • use_cert_sn_issuer() -> Self

    Authenticate with Subject Name + Issuer, for automatic certificate rolls (--use-cert-sn-issuer).

  • identity() -> Self

    Log in with the managed identity of the machine the build runs on (--identity).

  • client_id(id: str) -> Self

    A user-assigned managed identity, by client id (--client-id).

  • object_id(id: str) -> Self

    A user-assigned managed identity, by object id (--object-id).

  • resource_id(id: str) -> Self

    A user-assigned managed identity, by resource id (--resource-id).

  • allow_no_subscriptions() -> Self

    Succeed for a tenant with no subscriptions (--allow-no-subscriptions).

#

AzLogoutSettings

class 
class AzLogoutSettings(AzSettings)

Settings for az logout.

  • username(name: str) -> Self

    The account to log out; the active one when omitted (--username).

#

AzMonitorActivityLogListSettings

class 
class AzMonitorActivityLogListSettings(AzSettings)

Settings for az monitor activity-log list: the control-plane events of a subscription, resource group or resource. The CLI returns at most maxEvents — 50 unless told otherwise.

  • start_time(time: str) -> Self

    The start of the range (--start-time).

  • end_time(time: str) -> Self

    The end of the range (--end-time); now by default.

  • offset(duration: str | float) -> Self

    The length of the range when only one end is given (--offset); six hours by default.

  • resource_group(name: str) -> Self

    Only events in this resource group (--resource-group).

  • resource_id(id: str) -> Self

    Only events on this resource (--resource-id).

  • namespace(namespace: str) -> Self

    Only events from this resource provider (--namespace).

  • caller(caller: str) -> Self

    Only events by this caller (--caller).

  • status(status: str) -> Self

    Only events with this status, e.g. "Failed" (--status).

  • correlation_id(id: str) -> Self

    Only the events of this operation (--correlation-id).

  • max_events(count: float) -> Self

    The most events to return (--max-events); 50 by default.

  • select(*properties: str) -> Self

    Only these properties of each event (--select); repeatable.

#

AzMonitorLogAnalyticsQuerySettings

class 
class AzMonitorLogAnalyticsQuerySettings(AzSettings)

Settings for az monitor log-analytics query.

  • workspace(id: str) -> Self

    The workspace's id — its customer id, a GUID (--workspace).

  • analytics_query(query: str) -> Self

    The KQL query (--analytics-query).

  • timespan(range: str | float) -> Self

    The range to query (--timespan): a duration back from now, as "30m" or milliseconds (sent as ISO 8601), or an ISO 8601 interval string such as "2026-10-07T10:00:00Z/2026-10-07T11:00:00Z", sent as written. All the data by default.

  • workspaces(*ids: str) -> Self

    Further workspaces to union into the query (--workspaces); repeatable.

#

AzMonitorMetricsAlertListSettings

class 
class AzMonitorMetricsAlertListSettings(AzSettings)

Settings for az monitor metrics alert list.

  • resource_group(name: str) -> Self

    Only the rules in this resource group (--resource-group).

#

AzMonitorMetricsAlertShowSettings

class 
class AzMonitorMetricsAlertShowSettings(AzResourceSettings)

Settings for az monitor metrics alert show: one metric alert rule. The rule's definition, not whether it is firing — that lives in Azure Monitor's alerts, not in the rule.

#

AzMonitorMetricsListDefinitionsSettings

class 
class AzMonitorMetricsListDefinitionsSettings(AzSettings)

Settings for az monitor metrics list-definitions: the metrics a resource has.

  • resource(id: str) -> Self

    The resource, by full resource id (--resource).

  • namespace(namespace: str) -> Self

    Only this metric namespace (--namespace).

#

AzMonitorMetricsListSettings

class 
class AzMonitorMetricsListSettings(AzSettings)

Settings for az monitor metrics list: a resource's metrics over a time range, one datapoint per interval.

The CLI returns at most top time series per metric — ten unless told otherwise — so a query that splits by a dimension can silently lose series; raise top to cover them.

  • resource(id: str) -> Self

    The resource, by full resource id (--resource).

  • metrics(*names: str) -> Self

    The metrics to read, by name (--metrics); repeatable.

  • aggregation(*types: Literal['Average', 'Count', 'Maximum', 'Minimum', 'Total']) -> Self

    The aggregations to compute per interval (--aggregation); repeatable.

  • interval(interval: Literal['PT1M', 'PT5M', 'PT15M', 'PT30M', 'PT1H', 'PT6H', 'PT12H', 'PT24H']) -> Self

    The time grain of each datapoint (--interval); one minute by default. The range set by window is not aligned to it, so the newest datapoint may cover an interval that is still being written.

  • start_time(time: str) -> Self

    The start of the range (--start-time).

  • end_time(time: str) -> Self

    The end of the range (--end-time); now by default.

  • window(duration: str | float, end: str | None=None) -> Self

    The duration ("15m", or milliseconds) up to end — now, unless given — as --start-time and --end-time.

  • offset(duration: str | float) -> Self

    The length of the range when only one end is given (--offset, as "30m" or milliseconds); an hour by default.

  • filter(expression: str) -> Self

    An OData filter on the dimensions (--filter), e.g. "ApiName eq 'GetBlob' and GeoType eq '*'". For plain equality, prefer dimension, which quotes the value.

  • dimension(name: str, value: str) -> Self

    Only the series where the dimension name is value — rendered into --filter as name eq 'value', joined with and; repeatable.

  • split_by(*dimensions: str) -> Self

    Split the series by these dimensions (--dimension); repeatable.

  • namespace(namespace: str) -> Self

    The metric namespace (--namespace).

  • top(count: float) -> Self

    The most time series to return per metric (--top); 10 by default.

  • orderby(order: str) -> Self

    The aggregation and direction to sort series by (--orderby), e.g. "sum desc".

#

AzMonitorMetricValueSettings

class 
class AzMonitorMetricValueSettings(AzMonitorMetricsListSettings)

Settings for AzTasks.metricValue: a metrics list request with exactly one AzMonitorMetricsListSettings.aggregation, and how to read it.

  • metric(name: str) -> Self

    The metric to read, by name. Needed only when the request names more than one with .metrics(...).

  • aggregate(how: Literal['latest', 'sum', 'average', 'maximum', 'minimum']) -> Self

    How to turn the datapoints into one number, across every series the answer holds. "latest" (the default) is the newest interval — the sum of the series' values at the newest timestamp any of them has, so a metric split by a dimension reads as its total. The others combine every datapoint in the range: a "sum" of per-minute Totals is the range's total.

  • missing_data_as(value: float) -> Self

    Return value when there are no datapoints, instead of failing. Azure Monitor reports an interval with no events without a value, so for a count of errors no data does mean 0; for a latency it usually means the query is looking in the wrong place.

#

AzResourceSettings

class 
class AzResourceSettings(AzSettings)

Settings for a command on one named resource in a resource group.

  • name(name: str) -> Self

    The resource's name (--name).

  • resource_group(name: str) -> Self

    The resource group the resource is in (--resource-group).

#

AzSettings

class 
class AzSettings(SubcommandSettings)

Settings for an az invocation.

Every instance sets three of the CLI's configuration variables in the child's environment, so the CLI never waits on a keypress, installs code, or colours a build log:

- AZURE_EXTENSION_USE_DYNAMIC_INSTALL=no — a command from an extension that is not installed fails, instead of prompting (on a terminal) or silently downloading and installing the extension (without one). The CLI's message does not name the extension — it says the command is misspelled or not recognized by the system and exits 2 — so install what a build needs up front with az extension add --name <name>. - AZURE_CORE_LOGIN_EXPERIENCE_V2=off — an interactive az login does not open its subscription selector. - AZURE_CORE_NO_COLOR=true — no ANSI colour codes in captured output.

Setting them there keeps the argv exactly what the settings say; override any of them with .env({...}). A confirmation prompt (group delete without --yes) is not switched off: on a terminal it asks, without one the CLI fails — call the command's .yes() to confirm in the build.

  • subscription(name_or_id: str) -> Self

    The subscription to run against, by name or id (--subscription); the CLI's default subscription when omitted. Most commands take it; the account commands read it as the subscription they act on.

  • output(format: Literal['json', 'jsonc', 'yaml', 'yamlc', 'table', 'tsv', 'none']) -> Self

    The output format (--output): json, jsonc, yaml, yamlc, table, tsv or none.

  • query(expression: str) -> Self

    A JMESPath expression that filters the output (--query).

  • only_show_errors() -> Self

    Print errors only, suppressing warnings (--only-show-errors). The CLI refuses it beside --debug or --verbose, and so do these settings.

  • verbose() -> Self

    More logging, on stderr (--verbose).

  • env(record: Mapping[str, str]) -> Self

    Merge additional environment variables for the process. Under debug — set before or after — a credential variable set here is registered with the run's redactor, like one in the build's environment.

  • debug() -> Self

    Turn on the CLI's debug logging (--debug), written to stderr. The debug log can carry credentials: request and response details, which for a Key Vault or storage command include what was read or sent. The credentials the CLI reads from the environment — AZURE_STORAGE_KEY, AZURE_STORAGE_CONNECTION_STRING, AZURE_STORAGE_SAS_TOKEN, AZURE_CLIENT_SECRET, AZURE_DEVOPS_EXT_PAT, and Terraform's ARM_CLIENT_SECRET beside them — are registered with the run's redactor, whether they are in the build's environment or set with env, but a token the CLI holds in its own cache (~/.azure) is not known here and is not masked. Keep it for a local investigation, never a shared CI log.

  • flag(name: str, value: str | float | None=None) -> Self

    Add an arbitrary option: --name value, or the bare --name. Two hazards come with the escape hatch, which the typed setters guard and this does not: a value that starts with - is read by the CLI as the next option, and a value that starts with @ — or, in a key=value list element, a value after the = that does — is replaced by that file's contents (@- by standard input), which then leave the machine in the request. Never pass an untrusted value here, or through .args(...) or .command(...).

#

AzStorageBlobDownloadSettings

class 
class AzStorageBlobDownloadSettings(AzStorageBlobSettings)

Settings for az storage blob download.

  • container_name(name: str) -> Self

    The container (--container-name).

  • name(name: str) -> Self

    The blob's name (--name).

  • file(path: str) -> Self

    The local file to write (--file).

  • overwrite(value: bool) -> Self

    Replace an existing local file (--overwrite).

#

AzStorageBlobSettings

class 
class AzStorageBlobSettings(AzSettings)

The account and credential options every storage blob command takes. One credential at most: the CLI reads it from standard input.

  • account_name(name: str) -> Self

    The storage account (--account-name).

  • auth_mode(mode: Literal['login', 'key']) -> Self

    login uses the signed-in identity; key an account key (--auth-mode).

  • account_key(key: str) -> Self

    The account key (--account-key), sent on standard input.

  • sas_token(token: str) -> Self

    A SAS token (--sas-token), sent on standard input. Its signature is registered on its own as well — as written, decoded and URL-encoded — since the CLI's debug log prints the token URL-encoded inside a request URL, where the token as a whole never appears.

  • connection_string(connection: str) -> Self

    A connection string (--connection-string), sent on standard input.

#

AzStorageBlobUploadBatchSettings

class 
class AzStorageBlobUploadBatchSettings(AzStorageBlobSettings)

Settings for az storage blob upload-batch: upload a directory.

  • source(path: str) -> Self

    The local directory to upload (--source).

  • destination(container: str) -> Self

    The container, by name or URL (--destination).

  • pattern(glob: str) -> Self

    Upload only the files matching this glob (--pattern).

  • destination_path(path: str) -> Self

    A path inside the container to upload under (--destination-path).

  • overwrite(value: bool) -> Self

    Replace existing blobs (--overwrite).

  • dryrun() -> Self

    Show what would be uploaded without uploading (--dryrun).

#

AzStorageBlobUploadSettings

class 
class AzStorageBlobUploadSettings(AzStorageBlobSettings)

Settings for az storage blob upload.

  • container_name(name: str) -> Self

    The container (--container-name).

  • name(name: str) -> Self

    The blob's name (--name).

  • file(path: str) -> Self

    The local file to upload (--file).

  • overwrite(value: bool) -> Self

    Replace an existing blob (--overwrite).

  • content_type(type_: str) -> Self

    The blob's MIME type (--content-type).

  • content_cache_control(value: str) -> Self

    The blob's Cache-Control (--content-cache-control).

  • tag(key: str, value: str) -> Self

    A blob index tag (--tags key=value); repeatable.

#

AzTasks

class 
class AzTasks

Typed task functions for the az CLI.

  • static async run(ctx: ServiceContext, configure: Callable[[AzSettings], AzSettings] | None=None) -> ExecResult

    Run any az command, built with .command(group, …, verb).

  • static async login(ctx: ServiceContext, configure: Callable[[AzLoginSettings], AzLoginSettings] | None=None) -> ExecResult

    Sign the CLI in, non-interactively: az login.

  • static async logout(ctx: ServiceContext, configure: Callable[[AzLogoutSettings], AzLogoutSettings] | None=None) -> ExecResult

    Sign the CLI out: az logout.

  • static async account_show(ctx: ServiceContext, configure: Callable[[AzAccountShowSettings], AzAccountShowSettings] | None=None) -> ExecResult

    Describe the current subscription: az account show.

  • static async account_set(ctx: ServiceContext, configure: Callable[[AzAccountSetSettings], AzAccountSetSettings] | None=None) -> ExecResult

    Make a subscription the default: az account set.

  • static async account_list(ctx: ServiceContext, configure: Callable[[AzAccountListSettings], AzAccountListSettings] | None=None) -> ExecResult

    List the subscriptions: az account list.

  • static async account_get_access_token(ctx: ServiceContext, configure: Callable[[AzAccountGetAccessTokenSettings], AzAccountGetAccessTokenSettings] | None=None) -> ExecResult

    Get an access token: az account get-access-token (captured, never streamed).

  • static async access_token(ctx: ServiceContext, configure: Callable[[AzAccountGetAccessTokenSettings], AzAccountGetAccessTokenSettings] | None=None) -> object

    An access token, read back as a string and registered as a secret. Pins --query accessToken --output json.

  • static async subscription_id(ctx: ServiceContext, configure: Callable[[AzAccountShowSettings], AzAccountShowSettings] | None=None) -> object

    The subscription id the CLI acts on. Pins --query id --output tsv.

  • static async tenant_id(ctx: ServiceContext, configure: Callable[[AzAccountShowSettings], AzAccountShowSettings] | None=None) -> object

    The tenant id of the current subscription. Pins --query tenantId --output tsv.

  • static async group_create(ctx: ServiceContext, configure: Callable[[AzGroupCreateSettings], AzGroupCreateSettings] | None=None) -> ExecResult

    Create a resource group: az group create.

  • static async group_show(ctx: ServiceContext, configure: Callable[[AzGroupShowSettings], AzGroupShowSettings] | None=None) -> ExecResult

    Describe a resource group: az group show.

  • static async group_delete(ctx: ServiceContext, configure: Callable[[AzGroupDeleteSettings], AzGroupDeleteSettings] | None=None) -> ExecResult

    Delete a resource group: az group delete.

  • static async group_exists(ctx: ServiceContext, configure: Callable[[AzGroupExistsSettings], AzGroupExistsSettings] | None=None) -> ExecResult

    Print whether a resource group exists: az group exists.

  • static async resource_group_exists(ctx: ServiceContext, name: str, configure: Callable[[AzGroupExistsSettings], AzGroupExistsSettings] | None=None) -> object

    Whether resource group name exists. Pins --output json.

  • static async acr_login(ctx: ServiceContext, configure: Callable[[AzAcrLoginSettings], AzAcrLoginSettings] | None=None) -> ExecResult

    Log in to a registry: az acr login (captured, never streamed).

  • static async acr_token(ctx: ServiceContext, configure: Callable[[AzAcrLoginSettings], AzAcrLoginSettings] | None=None) -> object

    A registry refresh token, for docker login as 00000000-0000-0000-0000-000000000000: az acr login --expose-token, read back and registered as a secret. Pins --query accessToken --output json.

  • static async acr_build(ctx: ServiceContext, configure: Callable[[AzAcrBuildSettings], AzAcrBuildSettings] | None=None) -> ExecResult

    Build and push an image in the registry: az acr build.

  • static async acr_repository_show_tags(ctx: ServiceContext, configure: Callable[[AzAcrRepositoryShowTagsSettings], AzAcrRepositoryShowTagsSettings] | None=None) -> ExecResult

    List a repository's tags: az acr repository show-tags.

  • static async acr_repository_delete(ctx: ServiceContext, configure: Callable[[AzAcrRepositoryDeleteSettings], AzAcrRepositoryDeleteSettings] | None=None) -> ExecResult

    Delete an image or a repository: az acr repository delete.

  • static async aks_get_credentials(ctx: ServiceContext, configure: Callable[[AzAksGetCredentialsSettings], AzAksGetCredentialsSettings] | None=None) -> ExecResult

    Write a cluster's credentials to a kubeconfig: az aks get-credentials.

  • static async aks_show(ctx: ServiceContext, configure: Callable[[AzAksShowSettings], AzAksShowSettings] | None=None) -> ExecResult

    Describe a cluster: az aks show.

  • static async containerapp_update(ctx: ServiceContext, configure: Callable[[AzContainerappUpdateSettings], AzContainerappUpdateSettings] | None=None) -> ExecResult

    Roll a container app onto a new revision: az containerapp update.

  • static async containerapp_show(ctx: ServiceContext, configure: Callable[[AzContainerappShowSettings], AzContainerappShowSettings] | None=None) -> ExecResult

    Describe a container app: az containerapp show.

  • static async containerapp_fqdn(ctx: ServiceContext, configure: Callable[[AzContainerappShowSettings], AzContainerappShowSettings] | None=None) -> object

    A container app's ingress FQDN. Pins --query properties.configuration.ingress.fqdn --output tsv; fails for an app without ingress.

  • static async containerapp_revision_list(ctx: ServiceContext, configure: Callable[[AzContainerappRevisionListSettings], AzContainerappRevisionListSettings] | None=None) -> ExecResult

    List a container app's revisions: az containerapp revision list.

  • static async containerapp_revision_activate(ctx: ServiceContext, configure: Callable[[AzContainerappRevisionSettings], AzContainerappRevisionSettings] | None=None) -> ExecResult

    Activate a revision: az containerapp revision activate.

  • static async containerapp_revision_deactivate(ctx: ServiceContext, configure: Callable[[AzContainerappRevisionSettings], AzContainerappRevisionSettings] | None=None) -> ExecResult

    Deactivate a revision: az containerapp revision deactivate.

  • static async containerapp_ingress_traffic_set(ctx: ServiceContext, configure: Callable[[AzContainerappIngressTrafficSetSettings], AzContainerappIngressTrafficSetSettings] | None=None) -> ExecResult

    Split traffic between revisions or labels: az containerapp ingress traffic set.

  • static async webapp_deploy(ctx: ServiceContext, configure: Callable[[AzWebappDeploySettings], AzWebappDeploySettings] | None=None) -> ExecResult

    Deploy an artifact to a web app: az webapp deploy.

  • static async webapp_show(ctx: ServiceContext, configure: Callable[[AzWebappShowSettings], AzWebappShowSettings] | None=None) -> ExecResult

    Describe a web app: az webapp show.

  • static async webapp_host_name(ctx: ServiceContext, configure: Callable[[AzWebappShowSettings], AzWebappShowSettings] | None=None) -> object

    A web app's default host name. Pins --query defaultHostName --output tsv.

  • static async webapp_config_appsettings_set(ctx: ServiceContext, configure: Callable[[AzWebappConfigAppsettingsSetSettings], AzWebappConfigAppsettingsSetSettings] | None=None) -> ExecResult

    Set app settings: az webapp config appsettings set.

  • static async webapp_deployment_slot_swap(ctx: ServiceContext, configure: Callable[[AzWebappDeploymentSlotSwapSettings], AzWebappDeploymentSlotSwapSettings] | None=None) -> ExecResult

    Swap a deployment slot: az webapp deployment slot swap.

  • static async functionapp_deployment_source_config_zip(ctx: ServiceContext, configure: Callable[[AzFunctionappDeploymentSourceConfigZipSettings], AzFunctionappDeploymentSourceConfigZipSettings] | None=None) -> ExecResult

    Deploy a zip package to a function app: az functionapp deployment source config-zip.

  • static async keyvault_secret_show(ctx: ServiceContext, configure: Callable[[AzKeyvaultSecretShowSettings], AzKeyvaultSecretShowSettings] | None=None) -> ExecResult

    Read a secret: az keyvault secret show (captured, never streamed).

  • static async secret_value(ctx: ServiceContext, configure: Callable[[AzKeyvaultSecretShowSettings], AzKeyvaultSecretShowSettings] | None=None) -> object

    A Key Vault secret's value, read back exactly — multi-line values and surrounding whitespace included — and registered as a secret. Pins --query value --output json.

  • static async keyvault_secret_set(ctx: ServiceContext, configure: Callable[[AzKeyvaultSecretSetSettings], AzKeyvaultSecretSetSettings] | None=None) -> ExecResult

    Write a secret: az keyvault secret set (captured, never streamed).

  • static async deployment_group_create(ctx: ServiceContext, configure: Callable[[AzDeploymentGroupCreateSettings], AzDeploymentGroupCreateSettings] | None=None) -> ExecResult

    Deploy a template to a resource group: az deployment group create.

  • static async deployment_group_show(ctx: ServiceContext, configure: Callable[[AzDeploymentGroupShowSettings], AzDeploymentGroupShowSettings] | None=None) -> ExecResult

    Describe a deployment: az deployment group show.

  • static async deployment_group_what_if(ctx: ServiceContext, configure: Callable[[AzDeploymentGroupWhatIfSettings], AzDeploymentGroupWhatIfSettings] | None=None) -> ExecResult

    Preview what a deployment would change: az deployment group what-if.

  • static async deployment_output(ctx: ServiceContext, group: str, name: str, key: str, configure: Callable[[AzDeploymentGroupShowSettings], AzDeploymentGroupShowSettings] | None=None) -> object

    One output of deployment name in resource group group, read back as a string — a non-string output as its JSON text. Pins --query properties.outputs --output json; fails when there is no such output.

  • static async storage_blob_upload(ctx: ServiceContext, configure: Callable[[AzStorageBlobUploadSettings], AzStorageBlobUploadSettings] | None=None) -> ExecResult

    Upload a file to a blob: az storage blob upload.

  • static async storage_blob_download(ctx: ServiceContext, configure: Callable[[AzStorageBlobDownloadSettings], AzStorageBlobDownloadSettings] | None=None) -> ExecResult

    Download a blob to a file: az storage blob download.

  • static async storage_blob_upload_batch(ctx: ServiceContext, configure: Callable[[AzStorageBlobUploadBatchSettings], AzStorageBlobUploadBatchSettings] | None=None) -> ExecResult

    Upload a directory: az storage blob upload-batch.

  • static async monitor_metrics_list(ctx: ServiceContext, configure: Callable[[AzMonitorMetricsListSettings], AzMonitorMetricsListSettings] | None=None) -> ExecResult

    Read a resource's metrics: az monitor metrics list.

  • static async metric_value(ctx: ServiceContext, configure: Callable[[AzMonitorMetricValueSettings], AzMonitorMetricValueSettings]) -> object

    One number from Azure Monitor: the latest datapoint of a metric, or an aggregate over the range. Pins --query value --output json; fails on no data unless .missingDataAs(value) says what it means.

  • static async monitor_metrics_list_definitions(ctx: ServiceContext, configure: Callable[[AzMonitorMetricsListDefinitionsSettings], AzMonitorMetricsListDefinitionsSettings] | None=None) -> ExecResult

    List a resource's metric definitions: az monitor metrics list-definitions.

  • static async monitor_metrics_alert_list(ctx: ServiceContext, configure: Callable[[AzMonitorMetricsAlertListSettings], AzMonitorMetricsAlertListSettings] | None=None) -> ExecResult

    List metric alert rules: az monitor metrics alert list.

  • static async monitor_metrics_alert_show(ctx: ServiceContext, configure: Callable[[AzMonitorMetricsAlertShowSettings], AzMonitorMetricsAlertShowSettings] | None=None) -> ExecResult

    Describe a metric alert rule: az monitor metrics alert show.

  • static async monitor_activity_log_list(ctx: ServiceContext, configure: Callable[[AzMonitorActivityLogListSettings], AzMonitorActivityLogListSettings] | None=None) -> ExecResult

    List activity-log events: az monitor activity-log list.

  • static async monitor_log_analytics_query(ctx: ServiceContext, configure: Callable[[AzMonitorLogAnalyticsQuerySettings], AzMonitorLogAnalyticsQuerySettings] | None=None) -> ExecResult

    Run a KQL query: az monitor log-analytics query (the log-analytics extension).

  • static async log_analytics_query(ctx: ServiceContext, configure: Callable[[AzMonitorLogAnalyticsQuerySettings], AzMonitorLogAnalyticsQuerySettings]) -> object

    The rows of a KQL query, every cell a string. Pins --output json and the whole answer as the query.

#

AzWebappConfigAppsettingsSetSettings

class 
class AzWebappConfigAppsettingsSetSettings(AzResourceSettings)

Settings for az webapp config appsettings set.

Each setting's value is part of the argv, so it is visible in the process table and in the command line the build logs; a credential belongs in Key Vault, referenced with keyVaultReference. A value that starts with @ is otherwise refused, because the CLI would read it from a file. The CLI's answer lists every setting with its value redacted.

  • setting(name: str, value: str) -> Self

    An app setting (--settings name=value); repeatable.

  • key_vault_reference(name: str, secret_uri: str) -> Self

    An app setting whose value App Service reads from Key Vault; repeatable. Sent as the JSON object {"name":"@Microsoft.KeyVault(SecretUri=<uri>)"}, a form --settings accepts: written as name=@Microsoft… the CLI would first try to read a file of that name, and send its contents if one existed.

  • slot_setting(name: str, value: str) -> Self

    A setting that stays with its slot through a swap (--slot-settings name=value); repeatable.

  • slot(name: str) -> Self

    A slot instead of production (--slot).

#

AzWebappDeploymentSlotSwapSettings

class 
class AzWebappDeploymentSlotSwapSettings(AzResourceSettings)

Settings for az webapp deployment slot swap: swap a slot with production, or with targetSlot.

  • slot(name: str) -> Self

    The slot to swap from (--slot).

  • target_slot(name: str) -> Self

    The slot to swap with; production by default (--target-slot).

  • action(action: Literal['swap', 'preview', 'reset']) -> Self

    preview applies the target's settings to the source first, swap completes the swap, reset cancels a preview (--action).

  • preserve_vnet(value: bool) -> Self

    Keep the virtual network with the slot (--preserve-vnet).

#

AzWebappDeploySettings

class 
class AzWebappDeploySettings(AzResourceSettings)

Settings for az webapp deploy, the current deploy command (the older webapp deployment source config-zip is deprecated in its favour).

  • src_path(path: str) -> Self

    The artifact to deploy, a local path (--src-path).

  • src_url(url: str) -> Self

    The artifact to deploy, a URL the app pulls it from (--src-url).

  • type_(type_: Literal['war', 'jar', 'ear', 'lib', 'startup', 'static', 'zip']) -> Self

    The artifact's type, when its extension does not say (--type).

  • target_path(path: str) -> Self

    Where to deploy it, an absolute path on the app (--target-path).

  • slot(name: str) -> Self

    The slot to deploy to; production when omitted (--slot).

  • async_(value: bool | None=None) -> Self

    Return once the artifact is pushed, without waiting for it to deploy (--async).

  • restart(value: bool) -> Self

    Restart the app after deploying (--restart); the CLI's default is to.

  • clean(value: bool) -> Self

    Empty the target directory first (--clean).

  • timeout(ms: float) -> Self

    How long to wait for the deployment, in milliseconds (--timeout).

#

AzWebappShowSettings

class 
class AzWebappShowSettings(AzResourceSettings)

Settings for az webapp show.

  • slot(name: str) -> Self

    A slot instead of production (--slot).