cx-platform-admin
Use this skill when the user asks "who has access", "audit permissions", "check user roles", "list API keys", "review access controls", "rotate API keys", "create API key", "RUM API key", "delete expired keys", "send data keys", "IP allowlist", "IP access restrictions", "check IP whitelist", "add user", "deactivate user", "manage team groups", "user permissions", "role-based access", "manage scopes", "system roles", "API key admin", "team member keys", "group membership", or wants to audit, manage, or configure access controls for a Coralogix account.
- Installs
- 3.3K
- Last 24h
- +78
- Trending rank
- #2341
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/coralogix/cx-cli --skill cx-platform-admin- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads cx-platform-admin automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Platform Admin Skill
Use this skill for managing access, authentication, and authorization in Coralogix. It covers API key management, role and scope definitions, user administration, team groups, and IP access restrictions.
Destructive Operation Safety
All write operations (create, update, delete, set-idp, set-active, set-status) require interactive confirmation. The CLI will prompt before executing. To skip the prompt in scripts, pass --yes.
IMPORTANT: NEVER pass --yes without explicit user approval. Before executing any write operation:
- Describe the exact operation to the user (what will be created/modified/deleted)
- Wait for the user to confirm
- Only then execute with
--yes
Read-only operations (list, get, search, system, sp-params, send-data-keys) do not require confirmation and can be run freely.
Read-Only Mode
Use --read-only (or CX_READ_ONLY=1) to block all write operations at the CLI level. This is useful for safe exploration - you can query any IAM resource without risk of accidental modifications.
Agent Mode
When running inside an AI agent (Claude Code, Cursor, Codex, etc.), cx automatically detects the agent environment and fails fast on write operations instead of hanging on a stdin prompt. The error message instructs you to get user confirmation first, then re-run with --yes.
CLI Commands
API Keys
For RUM (browser/mobile) keys and SDK setup, use the
cx-rum-setupskill.
| Command | Purpose |
|---|---|
cx iam api-keys list | List all API keys |
cx iam api-keys get <id> | Get a single API key |
cx iam api-keys create --from-file | Create an API key |
cx iam api-keys update --from-file <id> | Update an API key |
cx iam api-keys delete <id> | Delete an API key |
cx iam api-keys send-data-keys | List send-data API keys |
cx iam api-keys admin list | List all team members' keys |
cx iam api-keys admin delete --ids <id1> <id2> | Bulk delete keys |
cx iam api-keys admin set-status --ids <id1> --active true/false | Activate/deactivate keys |
Roles & Scopes
| Command | Purpose |
|---|---|
cx iam roles list | List custom roles |
cx iam roles get <id> | Get a role definition |
cx iam roles create --from-file | Create a custom role |
cx iam roles update --from-file <id> | Update a custom role |
cx iam roles delete <id> | Delete a custom role |
cx iam roles system | List system (built-in) roles |
cx iam scopes list | List all scopes |
cx iam scopes get <id> | Get a scope definition |
cx iam scopes create --from-file | Create a scope |
cx iam scopes update --from-file | Update a scope |
cx iam scopes delete <id> | Delete a scope |
Users & Groups
| Command | Purpose |
|---|---|
cx iam users search | Search users (optional --query, --status) |
cx iam users get <user-id> | Get a single user |
cx iam users create --from-file | Create user(s) |
cx iam users update --from-file | Update user(s) |
cx iam users set-status --user-ids <id> --status ACTIVE/INACTIVE | Activate/deactivate users |
cx iam groups list | List all team groups |
cx iam groups get <id> | Get a group by ID |
cx iam groups get-by-name <name> | Get a group by name |
cx iam groups users <group-id> | List users in a group |
cx iam groups create --from-file | Create a group |
cx iam groups update --from-file <id> | Update a group |
cx iam groups delete <id> | Delete a group |
IP Access
| Command | Purpose |
|---|---|
cx iam ip-access get | Get IP access settings |
cx iam ip-access create --from-file | Create IP access rules |
cx iam ip-access update --from-file | Update IP access rules |
cx iam ip-access delete | Delete IP access settings |
All commands support -o json for structured output and -p <profile> for profile selection.
Access Audit Workflow
Use this workflow to produce a comprehensive access report:
Step 1: List All Users
cx iam users search -o json
cx iam users search -o json | jq '[.[] | {id, name: .user_name, status, role_ids}]'
Step 2: List Roles
cx iam roles list -o json
cx iam roles system -o json
Cross-reference user role IDs with role definitions to understand permissions.
Step 3: List Groups and Memberships
cx iam groups list -o json
cx iam groups list -o json | jq '[.[] | {id, name, member_count: (.members | length)}]'
For each group, check members:
cx iam groups users <group-id> -o json
Step 4: Inventory API Keys
cx iam api-keys list -o json
cx iam api-keys admin list -o json
cx iam api-keys send-data-keys -o json
Identify old or unused keys:
cx iam api-keys list -o json | jq '[.[] | {id, name, created_at, active}] | sort_by(.created_at)'
Step 5: Check IP Restrictions
cx iam ip-access get -o json
Step 6: Cross-Reference
Produce a summary: which users have admin roles, which API keys are old, which groups have broad access.
API Key Rotation
Safe key rotation workflow:
- List current keys:
cx iam api-keys list -o json - Identify keys to rotate: filter by age or name
- Create replacement key:
cx iam api-keys create --from-file new-key.json --yes(after user approval) - Deploy the new key to all systems using the old key
- Verify the new key works in all integrations
- Delete the old key:
cx iam api-keys delete <old-key-id> --yes(after user approval)
WARNING: Never delete an API key before its replacement is deployed and verified. Deleting an active key immediately breaks all integrations using it.
Safety Callouts
Deleting API keys breaks any integration using that key immediately. Always create a replacement first.
Deactivating users (
cx iam users set-status --status INACTIVE) takes effect immediately. The user loses access with no grace period.
Deleting IP access rules (
cx iam ip-access delete) removes all IP restrictions immediately, potentially exposing the account.
Key Principles
- Audit before modifying - run the full access audit workflow before making changes
- Never delete keys without replacement - create new key → deploy → verify → delete old
- Use
-o jsonfor structured reports - enables jq filtering for precise access analysis - Multi-profile for cross-environment audits - use
-p <profile>or--all-profilesto audit staging + production - Template from existing -
cx iam roles get <id> -o json > role.jsonbefore creating new roles
Related Skills
cx-cost-optimization- review what API keys are used for and whether they're still neededcx-rum-setup- create RUM API keys and wire the RUM SDK into an app
FAQ
What does the cx-platform-admin skill do?
Use this skill when the user asks "who has access", "audit permissions", "check user roles", "list API keys", "review access controls", "rotate API keys", "create API key", "RUM API key", "delete expired keys", "send data keys", "IP allowlist", "IP access restrictions", "check IP whitelist", "add user", "deactivate user", "manage team groups", "user permissions", "role-based access", "manage scopes", "system roles", "API key admin", "team member keys", "group membership", or wants to audit, manage, or configure access controls for a Coralogix account.
How do I install cx-platform-admin?
Run npx skills add https://github.com/coralogix/cx-cli --skill cx-platform-admin in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cx-platform-admin/ (personal) or .claude/skills/cx-platform-admin/ (project).
Which AI agents can use cx-platform-admin?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is cx-platform-admin safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains cx-platform-admin?
It is published by coralogix in coralogix/cx-cli. It has 3,259 recorded installs.
More from coralogix/cx-cli
cx-telemetry-querying
coralogix/cx-cli
Use this skill for any question involving telemetry data: "investigate an issue", "debug a problem", "find out why something is slow", "check error rates", "analyze user behavior", "understand a production incident", "query telemetry data", "look at logs", "search logs", "find errors", "find stack traces", "filter by severity", "check traces", "examine spans", "investigate request latency", "debug service-to-service calls", "look up a trace ID", "analyze RUM data", "query rum.events", "check frontend performance", "frontend errors", "Core Web Vitals", "JavaScript exceptions", "query metrics", "check CPU usage", "run a PromQL query", "check error rate", "look up a metric", "check memory usage", "how do I write a DataPrime query", "DataPrime syntax", or wants to answer questions using observability data from logs, metrics, traces, RUM, or APM.
cx-search-dashboard
coralogix/cx-cli
This skill should be used when the user asks to "find a dashboard", "search dashboards", "does a dashboard exist for X", "find widgets that query Y", "which dashboards use this field", "find a dashboard about errors", "look up dashboards by description", "search for existing monitoring dashboards", "find widgets that reference a field", or wants to discover existing Coralogix dashboards or widgets using natural-language or field-based search.
coralogix-docs
coralogix/cx-cli
Search and read official Coralogix platform documentation using cx docs search and cx docs fetch. Use when the user asks how Coralogix features work, how to configure or use the UI, set up integrations (OpenTelemetry, agents, collectors, webhooks), manage API keys, explore spans/traces/logs in the product, configure alerts/SLOs/dashboards, or needs authoritative product docs — not live tenant telemetry.
cx-alerts
coralogix/cx-cli
This skill should be used when the user asks to "manage alerts", "create alert", "list alerts", "delete alert", "check alert status", "enable alert", "disable alert", "investigate firing alerts", "check which alerts are active", "find alerting rules", "set up an alert", "configure alerting", "mute an alert", "silence an alert", "see alert definitions", "check alert priority", or wants to manage Coralogix alert definitions using the cx CLI.
cx-cli
coralogix/cx-cli
This skill should be used whenever the user runs any cx command, uses the cx CLI, Coralogix CLI, or mentions cx in the context of Coralogix observability. This skill provides cross-cutting concerns like update notifications that apply to all cx commands.
cx-observability-setup
coralogix/cx-cli
Use this skill when the user asks to "set up monitoring", "configure observability", "onboard new service", "create saved view", "set up notifications", "configure webhook", "set up Slack integration", "outgoing webhook", "automation action", "webhook for alerts", "create view", "saved view", "view folder", "organize dashboards", "install integration", "configure extension", "contextual data", "connect external service", "create notification connector", "set up email alerts", "configure PagerDuty", "notification routing", "deploy extension", "test webhook", "notification preset", "test notification", "webhook actions", or wants to set up, configure, or manage the observability stack for a service or team.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.