Skip to main content
The tolmo query command proxies requests to your organization’s connected services. Credentials are resolved on the backend — they never leave the server, and your local machine never sees a token or secret key. Use tolmo query list to discover which connected providers support proxy queries. All subcommands accept the global --org flag to target a specific organization.

​
Discover available services

Before querying a service, use tolmo query list to see which providers are connected for your organization.
Providers are discovered dynamically from the backend. New backend adapters become available without any CLI update on your end.

​
GitHub (REST)

Send REST requests directly to the GitHub API. Tolmo injects the org’s GitHub App credentials on the backend.

​
GitHub CLI passthrough

tolmo query -- gh ... runs your locally installed gh CLI with a short-lived token injected by the backend via a Unix socket proxy. This supports gh output features — including pagination, --jq, --template, and gh api — backed by the org’s GitHub App credentials rather than your personal token.
The -- separator between tolmo query and gh is mandatory. Without it, the Cobra argument parser strips unknown flags (like --repo, --limit, or --state) before they ever reach gh, causing unexpected errors or silent failures.

​
AWS CLI passthrough

tolmo query -- aws ... sends AWS CLI arguments to the backend, which parses and executes the supported request with your integration credentials. You do not need a local AWS CLI installation. Provider permissions and proxy restrictions still apply.
The -- separator is mandatory here too. Without it, flags like --region and --output are stripped before reaching the AWS CLI.

​
Linear (GraphQL)

Send GraphQL queries to Linear. Pass the query inline as a string or load it from a file.

​
Sentry (REST)

Send REST requests to the Sentry API. The path is appended to the Sentry base URL.

​
Datadog (REST)

Send REST requests to the Datadog API. The path is appended to the Datadog base URL.

​
Multiple integrations

When your organization has more than one integration for the same provider (for example, two separate GitHub App installations), pass --integration <id> to tell Tolmo which credentials to use. Integration IDs are shown in the output of tolmo query list.

​
Select an AWS account

When multiple AWS integrations are connected, select one by integration ID or account ID:

​
Fly.io CLI passthrough

Use fly or flyctl after the required separator. The CLI runs locally and routes supported requests through Tolmo’s proxy:

​
GraphQL variables

Pass repeatable --var key=value arguments with --file. Values are parsed as JSON when possible. Quote a JSON-looking value as a JSON string when you need to preserve it as text: