> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query Connected Services Through Tolmo's Secure Proxy

> Proxy REST, GraphQL, and CLI requests to GitHub, AWS, Linear, Sentry, and Datadog through Tolmo. Credentials are resolved server-side and never exposed.

The `tolmo query` command proxies requests to your organization's connected services. Credentials are resolved on the backend — they never leave the server, and your local machine never sees a token or secret key. Tolmo supports GitHub, AWS, Linear, Sentry, Datadog, and any additional providers your org connects. All subcommands accept the global `--org` flag to target a specific organization.

## Discover available services

Before querying a service, use `tolmo query list` to see which providers are connected for your organization.

```bash theme={null}
# List connected services for the active org
tolmo query list

# List connected services for a specific org
tolmo query list --org superset
```

Providers are discovered dynamically from the backend. New backend adapters become available without any CLI update on your end.

## GitHub (REST)

Send REST requests directly to the GitHub API. Tolmo injects the org's GitHub App credentials on the backend.

```bash theme={null}
# List pull requests for a repository
tolmo query github /repos/owner/repo/pulls?state=all

# Search issues and PRs across an org
tolmo query github /search/issues?q=type:pr+org:myorg
```

## GitHub CLI passthrough

`tolmo query -- gh ...` runs your locally installed `gh` CLI with a short-lived token injected by the backend via a Unix socket proxy. This gives you the full `gh` feature set — including pagination, `--jq`, `--template`, and `gh api` — backed by the org's GitHub App credentials rather than your personal token.

<Warning>
  The `--` separator between `tolmo query` and `gh` is **mandatory**. Without it, the Cobra argument parser strips unknown flags (like `--repo`, `--limit`, or `--state`) before they ever reach `gh`, causing unexpected errors or silent failures.
</Warning>

```bash theme={null}
# List repositories in an org
tolmo query -- gh repo list myorg --limit 50

# Search PRs with a date range using full gh api syntax
tolmo query -- gh api search/issues -f "q=type:pr org:myorg created:2026-01-01..2026-03-01" -f per_page=100

# List open issues with JSON output
tolmo query -- gh issue list --repo myorg/myrepo --state open --json number,title

# Use a different org's GitHub credentials
tolmo query --org superset -- gh api /repos/superset-sh/superset/pulls?state=all&per_page=5
```

## AWS CLI passthrough

`tolmo query -- aws ...` runs your locally installed AWS CLI with credentials injected by the backend proxy. You get full AWS CLI functionality without any local credential configuration.

<Warning>
  The `--` separator is **mandatory** here too. Without it, flags like `--region` and `--output` are stripped before reaching the AWS CLI.
</Warning>

```bash theme={null}
# Describe EC2 instances
tolmo query -- aws ec2 describe-instances

# List S3 buckets
tolmo query -- aws s3 ls

# List IAM roles in a specific region
tolmo query -- aws iam list-roles --region us-east-1

# Query a specific org's AWS environment
tolmo query --org klarify -- aws ec2 describe-security-groups --region ca-central-1
```

## Linear (GraphQL)

Send GraphQL queries to Linear. Pass the query inline as a string or load it from a file.

```bash theme={null}
# Inline GraphQL query
tolmo query linear '{ viewer { id name } }'

# Load a query from a file
tolmo query linear --file query.graphql
```

## Sentry (REST)

Send REST requests to the Sentry API. The path is appended to the Sentry base URL.

```bash theme={null}
# List issues for an organization
tolmo query sentry /api/0/organizations/acme/issues/
```

## Datadog (REST)

Send REST requests to the Datadog API. The path is appended to the Datadog base URL.

```bash theme={null}
# List all monitors
tolmo query datadog /api/v1/monitors
```

## Multiple integrations

When your organization has more than one integration for the same provider (for example, two separate GitHub App installations), pass `--integration <id>` to tell Tolmo which credentials to use. Integration IDs are shown in the output of `tolmo query list`.

```bash theme={null}
# Disambiguate when multiple GitHub integrations exist
tolmo query --integration <id> -- gh repo list

# Disambiguate a direct REST call
tolmo query --integration <id> github /repos/owner/repo/pulls
```