UiPath platform ops via the uip CLI — use for ANY task hitting UiPath Cloud / Orchestrator / Studio Web / Integration Service / Data Fabric / LLM Gateway. Load BEFORE writing code that calls a UiPath API. Covers auth, folders, assets, queues, storage buckets, libraries, webhooks, triggers, processes, jobs, machines, users, roles, sessions, calendars, IS connectors/connections/activities, Data Fabric entities/records/files/choice-sets (`uip df`), BYO LLM product configurations, BYO guardrail (BYOG) configurations, context grounding, traces (execution traces and spans + trace feedback / annotation), licensing. For 'why did X fail' / root-cause→uipath-troubleshoot. For org/tenant audit trail / audit logs / login history→uipath-admin. For `uip solution` lifecycle→uipath-solution. For PDD/SDD design→uipath-planner. For workflow code (.xaml/.cs)→uipath-rpa, .flow (incl. Data Fabric connector nodes)→uipath-maestro-flow, .bpmn→uipath-maestro-bpmn, agents (.py/agent.json)→uipath-agents, Test Manager→uipath-test.
when_to_use
User mentions UiPath / Orchestrator / Studio Web / Integration Service / Data Fabric / LLM Gateway / 'uip' CLI / asset / queue / bucket / library / webhook / trigger / connector / connection / tenant / folder / robot / package / entity / record / choice set / trace / span / trace feedback / BYO LLM / BYO guardrail / BYOG. Also 'upload to UiPath', 'create asset', 'start job', 'list queues', 'deploy a single package to Orchestrator', 'OAuth2 token', 'list trace spans / add trace feedback', 'create entity', 'add field', 'delete field', 'list entities', 'insert record', 'update record', 'delete record', 'query Data Fabric', 'search records', 'show every <thing> tagged/where', 'filter records by tag/choice/field', 'count by group', 'unique tag combinations', 'group by field', 'aggregate COUNT/SUM/AVG', 'create choice-set', 'create choiceset', 'add choice set values', 'delete choice set', 'attach file to record', 'upload/download/delete file on entity record', 'swap record attachment', 'import CSV', 'load CSV into entity/list', 'load spreadsheet into entity', 'bulk load records from CSV', 'bulk import from CSV', 'register my own LLM key', 'configure a model substitution', 'my BYO LLM key stopped working / returns errors', 're-probe / audit a BYO configuration', 'list bring-your-own guardrail configurations', 'register/enable/disable/delete a BYOG guardrail configuration', 'who registered this BYOG guardrail', 'uipath.com REST'. For `uip solution` ops or `.uipx` deploys→uipath-solution. For Data Fabric connector nodes inside a `.flow`→uipath-maestro-flow.
allowed-tools
Bash, Read, Write, Glob, Grep, Skill
UiPath Platform — uip CLI Assistant
Comprehensive guide for UiPath Cloud / Orchestrator / Studio Web / Integration Service, end-to-end via the uip CLI. For uip solution lifecycle load uipath-solution; for PDD/SDD design & task planning load uipath-planner.
Route Diagnostic Intent Before Platform Work
Classify the requested outcome before running any command:
Causal outcome → hand off immediately. User wants an explanation, diagnosis, or root cause for undesirable existing behavior → invoke the Skill tool with uipath-troubleshoot (name exactly as it appears in your available-skills list) before running anything. No preliminary job/log/trace fetching — troubleshoot owns evidence collection. Prose telling the user to use troubleshoot is not a substitute for the Skill call.
Operational outcome → stay here. Inspect current state without a causal question, perform CRUD or lifecycle actions, validate an input before applying it, or execute an already-diagnosed platform fix.
Mixed request → troubleshoot first. Hand off the diagnosis; return here only for the platform mutation that applies the confirmed fix.
Sibling unavailable → degrade gracefully. State the handoff could not run; give the entity, scope, and time window needed to retry the investigation. Do not improvise a platform-only root cause.
Use the CLI. Don't roll your own REST.
Always reach for uip CLI commands first. The CLI covers auth, Orchestrator (folders, processes, jobs, machines, users, roles, sessions, calendars, settings, audit logs, credential stores, feeds, attachments), resources (assets, queues, queue items, storage buckets, bucket files, libraries, webhooks, triggers), Integration Service (connectors, connections, activities, IS triggers), traces, and licensing end-to-end.
Hand-rolling HTTP calls — reading ~/.uipath/.auth and POSTing to /odata/... or /orchestrator_/... — almost always misses something the CLI gets right: the X-UIPATH-OrganizationUnitId folder header, OData filter shape (Key eq '...' with escaped single quotes), pagination envelope, retry semantics, validation error shape, or Result/Code/Data output contract. Reach for raw REST only after you've searched for your task and confirmed no command covers it. The CLI is the source of truth.
references/uip-commands.md
uip
If you find yourself about to curlhttps://cloud.uipath.com/... — stop. Search the command index first. Examples of what people often miss:
"upload a file to a storage bucket" → uip or bucket-files upload (NOT a PUT /buckets/.../signedUrl dance)
"create an asset" → uip or assets create (NOT a POST /odata/Assets)
"start a job for a process" → uip or jobs start <process-key> (NOT POST /odata/Jobs/UiPath.Server.Configuration.OData.StartJobs)
"configure an Integration Service connection" → uip is connections create <connector-key> (NOT a hand-rolled OAuth flow)
"attach a file to a Data Fabric record" → uip df files upload <entity-id> <record-id> <field-name> --file <path> (NOT records insert / records update with the file value — the platform silently strips FILE columns and returns Success, see references/data-fabric/data-fabric.md Rule 6)
When to Use This Skill
Load this skill BEFORE writing any code that talks to UiPath. Specific triggers:
Auth & tenant: login, logout, switch tenant, named login profiles via --profile <name>, ~/.uipath/.auth, OAuth token, organization
Records — insert / update / delete / list / get / query with server-side filters, sorting, pagination, group-by, and aggregates (COUNT, SUM, AVG, MIN, MAX).
DF filter body uses filterGroup.queryFilters[] — full shape in records-query.md.
Files — binary attachments stored on FILE-typed fields via files upload / download / delete (record-level writes silently strip FILE values; the dedicated verbs are mandatory).
Choice sets — shared enumerations consumed by CHOICE_SET_SINGLE / CHOICE_SET_MULTIPLE fields; values use immutable integer NumberIds, not labels.
Folder scoping — tenant-level OR folder-scoped via --folder-key <GUID> on every write, --include-folders on entities list / choice-sets list.
CSV bulk import — uip df records import <entity-id> --file <path.csv> --output json. Basic field types only; complex fields (CHOICE_SET, RELATIONSHIP, FILE, AUTO_NUMBER) require records insert --file <json>.
For Query / Create / Update / Delete / GetById connector nodes inside a .flow, hand off to uipath-maestro-flow — that skill owns the in-flow node JSON, bindings_v2.json, and connection-resource layout.
LLM Gateway — BYO product configurations: uip llm-configuration byo-connections (list / get / create / update / delete / list-product-configs). Register tenant-owned OpenAI / Azure OpenAI / AWS Bedrock / Google Vertex / Anthropic / OpenAI-compatible keys against UiPath product features (agents, agenthub, jarvis, IXP, agent builder, ECS). Two input shapes: single-mapping (for AnyModelWithOwnAdditions features) and repeated --mapping (required for AllModels / AnyModel). Server-side validation is mandatory.
LLM Gateway — diagnose a failing BYO config: re-probe the underlying IS connection with byo-connections get <id> --force-refresh, force a fresh server-side probe with an idempotent update, audit the tenant with list --include-connection-details filtered on connectionState != Enabled, check catalog drift with list-product-configs, and cross-reference trace evidence with uip traces spans get <trace-id>. The gateway does not expose per-request invocation logs via CLI — diagnosis is current-state + trace evidence only. See references/llmgateway/byo-connections.md § Diagnostics. For tenant-wide AI Trust Layer policy that may be overriding routing, see uipath-governance.
AI Trust Layer — BYO guardrail (BYOG) configurations: uip guardrails byo-configurations (list / list-validators / probe / create / update / delete) — manage tenant-registered external guardrail validator providers (e.g. Azure AI Content Safety, Databricks AI Guardrails), each backed by an Integration Service connection. ValidatorName is tenant-unique and is the only value agents reference (ByoValidator(<ValidatorName>) — the connection resolves server-side). Before creating, list (the name must be free) and uip is connections list (for --connection-id); create always probes the connection/validator pair server-side and aborts if the probe fails, with no skip flag, and update re-probes whenever --connection-id changes. probe and list-validators test a pairing without saving anything; update merges supplied fields and can flip --enabled/--disabled; delete requires --force; no get verb. See references/guardrails/byo-configurations.md. For authoring a guardrail against one of these configurations (low-code or coded), see uipath-agents.
Traces: uip traces spans get <trace-id> (LLM/agentic execution observability)
Context grounding: knowledge indexes for semantic search / RAG — uip context-grounding (list / create from a bucket or connection / ingest / retrieve to poll ingestion status / search / delete). Agents and flows consume these indexes as tools. See references/context-grounding/index-management.md.
Platform licensing: tenant license allocations, user/group bundle assignments, consumables reporting (uip platform tenants licenses, users licenses, groups rules, licenses consumables get — the only consumables verb; summary/daily/folders are --mode values)
Named profiles store credentials at ~/.uipath/profiles/<name>/.auth. Use named profiles when the user asks to keep multiple UiPath logins on the same machine:
uip login --profile dev --output json
uip login status --profile dev --output json
uip login which --profile dev --output json
Rules:
--profile <name> is a global option. Pass it on every uip command that should use that login, for example uip --profile dev or folders list --output json.
default means the built-in unprofiled login and maps back to ~/.uipath/.auth.
Profile names may contain only letters, numbers, ., _, and -. Never use paths like ../prod.
--profile and auth-command --file <folder> are mutually exclusive. Use one or the other.
A missing named profile does not fall back to ~/.uipath/.auth or Robot credentials. Tell the user to run uip login --profile <name>.
These tokens can be reused for direct Orchestrator REST API calls when CLI commands don't cover a use case. If a named profile is active, read the path from uip login which --profile <name> --output json rather than assuming ~/.uipath/.auth.
Quick Start
Step 1 — Authenticate
Before interacting with Orchestrator, solutions, or Integration Service, the user must be logged in.
Always check first — most sessions are already authenticated:
uip login status --output json
If it reports Logged in, skip the rest of this step. There is no --check flag — status is the verification subcommand.
If the user names a profile, check that profile explicitly:
uip login status --profile dev --output json
Interactive login (browser OAuth2):uip login opens a browser window on the user's machine and blocks until they complete it. Never run an interactive login through your own shell tool — with or without --no-browser. Run by an agent, the person who must sign in sees only a spinner: the printed URL and the blocking wait live in your tool output, not in front of them. --no-browser does not make the command agent-runnable — it exists for automation that opens the URL itself; it still blocks until the sign-in callback arrives, and relaying the printed URL by copy/paste is fragile (a line-wrapped or truncated copy is rejected by the identity server with an opaque browser-side error). Instead, ask the user to run the command directly in their own terminal — in Claude Code, prefixing it with ! runs it inside the session:
! uip login
Then confirm with uip login status --output json once they say it's done. If a retry fails with EADDRINUSE / "Port 8104 is already in use", an abandoned earlier attempt is still holding the callback port — it releases itself within 5 minutes, or the user can end the stale uip login process.
Some operations (creating projects, validating, running workflows, packing) require UiPath Studio. When Studio is needed:
Check for a running instance first:
rpa-tool list-instances --output json
If no instance is running, try the standard install location:
rpa-tool start-studio --output json
If that fails (version too old, not found, etc.) — ASK THE USER where their Studio build is located. Do NOT search the entire filesystem. Common locations include:
C:\Program Files\UiPath\Studio
A dev build directory (e.g., dev4/Studio/Output/bin/Debug)
Use a named auth profile from ~/.uipath/profiles/<name>/.auth
built-in default login
--verbose
Enable verbose/debug logging
Off
--help / -h
Display help for the command
--
--version / -v
Display CLI version
--
Always use --output json when calling uip commands programmatically. JSON is compact and machine-readable.
To narrow list results, use the noun's own filter flag (--state Faulted, --type Text, --status New, --name, --process-name, --search). The backend filters before sending; pagination stays correct. Per-noun flags: references/uip-commands.md. Never list-everything-then-filter-mentally.
Use --output-filter (JMESPath) for output reshaping or for fields with no server-side flag — e.g., --output-filter "Data[].{id: id, name: name}", or filtering by a derived/computed value. Don't reach for it when the server already has a filter for that attribute.
Deployment Notes
Starting jobs requires runtimes. If you get error 2818 "no runtimes configured", the target folder needs machine templates with Unattended/Development runtimes assigned.
For uip solution pack / publish / deploy / activate flows, load uipath-solution. This skill owns the auth and Orchestrator surface those flows depend on; the solution skill owns the lifecycle commands.
