kf feature
Install or disable feature modules and apps for the tenant.
kf feature disable-app
Pause a tenant environment app installation without revoking the install evidence, write an AppInstallation command receipt, emit app.installation.disabled, and pause the matching active FeatureModule activation when present so runtime execution stops while credentials and approvals remain auditable.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--installation-id <value> | no | Installation id. |
--app-id <value> | no | App id. |
--expected-version <value> | yes | Expected version. |
--reason-code <value> | yes | Reason code. |
Example
kf feature disable-app --tenant tnt_demo --actor-type USER --actor-id usr_sam --expected-version <value> --reason-code <value>kf feature install-app
Install a partner App into a tenant environment by validating its manifest, namespace registration, approval receipt, and resolved FeatureModule surface, then writing the active app installation plus immutable app_installation_versions snapshot.
Install a partner App into a tenant environment by validating its manifest, namespace registration, approval receipt, and resolved FeatureModule surface, then writing the active app installation plus immutable app_installation_versions snapshot. Activation remains a separate FeatureActivationEngine step that re-checks the snapshot hash.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--manifest <value> | yes | Manifest. |
--approved-scopes <value> | no | Approved scopes. |
--approval-receipt-id <value> | yes | Approval receipt id. |
Example
kf feature install-app --tenant tnt_demo --actor-type USER --actor-id usr_sam --manifest <value> --approval-receipt-id <value>kf feature revoke-app
Revoke a tenant environment app installation with expected-version protection, write an AppInstallation command receipt, emit app.installation.revoked, pause the matching active FeatureModule activation when present, and revoke app-linked connector bindings while clearing stored credential refs so the install gate fails closed on the next activation attempt.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--installation-id <value> | no | Installation id. |
--app-id <value> | no | App id. |
--expected-version <value> | yes | Expected version. |
--reason-code <value> | yes | Reason code. |
Example
kf feature revoke-app --tenant tnt_demo --actor-type USER --actor-id usr_sam --expected-version <value> --reason-code <value>