Commands

General

Log in to Latitude.sh

lsh login

Opens your browser for browser-assisted authentication. To authenticate with an API key instead, pass it as an argument:

lsh login --with-token <API_KEY>

Update the CLI to latest version

lsh update

Generate a shell completion script

lsh completion <bash|zsh|fish|powershell>

Api Keys

Create an API Key

lsh api_keys create

Delete an API Key

lsh api_keys destroy

List API Keys

lsh api_keys list

Update an API Key

lsh api_keys update

Auth

Show the current authentication context

lsh auth status

Shows the active profile’s email, team and API key, plus every other stored profile. Pass --check to validate each stored token against the API. Log out

lsh auth logout

Removes the stored profile and, for browser logins, revokes the API key. Pass --profile <NAME> to log out a specific profile, or --all to log out every stored profile.

Elastic IPs

List Elastic IPs

lsh elastic-ips list

Lists all Elastic IPs in the team. ls is available as an alias. Filter with --project, --server, and --status, where status is one of configuring, active, moving, releasing, or error. Retrieve an Elastic IP

lsh elastic-ips get <ELASTIC_IP_ID>

Create an Elastic IP

lsh elastic-ips create --project <PROJECT_ID_OR_SLUG> --server <SERVER_ID>

Both --project and --server are required: the API allocates the IP in the target server’s region and assigns it there. Allocation is asynchronous, so the new IP starts in the configuring status until provisioning completes. Move an Elastic IP to another server

lsh elastic-ips update <ELASTIC_IP_ID> --server <SERVER_ID>

Reassigns the Elastic IP to another server in the same project. Delete an Elastic IP

lsh elastic-ips delete <ELASTIC_IP_ID>

Releases the Elastic IP. rm is available as an alias.

Events

List team audit events

lsh events list

Lists the team’s audit events, newest first, with automatic pagination. Filter the results with --author (ID or email), --project (ID or slug), --target-type (repeatable, e.g. servers, projects, virtual_networks), --target-id, and --action (e.g. servers.create). Use --since and --until to scope the time range. Both accept either a relative duration looking back from now (24h, 7d, 2w) or an ISO date (2026-06-01):

lsh events list --since 24h --target-type servers
lsh events list --author user@example.com --action servers.create
lsh events list --project my-project --since 2026-06-01

Pass --follow (or -f) to stream new events in real time instead of printing a one-time list. The command keeps polling and prints each new event as it happens until you stop it with Ctrl+C. Combine it with the usual filters to watch a single resource:

lsh events list --follow --target-id sv_xxxx

--follow streams plain text only: -o json, -o yaml, and -o csv are ignored with a warning, and --until is ignored because the stream has no end. Following starts from the current moment unless you pass --since to replay recent history before streaming.

Firewalls

List firewalls

lsh firewalls list

Lists all firewalls in the team. ls is available as an alias. Filter by project with --project <PROJECT_ID_OR_SLUG>. In the interactive table, press Enter on a row to expand that firewall’s rules. Retrieve a firewall

lsh firewalls get <FIREWALL_ID>

Create a firewall

lsh firewalls create --name <NAME> --project <PROJECT_ID_OR_SLUG>

--name and --project are both required. Add rules with --rules, passing either an inline JSON array or a file with @path/to/rules.json:

echo '[{"from":"ANY","to":"ANY","protocol":"TCP","port":"22","description":"SSH"}]' > rules.json
lsh firewalls create --name web --project my-project --rules @rules.json

Each rule accepts from, to, protocol (TCP or UDP), port (a single port or a range), and an optional description. Update a firewall

lsh firewalls update <FIREWALL_ID> --name <NAME>

Pass --name, --rules, or both — at least one is required. Passing --rules replaces the firewall’s entire rule set; pass [] to clear all rules. Delete a firewall

lsh firewalls delete <FIREWALL_ID>

rm is available as an alias.

Firewall assignments

An assignment attaches a firewall to a server so the firewall’s rules apply to that server’s traffic. Assign a server to a firewall

lsh firewalls assignments create --firewall <FIREWALL_ID> --server <SERVER_ID>

List firewall assignments

lsh firewalls assignments list --firewall <FIREWALL_ID>

With --firewall, lists the assignments of a single firewall. Omit it to list every firewall assignment in the team, optionally filtered by --server <SERVER_ID>. Remove a firewall assignment

lsh firewalls assignments delete <ASSIGNMENT_ID> --firewall <FIREWALL_ID>

rm is available as an alias.

IPs

List IP addresses of a project

lsh ips list --project <PROJECT_ID_OR_SLUG>

Pass --all-projects to list IPs across every project you have access to. Filter with --server, --family, --type and --location. Retrieve an IP address

lsh ips get <IP_ID>

Kubernetes

Manage Kubernetes clusters, list available versions, and fetch a cluster’s kubeconfig. k8s is available as an alias: lsh k8s clusters list. List clusters

lsh kubernetes clusters list --project <PROJECT_ID>

Lists the Kubernetes clusters in a project. This endpoint accepts the project ID (proj_xxx) only — it does not resolve slugs. ls is available as an alias. Retrieve a cluster

lsh kubernetes clusters get <CLUSTER_ID>

Create a cluster

lsh kubernetes clusters create --project <PROJECT_ID> --region <LOCATION> --plan <PLAN>

--project, --region (site code, e.g. SAO2), and --plan (the control-plane node plan) are required. Optional flags: --worker-plan (defaults to the control-plane plan), --worker-count (defaults to 1), --control-plane-count (defaults to 1), --kubernetes-version (defaults to the latest supported), --ssh-keys (SSH key IDs, repeatable), --os, and --name (auto-generated if omitted). By default the command returns as soon as the request is accepted. Pass --wait to block until the cluster is provisioned instead. The wait fails fast if the cluster enters a failed phase, and --timeout (default 10m) caps how long it waits.

lsh kubernetes clusters create --project <PROJECT_ID> --region SAO2 --plan c2-small-x86 --worker-count 3 --wait

Delete a cluster

lsh kubernetes clusters delete <CLUSTER_ID>

rm is available as an alias: lsh kubernetes clusters rm <CLUSTER_ID>. List available Kubernetes versions

lsh kubernetes versions list

Fetch a cluster’s kubeconfig

lsh kubernetes kubeconfig <CLUSTER_ID>

Prints the cluster’s kubeconfig as raw YAML to stdout. Redirect it to a file to use with kubectl:

lsh kubernetes kubeconfig <CLUSTER_ID> > kubeconfig.yaml

Operating Systems

List operating systems available for deployment

lsh operating-systems list

os is available as an alias: lsh os list.

Plans

Retrieve information of a plan

lsh plans get

List available plans

lsh plans list

List bandwidth package plans

lsh plans list-bandwidth

Show per-location plan availability and stock level

lsh plans stock

Profiles

The CLI stores one profile per team you are logged into. The active profile defines the team your commands run against. List stored profiles

lsh profile list

Switch the active profile

lsh profile use <PROFILE_NAME_OR_TEAM_SLUG>

You can also set the profile for a single command with the global --profile flag or the LSH_PROFILE environment variable.

Projects

Create a project

lsh projects create

Delete a project

lsh projects destroy

Retrieve a project

lsh projects get

List projects

lsh projects list

Update a project

lsh projects update

Regions

List available regions

lsh regions list

Servers

Deploy a bare metal server

lsh servers create

Delete a server

lsh servers destroy

Get information on a server

lsh servers get

List servers

lsh servers list

Reinstall a server

lsh servers reinstall

Wait for a server to finish provisioning By default, servers create and servers reinstall return as soon as the request is accepted. Pass --wait to block until the server settles into a stable state (on or off) instead, which is useful in scripts and CI pipelines where the next step depends on the server being ready.

lsh servers create --project <PROJECT> --site <LOCATION> --plan <PLAN> --operating_system <OS> --hostname <HOSTNAME> --wait

The wait fails fast if the server enters a failed deployment state, and --timeout (default 10m) caps how long it waits — on timeout the command exits with a non-zero status. Progress is written to stderr while the final server state goes to stdout, so -o json, -o yaml, and -o csv are still honored.

lsh servers create ... --wait --timeout 30s

Power on, off, or reboot a server

lsh servers power-on <SERVER_ID>
lsh servers power-off <SERVER_ID>
lsh servers reboot <SERVER_ID>

Each power action is its own subcommand. Pass --wait to block until the server reaches the target power state — on for power-on and reboot, off for power-off — instead of returning as soon as the request is accepted. power-on and power-off return immediately when the server is already in the target state, while reboot waits to observe the power cycle. As with provisioning, --timeout (default 10m) caps the wait, progress is written to stderr, and the wait fails fast if the server enters a failed deployment state.

lsh servers reboot <SERVER_ID> --wait

Boot a server into rescue mode

lsh servers rescue-mode <SERVER_ID>
lsh servers exit-rescue-mode <SERVER_ID>

rescue-mode reboots the server into a lightweight recovery environment, and exit-rescue-mode reboots it back into its installed operating system. Both accept --wait: rescue-mode waits for the server to reach the rescue_mode state, and exit-rescue-mode waits for it to settle back to on or off. The API doesn’t return the rescue login credentials — find them on the server’s page in the dashboard. See Rescue mode for the full recovery workflow. Lock or unlock a server

lsh servers lock <SERVER_ID>
lsh servers unlock <SERVER_ID>

Locking a server prevents destructive actions such as deletion, reinstall, and power changes. Unlock it to allow those actions again. Schedule deletion

lsh servers schedule-deletion

Unschedule deletion

lsh servers unschedule-deletion

Update a server

lsh servers update

SSH Keys

The lsh ssh-keys commands manage your team’s SSH keys at the account level. To manage the keys inside a specific project, use lsh projects ssh-keys instead. The legacy ssh_keys name still works as a hidden alias. List SSH keys

lsh ssh-keys list

Filter by tag with --tags <TAG_ID>. Lists paginate automatically; use --page-size, --max-items, or --no-paginate to control paging. ls is available as an alias. Retrieve an SSH key

lsh ssh-keys get <SSH_KEY_ID>

Create an SSH key

lsh ssh-keys create --name <NAME> --public-key "ssh-ed25519 AAAA..."

Both --name and --public-key are required. Update an SSH key

lsh ssh-keys update <SSH_KEY_ID> --name <NAME>

Only the flags you pass are changed. Pass --name to rename the key and --tags <TAG_ID> (repeatable) to associate tags. Delete an SSH key

lsh ssh-keys delete <SSH_KEY_ID>

rm is available as an alias. Manage a project’s SSH keys

lsh projects ssh-keys list --project <PROJECT_ID_OR_SLUG>
lsh projects ssh-keys get <SSH_KEY_ID> --project <PROJECT_ID_OR_SLUG>
lsh projects ssh-keys create --project <PROJECT_ID_OR_SLUG> --name <NAME> --public-key "ssh-ed25519 AAAA..."
lsh projects ssh-keys delete <SSH_KEY_ID> --project <PROJECT_ID_OR_SLUG>

The projects ssh-keys commands (list, get, create, and delete) manage SSH keys scoped to a project. create adds a new key to the project and delete removes it entirely, rather than detaching a team key. Commands default to the active project, so --project is optional once one is set.

Storage Filesystems

Manage file storage volumes in a project. Filesystems are created from the dashboard; the CLI lists, resizes, and deletes them. List filesystems

lsh storage-filesystems list --project <PROJECT_ID_OR_SLUG>

ls is available as an alias. Pass --project to filter to a single project. Resize a filesystem

lsh storage-filesystems update <FILESYSTEM_ID> --size <SIZE_IN_GB>

Size is the only field you can update. --size is required and must be a positive number of GB; otherwise the command fails before making any request. Delete a filesystem

lsh storage-filesystems delete <FILESYSTEM_ID>

rm is available as an alias.

Storage Objects

Manage S3-compatible object storage buckets in a project. List buckets

lsh storage-objects list --project <PROJECT_ID_OR_SLUG>

ls is available as an alias. Pass --project to filter to a single project. Retrieve a bucket

lsh storage-objects get <BUCKET_ID>

Create a bucket

lsh storage-objects create --project <PROJECT_ID_OR_SLUG> --name <NAME> --region <SITE_SLUG>

--project, --name, and --region are required. --region takes a site slug (for example, DAL). Optionally pass --storage-class (standard or high_performance), --versioning to enable object versioning, and --locking to enable object lock (WORM). Object lock requires versioning, so --locking enables it automatically.

lsh storage-objects create --project my-project --name logs --region DAL --storage-class high_performance --versioning

Delete a bucket

lsh storage-objects delete <BUCKET_ID>

rm is available as an alias.

Traffic

Show traffic consumption

lsh traffic list --project <PROJECT_ID_OR_SLUG>

Shows bandwidth consumption per region for a project, mirroring the dashboard: inbound and outbound totals, the quota, and how much of it has been used. Units follow the project’s billing method — TB for volume billing, Mbps for 95th-percentile billing. A project is required; in an interactive terminal you’re prompted to pick one when --project is omitted. The range defaults to the last 7 days. Override it with --since and --until, which accept a duration (24h, 7d, 2w) or an ISO date (2026-06-01). The range applies to consumption only — the quota column always reflects the current limit. Pass --daily for the day-by-day breakdown behind the dashboard chart.

lsh traffic list --project my-project --daily
lsh traffic list --project my-project --since 30d
lsh traffic list --project my-project --since 2026-05-01 --until 2026-06-01

Show traffic quota

lsh traffic quota

Shows the traffic quota of each project, per region. Pass --project to filter to a single project.

Teams

Team and member operations are interactive: when you omit an argument or required flag, the CLI prompts you for it in the terminal.

List your teams

lsh teams list

Create a team

lsh teams create --name <NAME> --currency <USD_OR_BRL>

Update a team

lsh teams update <TEAM_ID> --name <NAME>

List members of the current team

lsh teams members list

Invite a user to the current team

lsh teams members add --email <EMAIL> --role <ROLE>

Roles: owner, administrator, collaborator or billing. Remove a user from the current team

lsh teams members remove <USER_ID>

User Data

The lsh user-data commands manage your team’s user data scripts at the account level. To manage the user data inside a specific project, use lsh projects user-data instead. The API stores user data content base64-encoded. To keep things simple, --content takes plain text and encodes it for you, while --content-base64 passes an already-encoded value through unchanged. The two flags are mutually exclusive. List user data

lsh user-data list

ls is available as an alias. Lists show a compact table without the base64 content, and paginate automatically; use --page-size, --max-items, or --no-paginate to control paging. Retrieve a user data entry

lsh user-data get <USER_DATA_ID>

The details view decodes and shows the cloud-init content, and is scrollable for longer scripts. Create a user data entry

lsh user-data create --description <DESCRIPTION> --content "#cloud-config"

--description is required. Pass the script with either --content (plain text) or --content-base64 (already encoded). Update a user data entry

lsh user-data update <USER_DATA_ID> --description <DESCRIPTION>

Only the flags you pass are changed. Provide at least one of --description or --content/--content-base64. Delete a user data entry

lsh user-data delete <USER_DATA_ID>

rm is available as an alias. Manage a project’s user data

lsh projects user-data list --project <PROJECT_ID_OR_SLUG>
lsh projects user-data get <USER_DATA_ID> --project <PROJECT_ID_OR_SLUG>
lsh projects user-data create --project <PROJECT_ID_OR_SLUG> --description <DESCRIPTION> --content "#cloud-config"
lsh projects user-data update <USER_DATA_ID> --project <PROJECT_ID_OR_SLUG> --description <DESCRIPTION>
lsh projects user-data delete <USER_DATA_ID> --project <PROJECT_ID_OR_SLUG>

The projects user-data commands manage user data scoped to a project, with the same --content and --content-base64 handling as the account-level commands. Commands default to the active project, so --project is optional once one is set. Unlike the other list commands, projects user-data list returns a single page; the pagination flags are accepted but have no effect.

Virtual Machines

vm and vms are available as aliases: lsh vm list, lsh vms get <VM_ID>. List virtual machines

lsh virtual-machines list

Lists every virtual machine in the team. Filter with --project <PROJECT_ID_OR_SLUG> and --tags <TAG_ID> (repeatable or comma-separated). Retrieve a virtual machine

lsh virtual-machines get <VM_ID>

Create a virtual machine

lsh virtual-machines create --plan <PLAN_ID> --project <PROJECT_ID_OR_SLUG>

--plan and --project are required. Pass the plan ID (plan_xxx) — virtual machine plans have no slug. Optional flags: --name (hostname), --region (site slug, e.g. DAL; defaults to DAL), --os (operating system slug), --ssh-keys (SSH key IDs, repeatable), --user-data (a user data record reference such as ud_xxx, applied as cloud-init), and --tags (tag IDs, repeatable). By default the command returns as soon as the request is accepted. Pass --wait to block until the VM reaches the Running state instead. --timeout (default 10m) caps the wait; on timeout the command exits with a non-zero status. Progress is written to stderr and the final state to stdout, so -o json, -o yaml, and -o csv are honored.

lsh virtual-machines create --plan <PLAN_ID> --project <PROJECT> --region DAL --name my-vm --wait

Update a virtual machine

lsh virtual-machines update <VM_ID> --name <NAME>

Updates the virtual machine’s name or tags. Pass --name and/or --tags (tag IDs; replaces all existing tags) — at least one is required. Run a power action

lsh virtual-machines action <VM_ID> --action <power_on|power_off|reboot>

--action is required and must be one of power_on, power_off, or reboot. Delete a virtual machine

lsh virtual-machines delete <VM_ID>

rm is available as an alias: lsh virtual-machines rm <VM_ID>.

Virtual Networks

Creates a virtual network

lsh virtual_networks create

Delete a virtual network

lsh virtual_networks destroy

Retrieve a virtual network

lsh virtual_networks get

List virtual networks

lsh virtual_networks list

Update a virtual network

lsh virtual_networks update

Virtual Networks Assignments

Assign a server to a virtual network

lsh assignments virtual_networks create

Unassign a server from a virtual network

lsh assignments virtual_networks destroy

List assignments

lsh assignments virtual_networks list

Help

Use lsh -h to get a list of all available commands
To see how to use a command, use lsh <resource> -h

The CLI also ships built-in help topics with longer guides:

lsh authentication   # How to sign in: tokens, profiles, env vars
lsh profiles         # How profiles map to teams
lsh automation       # Run lsh non-interactively (CI, scripts, AI agents)
lsh output-formats   # Render results as table, JSON, YAML or CSV (with JMESPath queries)

See Output formats & automation for the full guide to machine-readable output, --query filtering, and pagination.

Developer resources

Tools

General

Api Keys

Auth

Elastic IPs

Events

Firewalls

Firewall assignments

IPs

Kubernetes

Operating Systems

Plans

Profiles

Projects

Regions

Servers

SSH Keys

Storage Filesystems

Storage Objects

Tags

Traffic

Teams

User Data

Virtual Machines

Virtual Networks

Virtual Networks Assignments

Help

​General

​Api Keys

​Auth

​Elastic IPs

​Events

​Firewalls

​Firewall assignments

​IPs

​Kubernetes

​Operating Systems

​Plans

​Profiles

​Projects

​Regions

​Servers

​SSH Keys

​Storage Filesystems

​Storage Objects

​Tags

​Traffic

​Teams

​User Data

​Virtual Machines

​Virtual Networks

​Virtual Networks Assignments

​Help

General

Api Keys

Auth

Elastic IPs

Events

Firewalls

Firewall assignments

IPs

Kubernetes

Operating Systems

Plans

Profiles

Projects

Regions

Servers

SSH Keys

Storage Filesystems

Storage Objects

Tags

Traffic

Teams

User Data

Virtual Machines

Virtual Networks

Virtual Networks Assignments

Help