a7 is a command-line tool for managing API7 Enterprise Edition API Gateway from your terminal. It wraps both the API7 EE control-plane API (/api/*) and the APISIX admin API (/apisix/admin/*) to provide convenient, scriptable access to gateway groups, routes, services, consumers, SSL certificates, plugins, and more.
- Resource CRUD — Create, list, get, update, and delete current API7 EE resource types:
- Control Plane: Gateway Group
- Runtime: Route, Service, Consumer, SSL Certificate, Plugin, Global Rule, Stream Route, Plugin Metadata, Credential, Secret, Proto
- Context management — Switch between multiple API7 EE instances (
a7 context create,a7 context use,a7 context list) - Gateway group scoping — All runtime operations are scoped to a gateway group via
--gateway-groupflag or context config - Rich output — Human-friendly tables in TTY, machine-readable JSON/YAML in pipes (
--output json|yaml|table) - Shell completions — Bash, Zsh, Fish, PowerShell (
a7 completion) - AI agent skill — an
a7skill that teaches AI coding agents to configure API7 EE through this CLI (npx skills add api7/agent-skills --skill a7)
If you have Go 1.22+ installed:
go install github.com/api7/a7/cmd/a7@latestThis installs the a7 binary to your $GOPATH/bin (or $HOME/go/bin by default). Make sure it's in your PATH.
git clone https://github.com/api7/a7.git
cd a7
make build
# Binary is at ./bin/a7a7installed (see Installation above)- A running API7 Enterprise Edition instance with Admin API access
- An API7 EE access token
# Create a context pointing to your API7 EE instance
a7 context create dev \
--server https://api7ee.example.com \
--token a7ee.your-access-token \
--gateway-group default
# Verify the active context
a7 context current
# List all contexts
a7 context list# List all gateway groups
a7 gateway-group list
# Get details of a specific gateway group
a7 gateway-group get <id> --output json# Create a service with inline upstream
a7 service create -g default -f service.yaml
# Create a route
a7 route create -g default -f route.yaml# List all routes (table output in terminal)
a7 route list
# Get a specific route in JSON
a7 route get <id> --output json
# Get it in YAML
a7 route get <id> --output yaml
# List available plugins
a7 plugin list# Update the route description
a7 route update <id> \
--name my-route \
--desc "Updated route for API v1"# Delete the route and service
a7 route delete <id> -g default --force
a7 service delete <id> -g default --force| Command | Description |
|---|---|
a7 version |
Print CLI version |
a7 completion <shell> |
Generate shell completions (bash, zsh, fish, powershell) |
a7 context create |
Create a connection context |
a7 context list |
List all contexts |
a7 context use <name> |
Switch active context |
a7 context current |
Show current context |
a7 context delete <name> |
Delete a context |
| Command | Alias | Actions | Description |
|---|---|---|---|
a7 gateway-group |
gg |
list, get, create, update, delete | Manage gateway groups |
| Command | Alias | Actions | Description |
|---|---|---|---|
a7 route |
rt |
list, get, create, update, delete | Manage routes |
a7 service |
svc |
list, get, create, update, delete | Manage runtime services |
a7 consumer |
c |
list, get, create, update, delete | Manage consumers |
a7 ssl |
— | list, get, create, update, delete | Manage SSL certificates |
a7 plugin |
pl |
list, get | Manage plugins |
a7 global-rule |
gr |
list, get, create, update, delete | Manage global rules |
a7 stream-route |
sr |
list, get, create, update, delete | Manage stream routes |
a7 plugin-metadata |
pm |
get, create, update, delete | Manage plugin metadata |
a7 credential |
cred |
list, get, create, update, delete | Manage consumer credentials |
a7 secret |
sec |
list, get, create, update, delete | Manage secret providers |
a7 proto |
pb |
list, get, create, update, delete | Manage protobuf definitions |
a7 supports API7 EE access tokens via the X-API-KEY header.
Precedence (highest to lowest):
--tokenflagA7_TOKENenvironment variable- Context config (
~/.config/a7/config.yaml)
| Prefix | Type | Scope |
|---|---|---|
a7ee |
Access Token | Full control-plane + admin API |
Config file: ~/.config/a7/config.yaml
current-context: dev
contexts:
- name: dev
server: https://api7ee.dev.example.com
token: a7ee.xxxxx
gateway-group: default
- name: prod
server: https://api7ee.prod.example.com
token: a7ee.yyyyy
gateway-group: production
tls-skip-verify: false
ca-cert: /path/to/ca.pemOverride the config directory with A7_CONFIG_DIR or XDG_CONFIG_HOME.
| Variable | Description |
|---|---|
A7_TOKEN |
API access token |
A7_SERVER |
Control-plane server URL |
A7_GATEWAY_GROUP |
Default gateway group |
A7_CONFIG_DIR |
Config directory path |
NO_COLOR |
Disable color output |
--server API7 EE server URL (overrides context)
--token API access token (overrides context)
--gateway-group Default gateway group (overrides context)
-o, --output Output format: json, yaml (default: table)
- Go 1.22+
- API7 Enterprise Edition 3.x with Admin API enabled
make build # Build binary to ./bin/a7
make test # Run unit tests
make test-verbose # Tests with verbose output
make lint # Run linter
make fmt # Format code
make vet # Run go vet
make check # fmt + vet + lint + test + test-skills
make test-skills # Validate api7/agent-skills examples against the CLI (SKILLS_DIR=...)See AGENTS.md for the full development guide, coding conventions, and how to add new commands.
The a7 agent skill teaches AI coding agents (Claude Code, Cursor, Codex, GitHub Copilot, Windsurf, OpenCode and 70+ others) how to configure API7 Enterprise Edition through the a7 CLI. The skill content lives in the api7/agent-skills repository and is published at skills.sh/api7/agent-skills/a7.
# install into the current project (add -g for a global install, -a <agent> to pick an agent)
npx skills add api7/agent-skills --skill a7Without Node.js, install.sh in this repository copies the skill into ~/.claude/skills/a7 (or --dir <path>):
curl -fsSL https://raw.githubusercontent.com/api7/a7/master/install.sh | shOne skill covers everything; the agent reads the detailed reference for a topic only when a task needs it:
| Category | Count | Examples |
|---|---|---|
| Shared | 1 | Core a7 conventions and patterns |
| Authentication | 5 | key-auth, jwt-auth, basic-auth, hmac-auth, openid-connect |
| Security & Rate Limiting | 4 | ip-restriction, cors, limit-count, limit-req |
| Traffic & Transformation | 5 | proxy-rewrite, response-rewrite, traffic-split, redirect, grpc-transcode |
| AI Gateway | 4 | ai-proxy, ai-prompt-template, ai-prompt-decorator, ai-content-moderation |
| Observability | 6 | prometheus, skywalking, zipkin, http-logger, kafka-logger, datadog |
| Advanced Plugins | 5 | serverless, ext-plugin, fault-injection, consumer-restriction, wolf-rbac |
| Operational Recipes | 5 | blue-green, canary, circuit-breaker, health-check, mTLS |
| Advanced Recipes | 3 | multi-tenant, api-versioning, graphql-proxy |
| Personas | 2 | operator, developer |
Skill content changes go to api7/agent-skills; this repository's CI (make test-skills) validates the shell examples against the current CLI. See docs/skills.md for details.
- Product Requirements
- AI Agent Guide
- AI Agent Skills
- Architecture Decision Record
- API7 EE API Specification
- Golden Example
- Coding Standards
- Testing Strategy
- Development Roadmap
- User Guides — Per-resource guides for all supported resource types
Contributions are welcome. Please see AGENTS.md for development workflow and coding conventions.