aeat config — command reference

This page documents every leaf command under aeat config. Help strings are rendered in English; the CLI respects the active output-language setting at runtime.

aeat config auth apoderado check

Verify against AEAT (unavailable; live reads are sealed). Use ‘status’ for the offline read.

Command path: aeat config auth apoderado check

Registry key: config.auth.apoderado.check

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ApoderadoCheckResult.

aeat config auth apoderado clear

Retire the apoderado configuration

Command path: aeat config auth apoderado clear

Registry key: config.auth.apoderado.clear

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ApoderadoClearResult.

aeat config auth apoderado configure

Set active apoderado configuration

Command path: aeat config auth apoderado configure

Registry key: config.auth.apoderado.configure

Parameters

--represented-nif

Option, required. NIF of the represented party

--scope

Option, required. Scope tokens (can be repeated)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ApoderadoConfigureResult.

aeat config auth apoderado scopes list

List accepted apoderado scopes

Command path: aeat config auth apoderado scopes list

Registry key: config.auth.apoderado.scopes.list

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ApoderadoScopesListResult.

aeat config auth apoderado status

Show active apoderado configuration

Command path: aeat config auth apoderado status

Registry key: config.auth.apoderado.status

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ApoderadoStatusResult.

aeat config auth certificate check

Check expiry/rotation health for every registered certificate source

Command path: aeat config auth certificate check

Registry key: config.auth.certificate.check

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceCheckPayload.

aeat config auth certificate list

List every registered certificate source

Command path: aeat config auth certificate list

Registry key: config.auth.certificate.list

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceListPayload.

aeat config auth certificate register

Register (or re-point) a named certificate source

Command path: aeat config auth certificate register

Registry key: config.auth.certificate.register

Parameters

--name

Option, required. Identifier for this certificate source (e.g. ‘personal’, ‘apoderado-acme’)

--file

Option, required. Path to the PKCS#12 (.p12/.pfx) bundle

--friendly-name

Option, optional. Optional human-readable label distinct from –name

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceMutationPayload.

aeat config auth certificate remove

Remove a registered certificate source

Command path: aeat config auth certificate remove

Registry key: config.auth.certificate.remove

Parameters

--name

Option, required. Registered certificate source to remove

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceMutationPayload.

aeat config auth certificate secret remove

Remove the passphrase bound to a registered certificate source

Command path: aeat config auth certificate secret remove

Registry key: config.auth.certificate.secret.remove

Parameters

--name

Option, required. Registered certificate source whose passphrase should be removed

--backend

Option, optional. Secret backend: secure_storage (default, encrypted at rest) or keyring (OS keychain)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceSecretMutationPayload.

aeat config auth certificate secret set

Set (or rotate) the passphrase for a registered certificate source

Command path: aeat config auth certificate secret set

Registry key: config.auth.certificate.secret.set

Parameters

--name

Option, required. Registered certificate source the passphrase is bound to

--secret

Option, required. The PKCS#12 passphrase (prompted, hidden, never echoed)

--backend

Option, optional. Secret backend: secure_storage (default, encrypted at rest) or keyring (OS keychain)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceSecretMutationPayload.

aeat config auth certificate select

Select the active certificate source

Command path: aeat config auth certificate select

Registry key: config.auth.certificate.select

Parameters

--name

Option, required. Registered certificate source to activate

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.CertificateSourceMutationPayload.

aeat config auth clear

Clear local authentication metadata

Command path: aeat config auth clear

Registry key: config.auth.clear

Parameters

--provider

Option, optional. No description.

--all

Option, optional. Clear all configured auth providers

--sessions

Option, optional. Clear persisted AEAT auth sessions

--locks

Option, optional. Clear auth acquisition locks

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthClearPayload.

aeat config auth configure

Configure the active authentication provider

Command path: aeat config auth configure

Registry key: config.auth.configure

Parameters

--provider

Option, required. Authentication provider id (e.g. certificado-electronico)

--file

Option, optional. Path to the credential file (certificate or key)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthConfigurePayload.

aeat config auth diagnostics list

List encrypted Cl@ve auth diagnostics.

Command path: aeat config auth diagnostics list

Registry key: config.auth.diagnostics.list

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthDiagnosticsListResult.

aeat config auth diagnostics report

Record the operator-observed Cl@ve app state for one auth diagnostic.

Command path: aeat config auth diagnostics report

Registry key: config.auth.diagnostics.report

Parameters

diagnostic_id

Option, required. Diagnostic id.

--phone-state

Option, required. One of: app_prompted_and_accepted, app_prompted_not_accepted, app_did_not_prompt, operator_did_not_check.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthDiagnosticsReportResult.

aeat config auth diagnostics show

Show one redacted encrypted auth diagnostic.

Command path: aeat config auth diagnostics show

Registry key: config.auth.diagnostics.show

Parameters

diagnostic_id

Option, required. Diagnostic id.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthDiagnosticsShowResult.

aeat config auth login

Acquire or verify a live AEAT session

Command path: aeat config auth login

Registry key: config.auth.login

Parameters

--provider

Option, optional. No description.

--fresh

Option, optional. Force a new live authentication instead of reusing a saved AEAT session

--reset-lock

Option, optional. Clear a stale auth acquisition lock before starting

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthLoginPayload.

aeat config auth providers

List supported authentication providers

Command path: aeat config auth providers

Registry key: config.auth.providers

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthProvidersResult.

aeat config auth status

Show configured authentication state

Command path: aeat config auth status

Registry key: config.auth.status

Parameters

--provider

Option, optional. No description.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthStatusPayload.

aeat config auth test

Check local authentication readiness

Command path: aeat config auth test

Registry key: config.auth.test

Parameters

--provider

Option, optional. No description.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.AuthTestPayload.

aeat config check

Check external-dependency availability and the active profile’s service capability posture, with the fix for any gap.

Command path: aeat config check

Registry key: config.check

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._check_payloads.ConfigCheckResult.

aeat config collab recipient add

Register a trusted recipient’s X25519 public key by fingerprint.

Command path: aeat config collab recipient add

Registry key: config.collab.recipient.add

Parameters

recipient_id

Option, required. Stable operator-chosen label (e.g. ‘my-accountant’).

--public-key

Option, required. The recipient’s raw X25519 public key, as 64 lowercase hex characters.

--label

Option, optional. Optional free-text display name for the recipient.

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._collab_payloads.ConfigCollabRecipientAddResult.

aeat config collab recipient list

List every trusted recipient registered on the active profile.

Command path: aeat config collab recipient list

Registry key: config.collab.recipient.list

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._collab_payloads.ConfigCollabRecipientListResult.

aeat config collab recipient remove

Remove one trusted recipient by id from the active profile.

Command path: aeat config collab recipient remove

Registry key: config.collab.recipient.remove

Parameters

recipient_id

Option, required. Stable operator-chosen label (e.g. ‘my-accountant’).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._collab_payloads.ConfigCollabRecipientRemoveResult.

aeat config google credential-source set

Persist the active profile’s Google credential-source selection

Command path: aeat config google credential-source set

Registry key: config.google.credential_source.set

Parameters

--kind

Option, required. Credential source: oauth_desktop (default, interactive consent) or service_account_impersonation (shared SA via ADC + IAM)

--target-principal

Option, optional. Service-account email to impersonate (required for –kind service_account_impersonation)

--scope

Option, optional. OAuth scope requested for the impersonated token (repeatable; defaults to the Sheets/Drive data-access scopes)

--delegate

Option, optional. Chained impersonation delegate service-account email (repeatable)

--subject

Option, optional. Workspace user email to impersonate via domain-wide delegation (optional)

--lifetime-seconds

Option, optional. Requested impersonated token lifetime in seconds (defaults to Google’s 3600s ceiling)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_credential_source_payloads.GoogleCredentialSourceSetResult.

aeat config google credential-source show

Show the active profile’s persisted Google credential-source selection

Command path: aeat config google credential-source show

Registry key: config.google.credential_source.show

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_credential_source_payloads.GoogleCredentialSourceShowResult.

aeat config google folder get

Show the configured Google Drive root folder

Command path: aeat config google folder get

Registry key: config.google.folder.get

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleFolderGetResult.

aeat config google folder set

Bind a Google Drive folder id to the active profile

Command path: aeat config google folder set

Registry key: config.google.folder.set

Parameters

folder_id

Option, required. Google Drive folder id

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleFolderSetResult.

aeat config google login

Run the OAuth consent flow (or refresh an existing credential)

Command path: aeat config google login

Registry key: config.google.login

Parameters

--refresh-only

Option, optional. Skip the consent screen and refresh an existing credential only

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleLoginResult.

aeat config google logout

Clear the refresh token and metadata; preserve the registered client

Command path: aeat config google logout

Registry key: config.google.logout

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleLogoutResult.

aeat config google register

Register a Cloud Console Desktop OAuth client JSON for the active profile

Command path: aeat config google register

Registry key: config.google.register

Parameters

--client-json

Option, required. Path to a Cloud Console Desktop OAuth client JSON file

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleRegisterResult.

aeat config google status

Show the current Google OAuth session state for the active profile

Command path: aeat config google status

Registry key: config.google.status

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleStatusResult.

aeat config google sync calc compute

Pull operator-edited cells from a calc-sheets workbook, run the local Decimal runtime over them, and emit the computed casilla values (persists nothing)

Command path: aeat config google sync calc compute

Registry key: config.google.sync.calc.compute

Parameters

--modelo

Option, required. Modelo id to export (e.g. 130, 303, 100)

--period

Option, required. Filing period code (e.g. 1T, 2T, 0A)

--year

Option, required. Filing year (e.g. 2025)

--spreadsheet-id

Option, required. Drive file id of the workbook to read operator edits from (must be app-owned and bound to the supplied snapshot)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleSyncCalcComputeResult.

aeat config google sync calc export

Export the registry calculation surface for a modelo+period to a Google Sheets workbook in the operator’s aeat-vault/

Command path: aeat config google sync calc export

Registry key: config.google.sync.calc.export

Parameters

--modelo

Option, required. Modelo id to export (e.g. 130, 303, 100)

--period

Option, required. Filing period code (e.g. 1T, 2T, 0A)

--year

Option, required. Filing year (e.g. 2025)

--prefill-relations

Option, optional. Prefill cross-revision relation values from the local observation store before exporting (annual roll-ups, prior-quarter carry-forward etc.)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleSyncCalcExportResult.

aeat config google sync calc pull

Read operator-edited cells back from a calc-sheets workbook into typed records (after validating the workbook’s registry-SHA stamp)

Command path: aeat config google sync calc pull

Registry key: config.google.sync.calc.pull

Parameters

--modelo

Option, required. Modelo id to export (e.g. 130, 303, 100)

--period

Option, required. Filing period code (e.g. 1T, 2T, 0A)

--year

Option, required. Filing year (e.g. 2025)

--spreadsheet-id

Option, required. Drive file id of the workbook to read operator edits from (must be app-owned and bound to the supplied snapshot)

--assemble-observations

Option, optional. After pulling, reassemble Detalle-tab row-set cells into typed observations (perceptors, foreign assets, related-party operations, atribución members, refund operations) and emit them in the payload alongside the raw row_set_edits

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleSyncCalcPullResult.

aeat config google sync calc verify

Three-way parity check of a modelo’s calculation surface (AEAT oracle vs local Decimal runtime vs Sheets workbook)

Command path: aeat config google sync calc verify

Registry key: config.google.sync.calc.verify

Parameters

--modelo

Option, required. Modelo id to export (e.g. 130, 303, 100)

--period

Option, required. Filing period code (e.g. 1T, 2T, 0A)

--year

Option, required. Filing year (e.g. 2025)

--scenario

Option, optional. Path to a JSON scenario file with operator inputs and an optional AEAT-published expected-output map

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleSyncCalcVerifyResult.

aeat config google sync probe

Probe the configured Google Drive folder for read/write access

Command path: aeat config google sync probe

Registry key: config.google.sync.probe

Parameters

--read-only

Option, optional. Probe Google Drive in read-only mode (no writes attempted)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleSyncProbeResult.

aeat config google sync push

Push the local data namespaces to the configured Google Drive folder

Command path: aeat config google sync push

Registry key: config.google.sync.push

Parameters

--namespace

Option, optional. Namespace to push (repeatable; defaults to every namespace)

--limit

Option, optional. Maximum number of files to push (defaults to no limit)

--dry-run

Option, optional. Plan the push without uploading any files

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._google_payloads.GoogleSyncPushResult.

aeat config lock

Lock the current profile by clearing the active profile pointer.

Command path: aeat config lock

Registry key: config.lock

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigLockResult.

aeat config profile archive export

Write a sealed, AEAD-encrypted full-backup archive to PATH; add –recovery-wrap-passphrase before email or cross-host transfer.

Command path: aeat config profile archive export

Registry key: config.profile.archive.export

Parameters

name

Option, optional. Profile to back up; defaults to active.

--to

Option, required. Destination path for the archive.

--recovery-wrap-passphrase

Option, optional. Optional passphrase to seal the archive under, instead of the active bucket key; required if the archive will leave this host.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileArchiveExportResult.

aeat config profile archive import

Restore a profile from a sealed, encrypted archive at PATH.

Command path: aeat config profile archive import

Registry key: config.profile.archive.import

Parameters

path

Option, required. Path to the sealed archive.

--force

Option, optional. Overwrite an existing profile that shares the archive’s bucket id.

--recovery-wrap-passphrase

Option, optional. Passphrase to unseal the archive; required if it was exported with one.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileArchiveImportResult.

aeat config profile archive inspect

Show a sealed archive’s header without decrypting or restoring it.

Command path: aeat config profile archive inspect

Registry key: config.profile.archive.inspect

Parameters

path

Option, required. Path to the sealed archive.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileArchiveInspectResult.

aeat config profile capabilities set

Opt the active profile in or out of one service capability.

Command path: aeat config profile capabilities set

Registry key: config.profile.capabilities.set

Parameters

capability

Option, required. Service capability to opt in or out of.

state

Option, required. Whether to enable (on) or disable (off) the capability.

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._capabilities_payloads.CapabilitySetResult.

aeat config profile capabilities show

Show the resolved posture of every service capability for the active profile.

Command path: aeat config profile capabilities show

Registry key: config.profile.capabilities.show

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._capabilities_payloads.CapabilitiesShowResult.

aeat config profile censo apply

Overwrite the profile with censo values reported by AEAT

Command path: aeat config profile censo apply

Registry key: config.profile.censo.apply

Parameters

--snapshot-id

Option, optional. Specific snapshot id (prefixes accepted)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._profile_censo_payloads.CensoApplyPayload.

aeat config profile censo compare

Compare AEAT censo and this profile field by field

Command path: aeat config profile censo compare

Registry key: config.profile.censo.compare

Parameters

--snapshot-id

Option, optional. Specific snapshot id (prefixes accepted)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._profile_censo_payloads.CensoCompareResult.

aeat config profile censo pull

Pull your latest censo from AEAT into this profile’s snapshot store.

Command path: aeat config profile censo pull

Registry key: config.profile.censo.pull

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._profile_censo_payloads.CensoRefreshResult.

aeat config profile censo show

Show the latest censo AEAT reported for this profile

Command path: aeat config profile censo show

Registry key: config.profile.censo.show

Parameters

--snapshot-id

Option, optional. Specific snapshot id (prefixes accepted)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config._profile_censo_payloads.CensoShowResult.

aeat config profile create

Initialize a new active profile.

Command path: aeat config profile create

Registry key: config.profile.create

Parameters

profile_name

Option, required. Profile name to write the answers into

--quiet

Option, optional. Run non-interactively using only the supplied flag values; required flags left unset cause an error. Sufficient on its own; combine with –accept-defaults to fill the rest from descriptor defaults.

--accept-defaults

Option, optional. Fill every unsupplied flag from the descriptor defaults, without prompting. Use alongside –quiet, or on its own for an all-defaults create.

--entity-type

Option, optional. Natural person, legal entity, or attribution entity

--legal-entity-form

Option, optional. Recognised legal form when the entity type is a legal entity

--irpf-income-categories

Option, optional. IRPF income category; pass –irpf-income-categories once per category

--incn-prior-12-months

Option, optional. Net turnover (importe neto de la cifra de negocios) over the prior 12 months, in euros. Above 6,000,000 EUR Modelo 202 mandates the Art. 40.3 LIS modality; below it both modalities are available. Optional.

--new-entity-first-two-profit-periods

Option, optional. Mark this when a newly-created legal entity is in one of its first two profit-making tax periods (LIS Art. 29) to opt into the 15 percent reduced rate. Optional; unset leaves the entity on its otherwise-applicable rate.

--ley-49-2002-option-declared

Option, optional. Record whether Modelo 036 casilla 651 declares the Ley 49/2002 Title II option.

--ley-49-2002-option-date

Option, optional. Record the Modelo 036 casilla 653 date for the Ley 49/2002 Title II option.

--ley-49-2002-renunciation-declared

Option, optional. Record whether Modelo 036 casilla 652 declares renunciation of the Ley 49/2002 Title II regime.

--ley-49-2002-renunciation-date

Option, optional. Record the Modelo 036 casilla 654 date for the Ley 49/2002 Title II renunciation.

--tax-id

Option, optional. Tax identifier (NIF/CIF/DNI/NIE) for the active profile

--name

Option, optional. Display name shown in local reviews

--surnames

Option, optional. Surnames or company name for export headers

--legal-name

Option, optional. Legal or company name for legal-entity export headers

--activity

Option, optional. Business activity as plain text, or the IAE heading if you know it

--address-postcode

Option, optional. Tax address postcode

--activity-start-date

Option, optional. Censo registration / start-of-activity date (YYYY-MM-DD). Optional; when set, obligations for periods before this date are not shown.

--taxation-type

Option, optional. Income-tax return type: 1 = individual, 2 = joint (family unit).

--output-language

Option, optional. CLI output language for this profile

--taxpayer-sex

Option, optional. First taxpayer sex: H = male, M = female.

--taxpayer-marital-status

Option, optional. First taxpayer marital status: 1 = single, 2 = married, 3 = widowed, 4 = separated or divorced, 5 = registered civil partnership.

--situacion-familiar

Option, optional. Family situation under Art. 82 LIRPF: determines whether joint taxation is available and which family unit variant applies.

--taxpayer-marriage-date

Option, optional. Start date of the current marriage (YYYY-MM-DD). Only when marital status = 2 (married). Derives casillas 0245/0246/0247 (matrimonio sobrevenido, Art. 82 LIRPF).

--taxpayer-birth-date

Option, optional. First taxpayer birth date

--taxpayer-disability-grade

Option, optional. First taxpayer disability grade: 1 = 33%-64%, 2 = 65% or higher, 3 = judicial incapacity, 4 = third-party assistance or reduced mobility.

--taxpayer-death-date

Option, optional. First taxpayer death date

--spouse-tax-id

Option, optional. Spouse NIF/NIE

--spouse-name

Option, optional. Spouse given name

--spouse-surnames

Option, optional. Spouse surnames

--spouse-birth-date

Option, optional. Spouse birth date

--spouse-sex

Option, optional. Spouse sex: H = male, M = female.

--spouse-disability-grade

Option, optional. Spouse disability grade (if applicable): 1 = 33%-64%, 2 = 65% or higher, 3 = judicial incapacity, 4 = third-party assistance or reduced mobility.

--spouse-non-resident-irpf

Option, optional. Spouse is non-resident IRPF

--spouse-eu-eea-resident

Option, optional. Spouse is EU/EEA resident

--spouse-eu-eea-country

Option, optional. Spouse EU/EEA country

--family-descendants-eu-eea-deduction

Option, optional. EU/EEA descendants in family-unit deduction

--family-minor-children-in-unit

Option, optional. Minor children in family unit

--iva-regime

Option, optional. IVA regime

--iva-roi-enrolled

Option, optional. Enrolled in ROI

--iva-oss-enrolled

Option, optional. Enrolled in OSS

--iva-group-member-enrolled

Option, optional. Enrolled as a member entity of an IVA group

--iva-group-dominant-entity-enrolled

Option, optional. Enrolled as the dominant entity of an IVA group

--iva-sii-enrolled

Option, optional. Whether the taxpayer is enrolled in the SII

--iva-redeme-enrolled

Option, optional. Whether the taxpayer is registered in REDEME

--iva-intracommunity-operations-exceed-50000-eur

Option, optional. Intra-community operations exceed 50,000 EUR

--enrollment-large-company

Option, optional. Large-company enrollment

--enrollment-public-administration-budget-gt-6000000

Option, optional. Public administration budget over 6,000,000

--has-employees

Option, optional. Has employees and pays salaries with retención

--pays-professionals-with-retencion

Option, optional. Pays professionals with retención

--art109-activity-income-withholding-ge-70pct

Option, optional. Art. 109 coverage - at least 70% of covered professional, agricultural, livestock, or forestry activity income subject to withholding or payment on account

--pays-rent-with-retencion

Option, optional. Pays local rent with retención

--pays-capital-income-with-retencion

Option, optional. Pays capital income with retención

--modelo-111-no-retenciones-periods

Option, optional. Comma-separated Modelo 111 no-obligation periods, format YYYY:PERIOD (for example 2025:2T,2025:3T). Use only when no subject payments were made.

--irpf-estimation-regime

Option, optional. IRPF estimation regime for economic-activity income

--objective-estimation-modulos-iae-epigraph

Option, optional. IAE epigraph for objective-estimation modules, such as 972.

--objective-estimation-modulos-module-1-units

Option, optional. Annual module 1 units for objective-estimation modules.

--objective-estimation-modulos-module-2-units

Option, optional. Annual module 2 units for objective-estimation modules.

--objective-estimation-modulos-module-3-units

Option, optional. Annual module 3 units for objective-estimation modules.

--objective-estimation-modulos-module-4-units

Option, optional. Annual module 4 units for objective-estimation modules.

--objective-estimation-modulos-module-5-units

Option, optional. Annual module 5 units for objective-estimation modules.

--objective-estimation-modulos-module-6-units

Option, optional. Annual module 6 units for objective-estimation modules.

--objective-estimation-modulos-module-7-units

Option, optional. Annual module 7 units for objective-estimation modules.

--irpf-special-regime

Option, optional. IRPF special regime. “general” for most taxpayers. “impatriado” for workers who relocated to Spain and elected the Beckham Law regime (Art. 93 LIRPF), available for the first 6 years after relocation.

--irpf-special-regime-start-date

Option, optional. Date the worker elected the inpatriate regime (YYYY-MM-DD). Only when irpf-special-regime is “impatriado”. RIRPF Art. 116. The regime expires at the end of the 6th calendar year.

--does-intracomunitario

Option, optional. Conducts intracomunitario operations

--third-party-transactions-above-347-threshold

Option, optional. Third-party transactions exceed Modelo 347 threshold

--bienes-extranjero-above-threshold

Option, optional. Foreign-held assets above legal threshold

--monedas-virtuales-extranjero-above-threshold

Option, optional. Virtual currencies held abroad above Modelo 721 threshold

--fiscal-residency

Option, optional. Fiscal residency category: resident_irpf (habitual resident in Spain) or non_resident_irnr (non-resident, IRNR taxation RDLeg 5/2004).

--country-of-fiscal-residence

Option, optional. ISO 3166-1 alpha-2 code of the country of fiscal residence (e.g. GB, DE, FR). Required when fiscal-residency is non_resident_irnr.

--representante-fiscal-nif

Option, optional. NIF/NIE of the fiscal representative in Spain. Required for non-EU/EEA non-residents (Art. 47 LGT + Art. 10 TRLIRNR RDLeg 5/2004).

--representante-fiscal-nombre

Option, optional. Full name of the fiscal representative in Spain.

--tax-residence-ccaa

Option, optional. Tax-residence autonomous community. One of: andalucia, aragon, asturias, baleares, canarias, cantabria, castilla_la_mancha, castilla_y_leon, cataluna, comunidad_valenciana, extremadura, galicia, la_rioja, madrid, murcia, pais_vasco, navarra.

--cloud-evidence-upload

Option, optional. Allow uploading sensitive evidence to cloud LLM providers (off by default).

--llm-vision

Option, optional. Enable on-host LLM vision for reading invoices.

--google-export

Option, optional. Enable Google Sheets export.

--notes

Option, optional. Notes for your own records (optional)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileCreateResult.

aeat config profile delete

Delete a profile and its on-disk state (–yes confirms)

Command path: aeat config profile delete

Registry key: config.profile.delete

Parameters

name

Option, required. Profile name to delete

--yes

Option, optional. Explicitly confirm the delete operation

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileDeleteResult.

aeat config profile descendiente add

Add one or more descendants to the active profile.

Command path: aeat config profile descendiente add

Registry key: config.profile.descendiente.add

Parameters

--descendiente

Option, required. NACIMIENTO=YYYY-MM-DD[,ADOPCION=YYYY-MM-DD][,DISCAPACIDAD=0|33|65][,CONVIVENCIA=true|false][,CUSTODIA=true|false][,MESES_TRABAJO=0..12][,GASTOS_GUARDERIA=N][,NIF=XXXXXXXXX]. Repeatable.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileDescendienteAddResult.

aeat config profile descendiente list

List descendants declared on the active profile.

Command path: aeat config profile descendiente list

Registry key: config.profile.descendiente.list

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileDescendienteListResult.

aeat config profile descendiente remove

Remove one descendant by 0-based index from the active profile.

Command path: aeat config profile descendiente remove

Registry key: config.profile.descendiente.remove

Parameters

index

Option, required. 0-based index of the descendant to remove.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileDescendienteRemoveResult.

aeat config profile duplicate

Copy a profile under a new id and display name

Command path: aeat config profile duplicate

Registry key: config.profile.duplicate

Parameters

source

Option, required. Source profile id to duplicate

target

Option, required. Target profile id for the duplicate

--display-name

Option, optional. Display name for the new profile (defaults to the target id)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileDuplicateResult.

aeat config profile edit

Re-run the wizard against an existing profile and update values in place

Command path: aeat config profile edit

Registry key: config.profile.edit

Parameters

profile_name

Option, required. Profile name to write the answers into

--quiet

Option, optional. Run non-interactively using only the supplied flag values; required flags left unset cause an error. Sufficient on its own; combine with –accept-defaults to fill the rest from descriptor defaults.

--accept-defaults

Option, optional. Fill every unsupplied flag from the descriptor defaults, without prompting. Use alongside –quiet, or on its own for an all-defaults create.

--entity-type

Option, optional. Natural person, legal entity, or attribution entity

--legal-entity-form

Option, optional. Recognised legal form when the entity type is a legal entity

--irpf-income-categories

Option, optional. IRPF income category; pass –irpf-income-categories once per category

--incn-prior-12-months

Option, optional. Net turnover (importe neto de la cifra de negocios) over the prior 12 months, in euros. Above 6,000,000 EUR Modelo 202 mandates the Art. 40.3 LIS modality; below it both modalities are available. Optional.

--new-entity-first-two-profit-periods

Option, optional. Mark this when a newly-created legal entity is in one of its first two profit-making tax periods (LIS Art. 29) to opt into the 15 percent reduced rate. Optional; unset leaves the entity on its otherwise-applicable rate.

--ley-49-2002-option-declared

Option, optional. Record whether Modelo 036 casilla 651 declares the Ley 49/2002 Title II option.

--ley-49-2002-option-date

Option, optional. Record the Modelo 036 casilla 653 date for the Ley 49/2002 Title II option.

--ley-49-2002-renunciation-declared

Option, optional. Record whether Modelo 036 casilla 652 declares renunciation of the Ley 49/2002 Title II regime.

--ley-49-2002-renunciation-date

Option, optional. Record the Modelo 036 casilla 654 date for the Ley 49/2002 Title II renunciation.

--tax-id

Option, optional. Tax identifier (NIF/CIF/DNI/NIE) for the active profile

--name

Option, optional. Display name shown in local reviews

--surnames

Option, optional. Surnames or company name for export headers

--legal-name

Option, optional. Legal or company name for legal-entity export headers

--activity

Option, optional. Business activity as plain text, or the IAE heading if you know it

--address-postcode

Option, optional. Tax address postcode

--activity-start-date

Option, optional. Censo registration / start-of-activity date (YYYY-MM-DD). Optional; when set, obligations for periods before this date are not shown.

--taxation-type

Option, optional. Income-tax return type: 1 = individual, 2 = joint (family unit).

--output-language

Option, optional. CLI output language for this profile

--taxpayer-sex

Option, optional. First taxpayer sex: H = male, M = female.

--taxpayer-marital-status

Option, optional. First taxpayer marital status: 1 = single, 2 = married, 3 = widowed, 4 = separated or divorced, 5 = registered civil partnership.

--situacion-familiar

Option, optional. Family situation under Art. 82 LIRPF: determines whether joint taxation is available and which family unit variant applies.

--taxpayer-marriage-date

Option, optional. Start date of the current marriage (YYYY-MM-DD). Only when marital status = 2 (married). Derives casillas 0245/0246/0247 (matrimonio sobrevenido, Art. 82 LIRPF).

--taxpayer-birth-date

Option, optional. First taxpayer birth date

--taxpayer-disability-grade

Option, optional. First taxpayer disability grade: 1 = 33%-64%, 2 = 65% or higher, 3 = judicial incapacity, 4 = third-party assistance or reduced mobility.

--taxpayer-death-date

Option, optional. First taxpayer death date

--spouse-tax-id

Option, optional. Spouse NIF/NIE

--spouse-name

Option, optional. Spouse given name

--spouse-surnames

Option, optional. Spouse surnames

--spouse-birth-date

Option, optional. Spouse birth date

--spouse-sex

Option, optional. Spouse sex: H = male, M = female.

--spouse-disability-grade

Option, optional. Spouse disability grade (if applicable): 1 = 33%-64%, 2 = 65% or higher, 3 = judicial incapacity, 4 = third-party assistance or reduced mobility.

--spouse-non-resident-irpf

Option, optional. Spouse is non-resident IRPF

--spouse-eu-eea-resident

Option, optional. Spouse is EU/EEA resident

--spouse-eu-eea-country

Option, optional. Spouse EU/EEA country

--family-descendants-eu-eea-deduction

Option, optional. EU/EEA descendants in family-unit deduction

--family-minor-children-in-unit

Option, optional. Minor children in family unit

--iva-regime

Option, optional. IVA regime

--iva-roi-enrolled

Option, optional. Enrolled in ROI

--iva-oss-enrolled

Option, optional. Enrolled in OSS

--iva-group-member-enrolled

Option, optional. Enrolled as a member entity of an IVA group

--iva-group-dominant-entity-enrolled

Option, optional. Enrolled as the dominant entity of an IVA group

--iva-sii-enrolled

Option, optional. Whether the taxpayer is enrolled in the SII

--iva-redeme-enrolled

Option, optional. Whether the taxpayer is registered in REDEME

--iva-intracommunity-operations-exceed-50000-eur

Option, optional. Intra-community operations exceed 50,000 EUR

--enrollment-large-company

Option, optional. Large-company enrollment

--enrollment-public-administration-budget-gt-6000000

Option, optional. Public administration budget over 6,000,000

--has-employees

Option, optional. Has employees and pays salaries with retención

--pays-professionals-with-retencion

Option, optional. Pays professionals with retención

--art109-activity-income-withholding-ge-70pct

Option, optional. Art. 109 coverage - at least 70% of covered professional, agricultural, livestock, or forestry activity income subject to withholding or payment on account

--pays-rent-with-retencion

Option, optional. Pays local rent with retención

--pays-capital-income-with-retencion

Option, optional. Pays capital income with retención

--modelo-111-no-retenciones-periods

Option, optional. Comma-separated Modelo 111 no-obligation periods, format YYYY:PERIOD (for example 2025:2T,2025:3T). Use only when no subject payments were made.

--irpf-estimation-regime

Option, optional. IRPF estimation regime for economic-activity income

--objective-estimation-modulos-iae-epigraph

Option, optional. IAE epigraph for objective-estimation modules, such as 972.

--objective-estimation-modulos-module-1-units

Option, optional. Annual module 1 units for objective-estimation modules.

--objective-estimation-modulos-module-2-units

Option, optional. Annual module 2 units for objective-estimation modules.

--objective-estimation-modulos-module-3-units

Option, optional. Annual module 3 units for objective-estimation modules.

--objective-estimation-modulos-module-4-units

Option, optional. Annual module 4 units for objective-estimation modules.

--objective-estimation-modulos-module-5-units

Option, optional. Annual module 5 units for objective-estimation modules.

--objective-estimation-modulos-module-6-units

Option, optional. Annual module 6 units for objective-estimation modules.

--objective-estimation-modulos-module-7-units

Option, optional. Annual module 7 units for objective-estimation modules.

--irpf-special-regime

Option, optional. IRPF special regime. “general” for most taxpayers. “impatriado” for workers who relocated to Spain and elected the Beckham Law regime (Art. 93 LIRPF), available for the first 6 years after relocation.

--irpf-special-regime-start-date

Option, optional. Date the worker elected the inpatriate regime (YYYY-MM-DD). Only when irpf-special-regime is “impatriado”. RIRPF Art. 116. The regime expires at the end of the 6th calendar year.

--does-intracomunitario

Option, optional. Conducts intracomunitario operations

--third-party-transactions-above-347-threshold

Option, optional. Third-party transactions exceed Modelo 347 threshold

--bienes-extranjero-above-threshold

Option, optional. Foreign-held assets above legal threshold

--monedas-virtuales-extranjero-above-threshold

Option, optional. Virtual currencies held abroad above Modelo 721 threshold

--fiscal-residency

Option, optional. Fiscal residency category: resident_irpf (habitual resident in Spain) or non_resident_irnr (non-resident, IRNR taxation RDLeg 5/2004).

--country-of-fiscal-residence

Option, optional. ISO 3166-1 alpha-2 code of the country of fiscal residence (e.g. GB, DE, FR). Required when fiscal-residency is non_resident_irnr.

--representante-fiscal-nif

Option, optional. NIF/NIE of the fiscal representative in Spain. Required for non-EU/EEA non-residents (Art. 47 LGT + Art. 10 TRLIRNR RDLeg 5/2004).

--representante-fiscal-nombre

Option, optional. Full name of the fiscal representative in Spain.

--tax-residence-ccaa

Option, optional. Tax-residence autonomous community. One of: andalucia, aragon, asturias, baleares, canarias, cantabria, castilla_la_mancha, castilla_y_leon, cataluna, comunidad_valenciana, extremadura, galicia, la_rioja, madrid, murcia, pais_vasco, navarra.

--cloud-evidence-upload

Option, optional. Allow uploading sensitive evidence to cloud LLM providers (off by default).

--llm-vision

Option, optional. Enable on-host LLM vision for reading invoices.

--google-export

Option, optional. Enable Google Sheets export.

--notes

Option, optional. Notes for your own records (optional)

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileEditResult.

aeat config profile export

Write a passphrase-encrypted portable profile bundle to PATH; cleartext JSON requires –cleartext-local for local/SAR use only.

Command path: aeat config profile export

Registry key: config.profile.export

Parameters

name

Option, optional. Profile to export; defaults to the active profile

--to

Option, required. Destination path for the profile bundle

--passphrase

Option, optional. Passphrase to AEAD-encrypt the serialized profile bundle for transfer.

--cleartext-local

Option, optional. Write cleartext JSON for local/SAR handling only; not safe for email, sync, or transfer.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileExportResult.

aeat config profile history

Show the append-only event history for one profile

Command path: aeat config profile history

Registry key: config.bucket.history

Parameters

profile

Option, required. Profile name whose event history should be inspected

--event-type

Option, optional. Filter the history to one or more event types (repeatable)

--since

Option, optional. Filter the history to events at or after this ISO-8601 timestamp (e.g. 2026-04-01T00:00:00+00:00)

--until

Option, optional. Filter the history to events at or before this ISO-8601 timestamp (e.g. 2026-04-30T23:59:59+00:00)

--object-id

Option, optional. Filter the history to events targeting a specific object_id (exact match)

--actor

Option, optional. Filter the history to events recorded by a specific actor (exact match)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.BucketHistoryResult.

aeat config profile import

Register a portable profile bundle from a file

Command path: aeat config profile import

Registry key: config.profile.import

Parameters

path

Option, required. Path to the profile bundle file

--passphrase

Option, optional. Passphrase for a bundle exported with ‘config profile export –passphrase’.

--label

Option, optional. Display name for the imported profile; defaults to the name stored in the bundle. Use it when the stored label is already in use.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileImportResult.

aeat config profile list

List every registered profile and mark the active one

Command path: aeat config profile list

Registry key: config.profile.list

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigListResult.

aeat config profile logout

Sign out of the active profile by clearing the local pointer

Command path: aeat config profile logout

Registry key: config.profile.logout

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileLogoutResult.

aeat config profile preflight

Report which profile fields are missing for a given (modelo, revision, filing-year, period) filing context.

Command path: aeat config profile preflight

Registry key: config.profile.preflight

Parameters

--modelo

Option, required. Numeric modelo identifier (e.g. 303).

--filing-year

Option, required. Four-digit filing year.

--period

Option, required. Period code (e.g. 1T, 1P, 0A, 01).

--revision-id

Option, optional. Optional registry revision id override for exact replay (e.g. 2024-0A); defaults to the active revision for the modelo, filing year, and period.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfilePreflightResult.

aeat config profile rename

Rename a profile in place; the active-profile pointer follows automatically

Command path: aeat config profile rename

Registry key: config.profile.rename

Parameters

source

Option, required. Existing profile name

target

Option, required. New profile name

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileRenameResult.

aeat config profile sandbox archive

Move a sandbox into reversible dormancy without erasing it.

Command path: aeat config profile sandbox archive

Registry key: config.profile.sandbox.archive

Parameters

name

Option, required. Sandbox name (without the prefix).

--yes

Option, optional. Confirm the archive.

--dry-run

Option, optional. Preview the archive without moving the sandbox out of the live surface.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxArchiveResult.

aeat config profile sandbox create

Fork a new isolated sandbox bucket and activate it.

Command path: aeat config profile sandbox create

Registry key: config.profile.sandbox.create

Parameters

name

Option, required. Sandbox name.

--from-profile

Option, optional. Seed the sandbox with an existing profile’s facts (read-only source).

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxCreateResult.

aeat config profile sandbox discard

Permanently erase a sandbox bucket.

Command path: aeat config profile sandbox discard

Registry key: config.profile.sandbox.discard

Parameters

name

Option, required. Sandbox name (without the prefix).

--yes

Option, optional. Confirm the destructive erase.

--dry-run

Option, optional. Preview what the discard would remove without removing anything.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxDiscardResult.

aeat config profile sandbox list

List every sandbox bucket.

Command path: aeat config profile sandbox list

Registry key: config.profile.sandbox.list

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxListResult.

aeat config profile sandbox merge

Promote a sandbox’s ledger and/or modelo records into another profile.

Command path: aeat config profile sandbox merge

Registry key: config.profile.sandbox.merge

Parameters

name

Option, required. Sandbox name (without the prefix).

--into

Option, required. Target profile name the sandbox’s records are promoted into.

--scope

Option, optional. Data category to promote: ledger, modelo, or all.

--yes

Option, optional. Confirm promoting sandbox data.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxMergeResult.

aeat config profile sandbox prune

Discard every sandbox bucket at once.

Command path: aeat config profile sandbox prune

Registry key: config.profile.sandbox.prune

Parameters

--yes

Option, optional. Confirm discarding every sandbox.

--dry-run

Option, optional. Preview which sandboxes would be discarded without discarding them.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxPruneResult.

aeat config profile sandbox restore

Bring an archived sandbox back to active status.

Command path: aeat config profile sandbox restore

Registry key: config.profile.sandbox.restore

Parameters

name

Option, required. Sandbox name (without the prefix).

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxRestoreResult.

aeat config profile sandbox usage

Report the on-disk footprint of one sandbox, or every sandbox at once.

Command path: aeat config profile sandbox usage

Registry key: config.profile.sandbox.usage

Parameters

name

Option, optional. Sandbox name (without the prefix); omit to report every sandbox.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxUsageResult.

aeat config profile sandbox use

Switch the active profile to an existing sandbox.

Command path: aeat config profile sandbox use

Registry key: config.profile.sandbox.use

Parameters

name

Option, required. Sandbox name (without the prefix).

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSandboxUseResult.

aeat config profile show

Show the live values of a profile (defaults to the active profile)

Command path: aeat config profile show

Registry key: config.profile.show

Parameters

name

Option, optional. Profile id to show (defaults to the active profile)

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileShowResult.

aeat config profile status

Show the readiness of the current configuration profile

Command path: aeat config profile status

Registry key: config.profile.status

Parameters

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigStatusResult.

aeat config profile subject-access-request

Export all personal data held for a profile as a GDPR right-of-access archive (the portable profile bundle).

Command path: aeat config profile subject-access-request

Registry key: config.profile.subject_access_request

Parameters

name

Option, optional. Profile to export; defaults to the active profile

--to

Option, required. Destination path for the profile bundle

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileSubjectAccessRequestResult.

aeat config profile validate

Validate a profile against the loaded schema (defaults to the active profile).

Command path: aeat config profile validate

Registry key: config.profile.validate

Parameters

name

Option, optional. Optional profile label to validate; defaults to the active profile.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigProfileValidateResult.

aeat config recover

Recover the file secret store with a recovery key and bind it to a new passphrase.

Command path: aeat config recover

Registry key: config.recover

Parameters

--recovery-key

Option, required. Twenty-four word recovery key.

--new-passphrase

Option, optional. New secret-store passphrase. Omit to enter it interactively.

--confirm-new-passphrase

Option, optional. Repeat the new secret-store passphrase.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigRecoverResult.

aeat config rekey

Rewrap the file secret store under a new passphrase.

Command path: aeat config rekey

Registry key: config.rekey

Parameters

--new-passphrase

Option, optional. New secret-store passphrase. Omit to enter it interactively.

--confirm-new-passphrase

Option, optional. Repeat the new secret-store passphrase.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigRekeyResult.

aeat config repair connectivity

Check browser and AEAT Sede connectivity

Command path: aeat config repair connectivity

Registry key: config.repair.connectivity

Parameters

--headless

Option, optional. No description.

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairConnectivityResult.

aeat config repair integrity objects

Check secure-object integrity.

Command path: aeat config repair integrity objects

Registry key: config.repair.integrity.objects

Parameters

--namespace

Option, optional. Restrict secure-object integrity checks to one namespace.

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairIntegrityObjectsResult.

aeat config repair integrity registry

Check calculation registry integrity.

Command path: aeat config repair integrity registry

Registry key: config.repair.integrity.registry

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairIntegrityRegistryResult.

aeat config repair logs

Show the log file path and recent lines

Command path: aeat config repair logs

Registry key: config.repair.logs

Parameters

--lines

Option, optional. Number of recent log lines to show

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairLogsResult.

aeat config repair profile

Inspect and repair the active-profile pointer.

Command path: aeat config repair profile

Registry key: config.repair.profile

Parameters

--profile

Option, optional. Inspect a specific registered profile.

--clear-active

Option, optional. Clear a pointer-file active profile only when it points at unreadable profile state.

--yes

Option, optional. Confirm repair.

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairProfileResult.

aeat config repair quarantine

Preview undecryptable rows; active quarantine is disabled by preserve-first repair policy

Command path: aeat config repair quarantine

Registry key: config.repair.quarantine

Parameters

--yes

Option, optional. Explicitly confirm the quarantine operation

--dry-run

Option, optional. Preview the rows that would be quarantined without moving anything

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairQuarantineResult.

aeat config repair reset-progress

Clear saved interrupted-command progress (destructive; requires –yes)

Command path: aeat config repair reset-progress

Registry key: config.repair.reset_progress

Parameters

--yes

Option, optional. Confirm clearing saved interrupted-command progress

--dry-run

Option, optional. Show the saved progress that would be cleared

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.RepairResetProgressResult.

aeat config reset

Reset operator-entered configuration scopes

Command path: aeat config reset

Registry key: config.reset

Parameters

--scope

Option, optional. Scope to reset. profile: delete every profile (manifests, DEKs, declarations, ledger and invoice reviews). auth: clear the persisted AEAT/SEDE auth session. data: quarantine unreadable secure-object rows across all namespaces. all: apply profile, auth, and data together.

--yes

Option, optional. Explicitly confirm the reset operation

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigResetResult.

aeat config show-recovery

Show recovery status or mint a one-time recovery key.

Command path: aeat config show-recovery

Registry key: config.show_recovery

Parameters

--rotate

Option, optional. Rotate the recovery wrapper and print a new one-time recovery key.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigShowRecoveryResult.

aeat config switch

Switch to a profile and make it the active one.

Command path: aeat config switch

Registry key: config.switch

Parameters

name

Option, optional. Profile name to switch to. Defaults to the active profile pointer.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigSwitchResult.

aeat config verify-recovery

Verify that a recovery key opens the persisted recovery wrapper.

Command path: aeat config verify-recovery

Registry key: config.verify_recovery

Parameters

--recovery-key

Option, required. Twenty-four word recovery key.

--output-language, --language

Option, optional. Output language for the response text (es, en, ca, hu).

Output schema

This command emits a SchemaEnvelope whose result field is validated against aeat.entrypoints.cli._config_payloads.ConfigVerifyRecoveryResult.