NAME¶

nbox-tag-add - Add a tag to an object. A write: requires the `--allow-writes` gate AND confirmation (`--confirm`, or an interactive prompt on a TTY in plain output). `--dry-run` previews with no mutation and needs neither. Adding a tag the object already carries is a no-op: apply sends no `PATCH`

SYNOPSIS¶

nbox tag add [--message] [--dry-run] [--confirm] [--allow-writes] [-h|--help] <OBJECT_TYPE> <OBJECT_NAME> <TAG>

DESCRIPTION¶

Add a tag to an object. A write: requires the `--allow-writes` gate AND confirmation (`--confirm`, or an interactive prompt on a TTY in plain output). `--dry-run` previews with no mutation and needs neither. Adding a tag the object already carries is a no-op: apply sends no `PATCH`

OPTIONS¶

--message <MESSAGE>

Record this message in NetBox's object-change entry (a write-only request field, never stored on the object). Validated to NetBox's 200-character limit before applying. Optional

--dry-run

Preview the plan + diff and perform no mutation. Needs neither `--allow-writes` nor confirmation. With `--json`, returns the stable `MutationPlan` JSON

--confirm

Apply the reviewed plan without an interactive prompt. Does NOT enable writes on its own — `--confirm` without `--allow-writes` is a usage error (exit 2). With `--json`, returns the stable `MutationReceipt` JSON

--allow-writes

The write-enable gate: required to apply ANY mutation. Kept separate from `--confirm` so a read-only invocation can never be silently turned into a write (ADR-0001 §4)

-h, --help

Print help

<OBJECT_TYPE>

Object kind (e.g. `device`, `prefix`, `ip`, `vlan`, `site`, `rack`, `circuit`, `tenant`, `vrf`, `vm`, `cluster`, `interface`, …). Any kind `nbox <kind> <ref>` resolves

<OBJECT_NAME>

Object reference (name, slug, id, CIDR, VID, … — kind-dependent). For an interface use `<device>/<name>`

<TAG>

Tag reference: id, exact name (e.g. `prod:us-east`), or exact slug