mulesoft · failup · Jun 11, 2026 · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026
@@ -38,6 +38,11 @@
 |xref:anypoint-cli::api-mgr.adoc#api-mgr-tier-copy[api-mgr:tier:copy] | Copies an SLA tier from source to a target API instance
 |xref:anypoint-cli::api-mgr.adoc#api-mgr-tier-delete[api-mgr:tier:delete] | Deletes an SLA tier from an API instance
 |xref:anypoint-cli::api-mgr.adoc#api-mgr-tier-list[api-mgr:tier:list] | Lists the SLA tiers of an API instance
+|xref:anypoint-cli::api-mgr.adoc#api-mgr-upstream-add[api-mgr:upstream:add] | Creates an upstream for an API instance
+|xref:anypoint-cli::api-mgr.adoc#api-mgr-upstream-bulk-edit[api-mgr:upstream:bulk-edit] | Bulk edits the TLS context for all upstreams of an API instance
+|xref:anypoint-cli::api-mgr.adoc#api-mgr-upstream-delete[api-mgr:upstream:delete] | Deletes an upstream from an API instance
+|xref:anypoint-cli::api-mgr.adoc#api-mgr-upstream-edit[api-mgr:upstream:edit] | Edits an upstream of an API instance
+|xref:anypoint-cli::api-mgr.adoc#api-mgr-upstream-list[api-mgr:upstream:list] | Lists all upstreams for an API instance
 |===
 
 // end::summary[]
@@ -302,15 +307,15 @@ Options: `cloudhub`, `hybrid`, `rtf` (required) | `--deploymentType cloudhub`
 | Inbound secret group ID  | `--inboundSecretGroupId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
 
 | `--inboundTlsContextId` 
-| Outbound TLS Context ID +
-Supply the `--inboundSecretGroupId` of the TLS Context's secret group. To remove a TLS Context, apply the flag with the following value: `--inboundTlsContextId "null"`. |  `--inboundTlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| Outbound TLS context ID +
+Supply the `--inboundSecretGroupId` of the TLS context's secret group. To remove a TLS context, apply the flag with the following value: `--inboundTlsContextId "null"`. |  `--inboundTlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
 
 | `--outboundSecretGroupId`
 | Outbound secret group ID. | `--outboundSecretGroupId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
 
 | `--outboundTlsContextId`
-| Outbound TLS Context ID. +
-Supply the `--outboundSecretGroupId` of the TLS Context's secret group. To remove a TLS Context, apply the flag with the following value: `--outboundTlsContextId "null"`. | `--outboundTlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| Outbound TLS context ID. +
+Supply the `--outboundSecretGroupId` of the TLS context's secret group. To remove a TLS context, apply the flag with the following value: `--outboundTlsContextId "null"`. | `--outboundTlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
 | `--output` | Specifies the response format, supported values are `table` (default) and `json` |  `--output json`
 
 | `--path`
@@ -325,7 +330,7 @@ Default is Anypoint Platform Client Provider | `--providerId 1787c36ab544466698e
 
 | `--responseTimeout`
 | Maximum response timeout(required) | `--responseTimeout 10`
-|`--routing` | Configure upstream service | `--routing 50e8400-e29b-41d4-a716-446655440000`
+|`--routing` | API instance routes as a JSON array. Each route defines a label, routing rules, and upstream references with weights. | `--routing '[{"label":"Rule 1","rules":{"path":"/path"},"upstreams":[{"id":"upstream-id","weight":100}]}]'`
 
 | `--scheme`
 | Proxy scheme (required) +
@@ -342,6 +347,10 @@ Omni Gateway does not support this flag | `--serviceName ExampleServerName`
 | WSDL service port +
  Omni Gateway does not support this flag | `--servicePort 443`
 
+| `--type`
+| Endpoint type +
+Supported options: `http`, `raml`, `wsdl`, `mcp`, `a2a`, `llm`, `grpc` | `--type http`
+
 | `--updateApisInSamePort`
 | Updates the TLS context of API instances sharing the port of this API. | `--updateApisInSamePort`
 
@@ -434,8 +443,8 @@ Supply the `--inboundSecretGroupId` of the TLS Context's secret group. To remove
 | Outbound secret group ID. | `--outboundSecretGroupId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
 
 | `--outboundTlsContextId`
-| Outbound TLS Context ID. +
-Supply the `--outboundSecretGroupId` of the TLS Context's secret group. To remove a TLS Context, apply the flag with the following value: `--outboundTlsContextId "null"`. | `--outboundTlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| Outbound TLS context ID. +
+Supply the `--outboundSecretGroupId` of the TLS context's secret group. To remove a TLS context, apply the flag with the following value: `--outboundTlsContextId "null"`. | `--outboundTlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
 | `--output` | Specifies the response format, supported values are `table` (default) and `json` |  `--output json`
 
 | `--path`
@@ -468,7 +477,7 @@ Omni Gateway does not support this flag | `--serviceName ExampleServerName`
 
 | `--type`
 | Endpoint type +
-Supported options: `http`, `raml`, `wsdl` | `--type http`
+Supported options: `http`, `raml`, `wsdl`, `mcp`, `a2a`, `llm`, `grpc` | `--type http`
 
 | `--uri`
 | Implementation URI | `--uri /udp://localhost:65432`
@@ -913,4 +922,90 @@ In addition to the xref:index.adoc#default-options[default flags], this command
 Supported values are: `id`, `name`, `createdDate`, and `updatedDate`  | `--sort id`
 |===
 
-// end::commands[]
+[[api-mgr-upstream-add]]
+== api-mgr:upstream:add
+
+----
+> api-mgr:upstream:add [flags] <apiInstanceId> <uri>
+----
+
+Creates an upstream for the API instance passed in `<apiInstanceId>` with the URI passed in `<uri>`.
+
+In addition to the xref:index.adoc#default-options[default flags], this command accepts these flags:
+
+[%header%autowidth.spread,cols="a,a,a"]
+|===
+|Flag |Description |Example
+| `--label` | Label for the upstream | `--label my-upstream`
+| `--tlsContextId` | TLS context ID to set on the upstream | `--tlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| `--tlsContextSecretGroupId` | Secret group ID for the TLS context specified in `--tlsContextId` | `--tlsContextSecretGroupId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| `--output` | Format for the response, supported values are `table` (default) and `json` | `--output json`
+|===
+
+[[api-mgr-upstream-bulk-edit]]
+== api-mgr:upstream:bulk-edit
+
+----
+> api-mgr:upstream:bulk-edit [flags] <apiInstanceId>
+----
+
+Bulk edits the TLS context for all upstreams of the API instance passed in `<apiInstanceId>` using a single API update.
+
+In addition to the xref:index.adoc#default-options[default flags], this command accepts these flags:
+
+[%header%autowidth.spread,cols="a,a,a"]
+|===
+|Flag |Description |Example
+| `--tlsContextId` *(required)* | TLS context ID to set on all upstreams. Pass `null` to remove the TLS context from all upstreams. | `--tlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| `--tlsContextSecretGroupId` | Secret group ID for the TLS context specified in `--tlsContextId` | `--tlsContextSecretGroupId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| `--output` | Format for the response, supported values are `table` (default) and `json` | `--output json`
+|===
+
+[[api-mgr-upstream-delete]]
+== api-mgr:upstream:delete
+
+----
+> api-mgr:upstream:delete [flags] <apiInstanceId> <upstreamId>
+----
+
+Deletes the upstream passed in `<upstreamId>` from the API instance passed in `<apiInstanceId>`.
+
+This command accepts the `--output` flag to specify the response format. Supported values are `table` (default) and `json`.
+
+This command accepts the xref:index.adoc#default-options[default flags].
+
+[[api-mgr-upstream-edit]]
+== api-mgr:upstream:edit
+
+----
+> api-mgr:upstream:edit [flags] <apiInstanceId> <upstreamId>
+----
+
+Edits the upstream passed in `<upstreamId>` for the API instance passed in `<apiInstanceId>`.
+
+In addition to the xref:index.adoc#default-options[default flags], this command accepts the following flags:
+
+[%header%autowidth.spread,cols="a,a,a"]
+|===
+|Flag |Description |Example
+| `--uri` | Upstream URI | `--uri https://backend.example.com`
+| `--label` | Label for the upstream | `--label my-upstream`
+| `--tlsContextId` | TLS context ID to set on the upstream. Pass `null` to remove the TLS context. | `--tlsContextId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| `--tlsContextSecretGroupId` | Secret group ID for the TLS context specified in `--tlsContextId` | `--tlsContextSecretGroupId 1fec0a49-1551-4199-bfcc-cf0352d0f29d`
+| `--output` | Format for the response, supported values are `table` (default) and `json` | `--output json`
+|===
+
+[[api-mgr-upstream-list]]
+== api-mgr:upstream:list
+
+----
+> api-mgr:upstream:list [flags] <apiInstanceId>
+----
+
+Lists all upstreams for the API instance passed in `<apiInstanceId>`.
+
+This command accepts the `--output` flag to specify the response format. Supported values are `table` (default) and `json`.
+
+This command accepts the xref:index.adoc#default-options[default flags].
+
+// end::commands[]
@@ -24,6 +24,8 @@
 
 |xref:anypoint-cli::cloudhub-dlb.adoc#cloudhub-load-balancer-start[cloudhub:load-balancer:start] | Starts a load balancer
 |xref:anypoint-cli::cloudhub-dlb.adoc#cloudhub-load-balancer-stop[cloudhub:load-balancer:stop] | Stops a load balancer
+|xref:anypoint-cli::cloudhub-dlb.adoc#cloudhub-load-balancer-whitelist-add[cloudhub:load-balancer:whitelist:add] | Adds an IP or range of IPs to the load balancer allowlist
+|xref:anypoint-cli::cloudhub-dlb.adoc#cloudhub-load-balancer-whitelist-remove[cloudhub:load-balancer:whitelist:remove] | Removes an IP or range of IPs from the load balancer allowlist
 |===
 
 // end::summary[]
@@ -332,4 +334,26 @@ Stops the load balancer specified in `<name>`
 This command accepts the xref:index.adoc#default-options[default flags].
 
 
+[[cloudhub-load-balancer-whitelist-add]]
+== cloudhub:load-balancer:whitelist:add
+
+----
+> cloudhub:load-balancer:whitelist:add [flags] <name> <cidrBlock>
+----
+
+Adds a range of IP addresses specified in `<cidrBlock>` to the allowlist of the load balancer specified in `<name>`.
+
+This command accepts the xref:index.adoc#default-options[default flags].
+
+[[cloudhub-load-balancer-whitelist-remove]]
+== cloudhub:load-balancer:whitelist:remove
+
+----
+> cloudhub:load-balancer:whitelist:remove [flags] <name> <cidrBlock>
+----
+
+Removes an IP or range of IPs specified in `<cidrBlock>` from the allowlist of the load balancer specified in `<name>`.
+
+This command accepts the xref:index.adoc#default-options[default flags].
+
 // end::commands[]
@@ -109,11 +109,12 @@ You can authenticate to Anypoint Platform through the command line by running th
 | `--password` | `ANYPOINT_PASSWORD`
 |`--client_id`| `ANYPOINT_CLIENT_ID`
 |`--client_secret`| `ANYPOINT_CLIENT_SECRET`
-|`--bearer`| -
+|`--bearer`| `ANYPOINT_BEARER`
 |`--organization`| `ANYPOINT_ORG`
 |`--environment`| `ANYPOINT_ENV`
 | - | `ANYPOINT_CERTIFICATE`
 | - | `ANYPOINT_HOST`
+| `--[no-]collectMetrics` | `COLLECT_METRICS`
 |===
 
 NOTE: The `--organization` flag is optional. It defaults to your main organization from Anypoint Platform.

@@ -165,6 +165,49 @@ anypoint-cli-v4 1.0.2 (core)
 
 ----
 
+[[link-plugin]]
+== Link a Local Plugin for Development
+
+To link a local plugin directory into the CLI for development purposes:
+
+[source,text,linenums]
+----
+anypoint-cli-v4 plugins:link <path>
+----
+
+For example, to link a plugin in the current directory:
+
+[source,text,linenums]
+----
+anypoint-cli-v4 plugins:link .
+----
+
+NOTE: Installing a linked plugin overrides a user-installed or core plugin that has the same commands.
+
+[[autocomplete]]
+== Enable Shell Autocomplete
+
+To display autocomplete installation instructions for your shell:
+
+[source,text,linenums]
+----
+anypoint-cli-v4 autocomplete [bash|zsh|powershell]
+----
+
+For example, to set up autocomplete for Zsh:
+
+[source,text,linenums]
+----
+anypoint-cli-v4 autocomplete zsh
+----
+
+To refresh the autocomplete cache after installing new plugins:
+
+[source,text,linenums]
+----
+anypoint-cli-v4 autocomplete --refresh-cache
+----
+
 [[uninstall-plugin]]
 == Uninstall a Plugin