An organization is the shared workspace for a team, and every repository, connected account, and finding belongs to one. If you belong to exactly one, you can skip this page: the CLI acts on it without being told.
The three commands
cf org list
cf org use acme
cf org show$cf org list slug name role> acme Acme owner acme-labs Acme Labs member
cf org use checks the slug against your own listing before storing it, so a typo fails there with unknown_organization and nothing is written. Without that check, a mistyped slug would turn the next unrelated command into an organization_not_found that reads like the repository is missing.
What decides the organization
| Order | Source |
|---|---|
| 1 | --org <slug> on the command |
| 2 | CEFENSE_ORG in the environment |
| 3 | What cf org use stored for this instance |
| 4 | Nothing, and the API picks |
The fourth is a real answer, not a failure, but only when your account belongs to exactly one organization. Belong to several and name none, and commands answer organization_required rather than guessing. Quietly picking one would mean showing you another team's findings and saying nothing about it.
cf org show
cf org show --jsoncf org show reports the slug and which of the three named it, as flag, CEFENSE_ORG, or stored. It reads local state only, so it works offline and without being signed in.
Your role decides what you can run
There are three roles: owner, admin, and member. A member can scan, read findings, triage them, and generate patches. A member cannot change what the team has connected, and cannot open or merge a pull request. An owner or an admin can do all of it.
| Command | Role needed |
|---|---|
cf scan, cf reproduced, cf matched, cf branches, cf commits, cf audit, cf sbom | Any |
cf triage | Any |
cf fix generate, cf fix show | Any |
cf proof, cf proof show, cf proof run | Any |
cf plan | Any |
cf plan upgrade, cf plan portal | owner or admin |
cf repo connect, cf repo disconnect, cf scan --url | owner or admin |
cf provider connect, cf provider disconnect | owner or admin |
cf settings subcommands | owner or admin |
cf fix publish, cf fix merge, cf proof attest | owner or admin |
cf proof env set, cf proof env unset | owner or admin |
A refusal is organization_forbidden with exit code 4, and billing_forbidden for the two plan commands. It is enforced by the API, not by the CLI, so it behaves the same from the workspace or from a script. Only an owner or admin of the organization can change what role you hold.
In CI
Have a correction or need help?
Email the docs team