CLI reference
Every ohs command. Configuration comes from OHS_* environment variables.
ohs <command> [flags]| Command | Does |
|---|---|
ohs up | Applies pending migrations, then serves. The container entrypoint. |
ohs serve | Runs the roles in OHS_ROLES (api, collect, etl) until SIGINT or SIGTERM. Needs a migrated database. |
ohs migrate up | Applies every pending migration. Safe to run on each start. |
ohs migrate version | Prints the schema version of the database. |
ohs migrate latest | Prints the schema version this binary migrates to. Needs no database. |
ohs migrate down --all | Reverts every migration: drops all Open Health Sync data. |
ohs doctor [--quick] | Checks configuration, database, raw store, public URL and connectors. --quick checks the database and raw store only. |
ohs admin tenant create --name <name> | Creates a tenant and prints its first API key, once. |
ohs admin tenant list | Lists tenants with their ids and active key counts. |
ohs admin key create --tenant <id> | Adds an API key to a tenant, for rotation. |
ohs admin key list --tenant <id> | Lists a tenant's keys by prefix, with creation and last use. |
ohs admin key revoke --tenant <id> --key <key or prefix> | Revokes a key. A whole user token is revoked the same way. |
ohs admin personal setup [--person <name>] | Readies a one person install for the recipes: a personal tenant, a user and a new key, printed as an env file. |
ohs admin rekey [--batch <rows>] | Re-seals every stored OAuth token and webhook secret under OHS_ENCRYPTION_KEY after a key rotation, and prints counts. |
ohs import apple-health <export.zip|export.xml> [--since] [--tz] [--dry-run] | Loads a Health app export into an instance with a user token (--url/OHS_URL, --token/OHS_TOKEN). |
ohs mcp | Serves the read-only MCP tools on stdin and stdout for a local agent. See AI agents. |
ohs seed --demo [--tenant <id>] [--days 90] [--external-ref demo-user] [--seed N] | Fills the instance with synthetic data for one user, from six sources. Running it again adds nothing. See Try it without a wearable. |
ohs version | Prints the version and the commit it was built from. |
ohs help [command] | Prints help, or the help of one command. |
up and serve need OHS_DATABASE_URL and OHS_ENCRYPTION_KEY; migrate, admin and seed need
OHS_DATABASE_URL only (migrate latest needs nothing), except admin rekey, which also reads the
encryption keys; mcp needs OHS_MCP_KEY and the instance URL. doctor checks the same settings,
and prints a fresh key when OHS_ENCRYPTION_KEY is empty.
Exit status: 0 on success, 1 on failure (a failed doctor check included), 2 on a command line error.
In a container
The runtime image has no shell. Call the binary directly:
docker compose --env-file .env -f deploy/docker-compose.yml exec ohs /ohs admin tenant list
docker compose --env-file .env -f deploy/docker-compose.yml run --rm ohs doctor