PowerShell cmdlets

NOTE: This page was generated from the OpenBolt source code based on version 5.6.0 on 2026-07-03 19:37:31 +0000. Do not edit it here; fix it upstream.

To use the PuppetBolt PowerShell module, see the installation documentation.

Cmdlet syntax

Bolt PowerShell cmdlets follow a verb-noun convention.

To view a full list of available cmdlets, use the Get-Command cmdlet:

Get-Command -Module PuppetBolt

Cmdlets

These PowerShell cmdlets are available in the Bolt PowerShell module.

Invoke-BoltApply

Apply Puppet manifest code on the specified targets.

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Invoke-BoltCommand Run a command on the specified targets.

Option	Description	Mandatory?
`-Manifest`	The manifest to apply	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Noop`	See what changes Bolt will make without actually executing the changes.
`-Execute`	Puppet manifest code to apply to the targets.	✓
`-CompileConcurrency`	Maximum number of simultaneous manifest block compiles (default: number of cores).
`-HieraConfig`	Specify where to load Hiera config from (default: <project>/hiera.yaml).

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Receive-BoltFile Download a file or directory from one or more targets. Downloaded files and directories are saved to the a subdirectory matching the target's name under the destination directory. The destination directory is expanded relative to the downloads subdirectory of the project directory.

Option	Description	Mandatory?
`-Command`	The command to execute	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-EnvVar`	Environment variables to set on the target.

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Send-BoltFile Upload a local file or directory.

Option	Description	Mandatory?
`-Source`	The source file or directory to download	✓
`-Destination`	The destination to download to	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Get-BoltGroup Show the list of groups in the inventory.

Option	Description	Mandatory?
`-Source`	The source file or directory to upload	✓
`-Destination`	The destination to upload to	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Tmpdir`	The directory to upload and execute temporary files on the target.

</tr> </tbody> </table> ### Get-BoltInventory Show the list of targets an action would run on. This command will list all targets in the project's inventory by default. To filter the targets in the list, use the --targets, --query, or --rerun options. To view detailed configuration and data for targets, use the --detail option. To learn more about the inventory run 'bolt guide inventory'.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Format`	Output format to use: human, json, or rainbow.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).

</tr> </tr> </tr> </tbody> </table> ### Invoke-BoltLookup Look up a value with Hiera.

Option	Description	Mandatory?
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Format`	Output format to use: human, json, or rainbow.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-Detail`	Show resolved configuration for the targets.

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Add-BoltModule Add a module to the project. Module declarations are loaded from the project's configuration file. Bolt will automatically resolve all module dependencies, generate a Puppetfile, and install the modules.

Option	Description	Mandatory?
`-Key`	The key to look up	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-HieraConfig`	Specify where to load Hiera config from (default: <project>/hiera.yaml).
`-PlanHierarchy`	Look up a value with Hiera in the context of a specific plan.

</tr> </tbody> </table> ### Register-BoltModuleTypes Generate type references to register in plans. To learn more about Bolt modules, run 'bolt guide module'.

Option	Description	Mandatory?
`-Module`	The name of the module to add to the Bolt project	✓
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).

</tr> </tr> </tbody> </table> ### Install-BoltModule Install the project's modules. Module declarations are loaded from the project's configuration file. Bolt will automatically resolve all module dependencies, generate a Puppetfile, and install the modules.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>

</tr> </tr> </tbody> </table> ### Get-BoltModule List modules available to the Bolt project. Providing the name of a module will display detailed documentation for the module.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Force`	Force a destructive action.
`-Resolve`	Use --no-resolve to install modules listed in the Puppetfile without resolving modules configured in Bolt project configuration.</td>

</tr> </tr> </tbody> </table> ### Get-BoltPlan Show available plans and plan documentation. Omitting the name of a plan will display a list of plans available in the Bolt project. Providing the name of a plan will display detailed documentation for the plan, including a list of available parameters.

Option	Description	Mandatory?
`-Name`	The module to show
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>

</tr> </tr> </tbody> </table> ### Invoke-BoltPlan Run a plan on the specified targets.

Option	Description	Mandatory?
`-Name`	The plan to show
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Filter`	Filter tasks and plans by a matching substring.
`-Format`	Output format to use: human, json, or rainbow.

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Convert-BoltPlan Convert a YAML plan to a Puppet language plan and print the converted plan to stdout. Converting a YAML plan might result in a plan that is syntactically correct but has different behavior. Always verify a converted plan's functionality. Note that the converted plan is not written to a file.

Option	Description	Mandatory?
`-Name`	The plan to run	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Params`	Parameters to a task or plan as json, a json file '@<file>', or on stdin '-'.
`-CompileConcurrency`	Maximum number of simultaneous manifest block compiles (default: number of cores).
`-Tmpdir`	The directory to upload and execute temporary files on the target.
`-HieraConfig`	Specify where to load Hiera config from (default: <project>/hiera.yaml).

</tr> </tr> </tbody> </table> ### New-BoltPlan Create a new plan in the current project.

Option	Description	Mandatory?
`-Name`	The plan to convert	✓
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>

</tr> </tbody> </table> ### Get-BoltPlugin Show available plugins.

Option	Description	Mandatory?
`-Name`	The plan to create	✓
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Pp`	Create a new Puppet language plan.

</tr> </tr> </tbody> </table> ### Invoke-BoltPolicy Apply a policy to the specified targets.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Color`	Whether to show output in color.
`-Format`	Output format to use: human, json, or rainbow.
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### New-BoltPolicy Create a new policy in the current project.

Option	Description	Mandatory?
`-Name`	The policy or policies to apply	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-CompileConcurrency`	Maximum number of simultaneous manifest block compiles (default: number of cores).
`-HieraConfig`	Specify where to load Hiera config from (default: <project>/hiera.yaml).
`-Noop`	See what changes Bolt will make without actually executing the changes.

</tr> </tbody> </table> ### Get-BoltPolicy Show available policies.

Option	Description	Mandatory?
`-Name`	The policy to create	✓
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).

</tr> </tbody> </table> ### New-BoltProject Create a new Bolt project in the current working directory. Specify a name for the Bolt project. Defaults to the basename of the current working directory.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).

</tr> </tr> </tbody> </table> ### Update-BoltProject Migrate a Bolt project to use current best practices and the latest version of configuration files.

Option	Description	Mandatory?
`-Name`	The name of the Bolt project to create
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Modules`	A comma-separated list of modules to install from the Puppet Forge when initializing a project. Resolves and installs all dependencies.</td>

</tr> </tbody> </table> ### Invoke-BoltScript Run a script on the specified targets. Arguments passed to a script are passed literally and are not interpolated by the shell. Any arguments containing spaces or special characters should be quoted.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table> ### Protect-BoltSecret Encrypt a value.

Option	Description	Mandatory?
`-Script`	The script to execute	✓
`-Arguments`	The arguments to the script
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Tmpdir`	The directory to upload and execute temporary files on the target.
`-EnvVar`	Environment variables to set on the target.

</tr> </tr> </tbody> </table> ### Unprotect-BoltSecret Decrypt a value.

Option	Description	Mandatory?
`-Text`	The text to encrypt	✓
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Plugin`	Select the plugin to use.

</tr> </tr> </tbody> </table> ### New-BoltSecretKey Create new encryption keys.

Option	Description	Mandatory?
`-Text`	The text to decrypt	✓
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Plugin`	Select the plugin to use.

</tr> </tr> </tbody> </table> ### Get-BoltTask Show available tasks and task documentation. Omitting the name of a task will display a list of tasks available in the Bolt project. Providing the name of a task will display detailed documentation for the task, including a list of available parameters.

Option	Description	Mandatory?
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Plugin`	Select the plugin to use.
`-Force`	Force a destructive action.

</tr> </tr> </tbody> </table> ### Invoke-BoltTask Run a task on the specified targets. Parameters take the form parameter=value.

Option	Description	Mandatory?
`-Name`	The task to show
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Filter`	Filter tasks and plans by a matching substring.
`-Format`	Output format to use: human, json, or rainbow.

</tr> </tr> </tr> </tr> </tr> </tr> </tr> </tr> </tbody> </table>

Option	Description	Mandatory?
`-Name`	The task to run	✓
`-Targets`	Identifies the targets of the command. For more information, see 'bolt guide targets'.</td>
`-Query`	Query PuppetDB to determine the targets.
`-Rerun`	Retry on targets from the last run. Available filters are 'all', 'failure', and 'success'.</td>
`-User`	User to authenticate as.
`-Password`	Password to authenticate with.
`-PasswordPrompt`	Prompt for user to input password.
`-PrivateKey`	Path to private ssh key to authenticate with.
`-HostKeyCheck`	Check host keys with SSH.
`-Ssl`	Use SSL with WinRM.
`-SslVerify`	Verify remote host SSL certificate with WinRM.
`-RunAs`	User to run as using privilege escalation.
`-SudoPassword`	Password for privilege escalation.
`-SudoPasswordPrompt`	Prompt for user to input escalation password.
`-SudoExecutable`	Experimental. Specify an executable for running as another user.
`-Concurrency`	Maximum number of simultaneous connections.
`-Inventoryfile`	Specify where to load inventory from (default: <project>/inventory.yaml).
`-SaveRerun`	Whether to update the rerun file after this command.
`-Cleanup`	Whether to clean up temporary files created on targets.
`-Puppetdb`	The named PuppetDB instance to connect to by default.
`-Project`	Path to load the Bolt project from (default: autodiscovered from current dir).
`-Modulepath`	List of directories containing modules, separated by ':' Directories are case-sensitive.</td>
`-Transport`	Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm. For more information, see 'bolt guide transports'.</td>
`-ConnectTimeout`	Connection timeout in seconds (defaults vary).
`-TTY`	Request a pseudo TTY on targets that support it.
`-NativeSsh`	Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
`-SshCommand`	Experimental. Executable to use instead of the net-ssh Ruby library.
`-CopyCommand`	Experimental. Command to copy files to remote hosts if using native SSH.
`-ChoriaConfigFile`	Path to a Choria/MCollective client configuration file.
`-ChoriaMcollectiveCertname`	Override the MCollective certname for Choria client identity. The choria-mcorpc-support library identifies non-root clients as '<username>.mcollective', which fails when authenticating with a certificate that has a different CN (e.g. the host's Puppet cert). Set this to the CN of the certificate being used.</td>
`-ChoriaSslCa`	CA certificate path for Choria TLS authentication.
`-ChoriaSslCert`	Client certificate path for Choria TLS authentication.
`-ChoriaSslKey`	Client private key path for Choria TLS authentication.
`-ChoriaCollective`	Choria collective to route messages through.
`-ChoriaPuppetEnvironment`	Puppet environment for bolt_tasks file downloads (default: 'production').
`-ChoriaRpcTimeout`	Seconds to wait for replies to individual Choria RPC calls (default: 30).
`-ChoriaTaskTimeout`	Seconds to wait for task execution to complete (default: 300).
`-ChoriaCommandTimeout`	Seconds to wait for commands and scripts to complete (default: 60).
`-ChoriaBrokers`	Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
`-ChoriaBrokerTimeout`	Seconds to wait for the TCP connection to a Choria broker (default: 30).
`-Format`	Output format to use: human, json, or rainbow.
`-Color`	Whether to show output in color.
`-Trace`	Display error stack traces.
`-Stream`	Stream output from scripts and commands to the console. Run with --no-verbose to prevent Bolt from displaying output a second time after the action is completed.</td>
`-LogLevel`	Set the log level for the console. Available options are trace, debug, info, warn, error, fatal.</td>
`-ClearCache`	Clear plugin, plan, and task caches before executing.
`-Params`	Parameters to a task or plan as json, a json file '@<file>', or on stdin '-'.
`-Tmpdir`	The directory to upload and execute temporary files on the target.
`-Noop`	See what changes Bolt will make without actually executing the changes.
`-ChoriaTaskAgent`	Which Choria agent to use for task execution (bolt_tasks, shell). Defaults to 'bolt_tasks'. Set to 'shell' for tasks not on the Puppet Server.</td>

Puppet v3 API

Puppet v4 API

CA v1 API

Server-specific API

Admin API

Status API

Metrics

PowerShell cmdlets

Cmdlet syntax

Cmdlets

Invoke-BoltApply