Akamai CLI: Enterprise Application Access

Table of contents



Enterprise Application Access (EAA) comes with a full suite of APIs. Yet you need to write scripts or use Postman to be able to interact with the service.

With Akamai CLI you can run very common operations directly from the command line, no coding required.

This can be helpful if you plan to consume EAA logs into your favorite SIEM, or automate some operation in your workflow with Bash, Powershell or solution like Ansible.

Key features


Make sure your first have Akamai CLI installed on your machine.

We support a wide variety of platform: Windows, Mac, Linux, container…

For more information, please visit the Getting Started guide on

Once the Akamai CLI is installed, the cli-eaa module installation is done via akamai install eaa command:

$ akamai install eaa

And voilà!

The command takes care of all the dependencies.

To check your cli-eaa version with the version command

$ akamai eaa version

Configuration file

In order to work, the CLI module will look for an .edgerc configuration file stored in your home directory or your prefered location.
For the latter make sure to use the --edgerc parameter in the command line.\

To create a {OPEN} API user, follow these instructions. Make sure the API user has READ-WRITE permission to Enterprise Application Access.

To create a legacy API key and secret from, connect to Akamai Control Center.

The .edgerc file should look like:


; EAA Legacy API used by the 'akamai eaa log' command
eaa_api_host =

; {OPEN} API for everything else
host =
client_token = akab-xxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx
client_secret = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
access_token = akab-xxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx
; If your organization have multiple contracts with EAA service
; please add it below. Contact your Akamai representative to obtain it
contractid = A-B-1CD2E34

Upgrade cli-eaa

To upgrade your CLI EAA module to the latest version, use:

$ akamai update eaa


EAA event logs

EAA has two types of logs, the user access logs and the administrators audit logs. For detailed description about each field, please refer to the product documentation on

You can pull log either in near realtime, using -f, or retrieve a period of time passing EPOCH timestamp in --start and --end You cannot combine -f and explicit date range.

Pull user access logs, block till new logs are received. You can stop by pressing Control+C (Control+Break) or sending a signal SIG_INT or SIG_TERM to the process

$ akamai eaa log access --tail

You may want a one time chunk of log for a period of time, let’s say the last 6 hours:

$ START=$(bc <<< "$(date +%s) - 6 * 60 * 60")
$ akamai eaa log access -s $START

Send the user access events to a file (utf-8 encoding is being used):

$ akamai eaa log access --tail -o /tmp/eaa_access.log

Pull admin audit events, block till new logs are received

$ akamai eaa log admin --tail


$ akamai eaa search datascience
app://mD_Pw1XASpyVJc2JwgICTg,Data Science,akdemo-datascience,,4
Found 1 app(s), total 124 app(s)

You can save locally the application

$ akamai eaa app app://mD_Pw1XASpyVJc2JwgICTg > ~/eaa_app_datascience_v3.json

And restore

$ cat ~/eaa_app_datascience_v3.json | akamai eaa app app://mD_Pw1XASpyVJc2JwgICTg update

Or quickly walk through the JSON tree with jq.

$ akamai eaa -b app app://mD_Pw1XASpyVJc2JwgICTg | jq .advanced_settings.websocket_enabled

One question we often get: What are the applications using connector xyz?
Buckle up, we use jq and grep.
Note: we use -b to avoid the extra info the CLI spills out, like the footer.

$ akamai eaa -b search | akamai eaa app - | jq -j '.name, ": ", (.agents[]|.name, " "), "\n"'|grep xyz

View groups associated with a particular application

$ akamai eaa app app://FWbUCfpvRKaSOX1rl0u55Q viewgroups

You can pipe command as well, example to deploy all the application matching “tunnel”

$ akamai eaa -b search bastion | akamai eaa app - deploy

Directory operations

List the configured directories

$ akamai eaa dir
dir://FuiibQiDQzmC34oBx7INfQ,Cloud Directory,7
dir://EX5-YjMyTrKgeWKHrqhUEA,Okta LDAP,10
dir://Ygl1BpAFREiHrA8HR7dFhA,Azure AD,1

Trigger directory synchronization

$ akamai eaa dir dir://2Kz2YqmgSpqT_IJq9BLkWg sync
Synchronize directory 2Kz2YqmgSpqT_IJq9BLkWg
Directory 2Kz2YqmgSpqT_IJq9BLkWg synchronization requested.


Here with the shortcut c and the column command available in most POSIX environment. When piping, the extra information written on stderr so they appear seperately.

$ akamai eaa c | column -t -s,
Total 9 connector(s)
#Connector-id                 name                reachable  status  version     privateip      publicip        debug
con://cht3_GEjQWyMW9LEk7KQfg  demo-v2-con-1-amer  1          1       4.4.0-2765  Y
con://Wy0Y6FrwQ66yQzLBAInC4w  demo-v2-con-2-amer  1          1       4.4.0-2765  Y
con://dK0f1UvhR7i8-RByABDXaQ  demo-v2-con-4-emea  1          1       4.4.0-2765    N
con://Ihmf51dASo-R1P37hzaP3Q  demo-v2-con-3-emea  1          1       4.4.0-2765    N
con://XiCmu80xQcSWnaeQcvH8Vg  demo-v2-con-5-apj   1          1       4.4.0-2765   Y
con://pkGjL5OgSjyHoymMguvp9Q  demo-v2-con-6-apj   1          1       4.4.0-2765   Y
con://NAWSlptPSXOjq-bk2-EQPw  demo-v2-con-10-rus  1          1       4.4.0-2765   Y
con://e_0nShZBQ7esNAC3ZEkhSQ  demo-v2-con-3-amer  1          1       4.4.0-2765  Y
con://OEe9o-n2S_aMeZpLxgwG0A  tmelab-sfo          1          1       4.4.0-2765   Y

Known Limitations

Troubleshooting and Support


If the command is not working properly, you can increase the level of verbosity using:

The messages are printed on stderr so you can safely redirect stdout to a file or use the --output option.


cli-eaa is provided as-is and it is not supported by Akamai Support. To report any issue, feature request or bug, please open a new issue into the GitHub Issues page

We are strongly encouraging developer to create a pull request.