CLI

The Norcube CLI (norcube, alias nrc) exposes Backup under the nrc backup command group. It's the tool for the things the dashboard doesn't do: org-wide backup listings, downloading backups, running restore tests, pausing and resuming datasources and policy attachments, and scripting.

Every command supports --org <slug> to override the organization and -o table|json|yaml for output. Setup is the standard CLI login:

nrc login
nrc org use <slug>
nrc backup datasource list     # sanity check

Datasources

# list, with optional name filter
nrc backup datasource list
nrc backup datasource list --query prod

# raw details for one datasource
nrc backup datasource get <id>

# master switch: stop/start all scheduled backups for a database
nrc backup datasource pause          # interactive picker in a TTY
nrc backup datasource pause <id>
nrc backup datasource resume <id>

The list shows name, engine, environment, active state, and ID. pause/resume toggle the datasource's active flag — semantics in Pause and resume: future scheduling stops, queued/running jobs still finish, no catch-up on resume.

Policy attachments

# what's attached to a datasource (policy, enabled, priority, destination)
nrc backup policy list --datasource <id>

# pause/resume one attachment (other policies keep running)
nrc backup policy pause  --datasource <id> --policy <policyId>
nrc backup policy resume --datasource <id> --policy <policyId>

# detach — destructive, so it confirms (or takes --yes for scripts)
nrc backup policy detach --datasource <id> --policy <policyId> --yes

Detach semantics are the same as the dashboard's: future runs stop, existing archives and job history stay — see Attach a policy.

Backups (org-wide job history)

The dashboard shows jobs per datasource; the CLI lists them across the whole organization — the tool for "did anything fail last night?":

nrc backup list                          # newest first, all datasources
nrc backup list --datasource <id>        # repeatable to filter several
nrc backup list --limit 100 --cursor <c> # manual paging
nrc backup list --all-pages --max-items 5000 -o json

Columns: datasource, status, restore-test verdict, trigger (schedule/manual), started, duration, size, job ID. The TEST column shows the latest restore test of each backup (passed, passed (warnings), failed, testing…, or a dash when never tested). With -o json the output pipes straight into jq:

# every failed job, with its error-relevant fields
nrc backup list -o json \
  | jq '[.[] | select(.jobStatus == "failed")]'

When more pages exist, the CLI prints the --cursor hint on stderr — so it never corrupts piped JSON.

Download a backup

# to a local file, named after the backup object
nrc backup download <jobId> --datasource <id>

# stream to stdout and straight into a restore
nrc backup download <jobId> -d <id> --file - | gunzip | pg_restore -d "$DSN"

The backend issues a short-lived presigned URL and the CLI streams the bytes directly from storage. Postgres artifacts are pg_dump custom-format archives (restore with pg_restore); MongoDB artifacts are mongodump archives (restore with mongorestore --archive). Both are compressed according to the policy's compression setting, so adjust the decompression step to match (gunzip, zstd -d, or none). Backups in customer-managed buckets can't be downloaded this way, because Norcube holds no read credentials for your bucket; fetch the object from your own storage instead.

Restore health and restore tests

# org-wide restore health, one row per datasource
nrc backup health
nrc backup health -o json     # e.g. for a CI gate

# restore-test one backup into a throwaway database, right now
nrc backup restore-test run <jobId> --datasource <id>

health aggregates recent restore tests per datasource: pass rate, warnings, and when the last test ran. A datasource that has never been tested shows a dash, never a fake 0%. restore-test run queues an on-demand test; the verdict lands in the TEST column of nrc backup list.

Scripting patterns

# maintenance window: pause, do the work, resume
nrc backup datasource pause "$DS_ID"
./run-migration.sh
nrc backup datasource resume "$DS_ID"

# export full history before deleting a datasource
nrc backup list --datasource "$DS_ID" --all-pages -o json > history.json

Non-interactive environments need explicit arguments — commands that would open a picker error out without one, and destructive commands require --yes when there's no TTY to confirm on.

What stays in the dashboard (or API)

Creating datasources, credentials, policies, and destinations, and running manual backups aren't CLI commands today — use the dashboard or call the API directly; the CLI authenticates with the same session tokens the dashboard uses.