github-actions · Oct 14, 2026
@@ -311,7 +311,7 @@ Read: references/tooling-{tooling}/index.md
 ### feature:passkeys
 ```
 Read: references/feature-passkeys/index.md
-Then Read the detected SDK's passkey leaf from the hub's "Example code snippets" table (e.g. nextjs → references/feature-passkeys/nextjs-auth0.md, react → references/feature-passkeys/auth0-react.md) — the leaf has the exact API surface and the required ceremony; do not implement from framework-{framework}/index.md alone.
+Then Read the detected SDK's passkey leaf from the hub's "Example code snippets" table (e.g. nextjs → nextjs-auth0.md; react-native/expo → ONLY react-native-auth0.md, which covers react-native-web — never auth0-react.md) — it has the exact API and ceremony; don't implement from framework-{framework}/index.md alone.
 Read: references/tooling-{tooling}/index.md
 If framework detected: Read references/framework-{framework}/index.md
 ```

@@ -15,16 +15,16 @@ For each item, build the command. **Use a first-class subcommand when one exists
 | Breached password detection | `auth0 protection breached-password-detection update` | `PATCH attack-protection/breached-password-detection` |
 | Suspicious IP throttling | `auth0 protection suspicious-ip-throttling update` | `PATCH attack-protection/suspicious-ip-throttling` |
 | Branding (universal login, colors, logo) | `auth0 universal-login update` (alias `auth0 ul update`) | `PATCH branding` |
-| Custom domains | `auth0 domains create` / `update <id>` | `POST custom-domains` / `PATCH custom-domains/<domain-id>` |
-| Connections (DB, social, enterprise) | (none) | `PATCH connections/<connection-id>` (full options blob) |
+| Custom domains | `auth0 domains create` / `update <id>` / `domains default set <domain>` / `domains default show` | `POST custom-domains` / `PATCH custom-domains/<domain-id>` |
+| Connections (DB, social, enterprise) | `auth0 connections create` / `update <id>` / `delete <id> --force` | `PATCH connections/<connection-id>` (full options blob) |
 | APIs / resource servers | `auth0 apis update <id>` | `PATCH resource-servers/<api-id>` |
 | Apps / clients (callbacks, origins, grant types, refresh tokens) | `auth0 apps update <id>` | `PATCH clients/<app-id>` |
 | Roles | `auth0 roles update <id>` | `PATCH roles/<role-id>` |
 | Actions | `auth0 actions create/update <id>/deploy <id>` | `POST actions/actions` / `PATCH actions/actions/<action-id>` / `POST actions/actions/<action-id>/deploy` |
 | Log streams | `auth0 logs streams create <provider>` / `update <provider> <id>` (provider is required: `eventbridge`, `eventgrid`, `http`, `datadog`, `splunk`, or `sumo`) | `POST log-streams` / `PATCH log-streams/<log-stream-id>` |
 | Email provider/templates | `auth0 email provider update` / `auth0 email templates update` | `PATCH emails/provider` / `PATCH email-templates/<template-name>` |
-| MFA factor toggles | (none) | `PUT guardian/factors/<factor>` |
-| MFA policies | (none) | `PUT guardian/policies` |
+| MFA factor toggles | `auth0 guardian factors set <factor> --enabled` | `PUT guardian/factors/<factor>` |
+| MFA policies | `auth0 guardian policies set --policy <policy>` | `PUT guardian/policies` |
 | Prompts customization | `auth0 universal-login prompts update <prompt>` (alias `auth0 ul prompts update`) | `PUT prompts/<prompt>/custom-text/<lang>` |
 | Network ACLs | `auth0 network-acl create` / `update <id>` | `POST network-acls` / `PATCH network-acls/<network-acl-id>` |
 | Auth0 Organizations | `auth0 orgs create` / `update <id>` | `POST organizations` / `PATCH organizations/<org-id>` |
@@ -102,7 +102,7 @@ Even in Express mode, these commands are blocked unless the user explicitly type
 - `auth0 logout`
 - `auth0 tenants delete`
 - `auth0 apps delete` (any app, especially the CheckMate app)
-- `auth0 api delete "connections/<id>"` (no first-class delete command exists for connections)
+- `auth0 connections delete <id> --force`
 - `auth0 api delete <anything>`
 
 ## Closing the run

@@ -55,7 +55,7 @@ Checks to run in parallel (no chat output during checks):
 | CLI installed | `auth0 --version` | version or missing |
 | Tenant session | `auth0 tenants list --json` | first tenant or none |
 | CheckMate app | `auth0 apps list --json \| jq '.[]\|select(.name\|test("CheckMate";"i"))'` | client_id or none |
-| M2M scopes | `auth0 api get client-grants?client_id=<id>` | scope count or none |
+| M2M scopes | `auth0 client-grants list --client-id <id>` | scope count or none |
 | CheckMate npm | `command -v a0checkmate` | path or missing |
 | Node version | `node -v` | version or missing |
 | Reviewer | read `state/operator.json` | name or missing |
@@ -132,7 +132,7 @@ For non-interactive shells (CI, agent without TTY), or private cloud tenants, us
 When an access token expires, the CLI prompts to confirm the default tenant (`Continue login with default tenant 'your-tenant.auth0.com'? [y/N]`) or lets you pick a different one — select `y` to proceed with the default, `N` to choose another. Note that CLI usage consumes Management API rate limits according to the subscription plan.
 
 ### 1.2 Pin tenant
-Save the tenant domain returned by `auth0 tenants list --json` (`.[0].domain` if only one, otherwise ask the user to pick) into `state/setup.json.tenant_domain`. **Don't parse region from the domain suffix** — use the value the CLI returns. Custom domains (private cloud) are valid here.
+Save the tenant domain returned by `auth0 tenants list --json` (`.[] | select(.active) | .name` for the active tenant; if several tenants, ask the user to pick) into `state/setup.json.tenant_domain`. **Don't parse region from the domain suffix** — use the value the CLI returns. Custom domains (private cloud) are valid here.
 
 **This pinned `tenant_domain` is the canonical Auth0-hosted URL.** Every report reference to the tenant URL — header right rail, "authentication is served from `<tenant_domain>`" narrative, CLI commands — reads from `state/setup.json.tenant_domain`. Never derive it from the company context, never parse it from the company domain. The company context provides company-level fields (name, products, business model, integrations) — never the tenant URL.
 
@@ -168,13 +168,11 @@ read:guardian_factors read:mfa_policies read:actions read:log_streams
 read:logs read:network_acls read:event_streams read:hooks read:rules
 ```
 
-Grant via the Management API (the CLI `auth0 api` is a raw wrapper):
+Grant the Management API scopes with a client grant:
 ```bash
-auth0 api post "client-grants" --data '{
-  "client_id":"<id>",
-  "audience":"https://<tenant_domain>/api/v2/",
-  "scope":["read:tenant_settings","read:custom_domains","read:prompts","read:clients","read:connections","read:connections_options","read:resource_servers","read:client_grants","read:roles","read:branding","read:email_provider","read:email_templates","read:phone_providers","read:phone_templates","read:shields","read:attack_protection","read:self_service_profiles","read:guardian_factors","read:mfa_policies","read:actions","read:log_streams","read:logs","read:network_acls","read:event_streams","read:hooks","read:rules"]
-}'
+auth0 client-grants create --client-id "<id>" \
+  --audience "https://<tenant_domain>/api/v2/" \
+  --scopes "read:tenant_settings,read:custom_domains,read:prompts,read:clients,read:connections,read:connections_options,read:resource_servers,read:client_grants,read:roles,read:branding,read:email_provider,read:email_templates,read:phone_providers,read:phone_templates,read:shields,read:attack_protection,read:self_service_profiles,read:guardian_factors,read:mfa_policies,read:actions,read:log_streams,read:logs,read:network_acls,read:event_streams,read:hooks,read:rules"
 ```
 
 Some tenants reject `read:hooks` / `read:rules` (deprecated). On 400, retry without those two and proceed.
@@ -279,11 +277,11 @@ The Phase 5 report needs more than CheckMate alone provides. Run these in parall
 ```bash
 auth0 apps list --json                   # apps_list — count + names for Section 1, 3, 4
 auth0 logs list --number 50 --json       # logs_sample — to flag "Active" login activity
-auth0 api get tenants/settings           # tenant_settings — for "Current Auth0 Tier" detection (look for plan/subscription hints; fallback "Free Plan"). Map detected features against the pricing reference to infer the tier when no explicit plan field is present.
-auth0 api get custom-domains             # custom_domains — empty array → triggers "Branding Gap"
-auth0 api get connections                # connections — for enterprise-connection check
-auth0 api get log-streams                # log_streams — empty array → triggers "Observability Gap"
-auth0 api get attack-protection/breached-password-detection  # for "Account Security" section
+auth0 tenant-settings show --json             # tenant_settings — for "Current Auth0 Tier" detection (look for plan/subscription hints; fallback "Free Plan"). Map detected features against the pricing reference to infer the tier when no explicit plan field is present.
+auth0 domains list                       # custom_domains — empty array → triggers "Branding Gap"
+auth0 connections list                   # connections — for enterprise-connection check
+auth0 logs streams list                  # log_streams — empty array → triggers "Observability Gap"
+auth0 protection breached-password-detection show  # for "Account Security" section
 ```
 
 These outputs feed directly into the Phase 5 fusion.