Command line (CLI)

Every Reqad install ships a reqad command that creates, changes and removes hosting accounts, databases and mailboxes from a shell or a script. It runs the same code as the panel, so an account created on the command line is indistinguishable from one created in the browser - same vhost, same PHP-FPM pool, same mail and DNS setup.

Commands

Every command has its own help:

reqad --help
reqad account --help
reqad db --help
reqad email --help
reqad auth --help
reqad health --help
reqad api --help
reqad mcp --help
reqad deploy --help
reqad app --help

Not seeing account, db or email in reqad --help? Update the panel with dnf update reqad.

Hosting accounts

reqad account list
reqad account show   <user>
reqad account create <user> <domain>
                     [--www] [--email] [--dns] [--letsencrypt] [--quota=MB]
reqad account edit   <user>
                     [--password] [--php=VERSION[:fpm|mod_php]] [--email=on|off]
reqad account delete <user> [--yes]

Create an account for a domain, with mail, the www. alias, a DNS zone at your configured provider and a Let's Encrypt certificate:

reqad account create bob example.com --www --email --dns --letsencrypt

The account is created with the server's default PHP version. Switch it later - and on Apache also choose the handler:

reqad account edit bob --php=8.3
reqad account edit bob --php=8.2:mod_php
reqad account edit bob --email=off

reqad account list prints one row per account:

┌──────┬──────┬──────────────────┬───────┬────────┬─────────────────────┐
│  UID │ USER │ DOMAIN           │ EMAIL │ STATUS │ CREATED             │
├──────┼──────┼──────────────────┼───────┼────────┼─────────────────────┤
│ 1041 │ bob  │ example.com      │ yes   │ active │ 2026-09-14 11:20:07 │
│ 1042 │ shop │ shop.example.net │ no    │ active │ 2026-09-18 09:02:55 │
└──────┴──────┴──────────────────┴───────┴────────┴─────────────────────┘

reqad account show adds the account's PHP version and handler, disk usage and quota, shell access, its mailboxes and databases, and its limits: CPU, memory and processes for SSH, cron and the web terminal, and database connections per database user. reqad account limits <user> shows what is in use right now and recent limit hits.

reqad account perms bob checks the owners and permissions of everything in the account's home: files owned by another user or by root (often copied in as root), groups other than the account's or the web server's, files anyone can write to, setuid files, wp-config.php and .env files anyone can read, and the modes of ~/.ssh. It exits 0 when everything is fine and 3 when it found problems. --fix repairs them and sets the account's top folders and PHP pool by the panel's permissions model; it first writes an undo script to /var/lib/reqad/perms-restore-bob-<time>.sh. --keep-root leaves files owned by root as they are, for files you put there as root on purpose, for example published downloads the site must not change.

reqad account perms bob                 # check only
reqad account perms bob --fix           # repair
reqad account perms bob --fix --keep-root

Databases

reqad db list   [--account=ACCOUNT]
reqad db create <account> <name> [--dbuser=NAME]
reqad db delete <database> [--yes]
reqad db passwd <dbuser>

<account> is the hosting account the database belongs to, and it is the prefix of every name, exactly as in the panel. create takes the short name and adds the prefix to both the database and its user; --dbuser picks a different user name, also prefixed. delete and passwd take the full name:

reqad db create bob wp --generate-password    # database bob_wp, user bob_wp
reqad db create bob shop --dbuser=shopuser    # database bob_shop, user bob_shopuser
reqad db passwd bob_wp
reqad db delete bob_shop --yes

┌──────────┬─────────────┬─────────┬─────────────────────────────────────┐
│ DATABASE │ SYSTEM USER │ SIZE_MB │ USERS                               │
├──────────┼─────────────┼─────────┼─────────────────────────────────────┤
│ bob_wp   │ bob         │   12.41 │ bob_wp@localhost, bob_wp2@localhost │
│ bob_shop │ bob         │    0.72 │ bob_shop@localhost                  │
└──────────┴─────────────┴─────────┴─────────────────────────────────────┘

The account must exist - the prefix is what ties a database to a hosting account, and is why deleting the account also deletes its databases. Deleting a database also drops the users that were granted on it, unless a user still has access to another database. A dash in the SYSTEM USER column means there is no hosting user behind the prefix - which is how a database left behind by a removed account shows up.

Mailboxes

reqad email list   [--domain=DOMAIN]
reqad email create <address> [--size=SIZE]
reqad email edit   <address> [--password] [--enable|--disable] [--size=SIZE]
reqad email delete <address> [--yes]

The domain must already belong to an account with mail enabled (reqad account create … --email, or reqad account edit <user> --email=on). --size (500M, 2G, or default) sets the mailbox size; it needs Reqad Hosting Pro.

reqad email create sales@example.com --generate-password
reqad email edit   sales@example.com --disable
reqad email list   --domain=example.com

┌───────────────────┬─────────────┬──────────┐
│ EMAIL             │ SYSTEM USER │ STATUS   │
├───────────────────┼─────────────┼──────────┤
│ bob@example.com   │ bob         │ active   │
│ sales@example.com │ bob         │ disabled │
└───────────────────┴─────────────┴──────────┘

--disable blocks IMAP, POP3 and SMTP login for that mailbox but keeps delivering mail to it, so nothing is lost while an account is suspended; --enable allows login again. delete removes the mailbox with its messages, filters and autoresponder.

Acting as one account

Add --user=ACCOUNT to any account, db or email command to run it with that hosting account's permissions instead of the server admin's. Lists show only the account's own databases and mailboxes, and anything that belongs to another account is refused:

reqad db list --user=bob                    # only bob's databases
reqad db delete alice_wp --user=bob --yes   # refused: does not belong to account bob
reqad email create info@example.com --user=bob

Creating or deleting accounts, assigning databases and the auth commands stay with the server admin and are refused with --user. It is the same check that account-level access to Reqad uses, so it is also a quick way to see what an account is allowed to do.

Panel login

reqad auth status
reqad auth mode       web|basic
reqad auth passwd     [<user>]
reqad auth 2fa-reset  [<user>]
reqad auth sessions
reqad auth logout     [<user>]
reqad auth unban      <ip>
reqad auth firewall   [status|off]
reqad auth email-code [status|off|on]
reqad auth passkeys   [<user>] [--remove-all]
reqad auth log        [--lines=N]

reqad auth passwd --generate-password   # new random password, printed once
reqad auth unban 203.0.113.7
reqad auth log --lines=50

These commands need SSH access as root, which is why they are the way back in - see Locked out? for which one fits which problem.

Needs attention

reqad health list    [--account=ACCOUNT] [--all]
reqad health run     [--check=ID]
reqad health checks
reqad health dismiss <id> [--days=N|--forever]
reqad health restore <id>

With --user=ACCOUNT, list shows only that account's problems and dismiss works only on them; run stays with the server admin. What each check looks for is on the Needs attention page.

REST API

reqad api status
reqad api on|off
reqad api tokens  [--all]
reqad api new     <name> [--account=ACCOUNT] [--write] [--delete] [--days=N] [--ip=LIST]
reqad api revoke  <id|name|prefix>
reqad api log     [--lines=N] [--token=ID]

The endpoints and examples are on the REST API page. With --user=ACCOUNT these commands are refused: tokens are the server admin's.

AI assistants (MCP)

reqad mcp status
reqad mcp on|off
reqad mcp tokens  [--all]
reqad mcp new     <name> [--account=ACCOUNT] [--write] [--delete] [--days=N] [--ip=LIST]
reqad mcp revoke  <id|name|prefix>
reqad mcp log     [--lines=N] [--token=ID]
reqad mcp tools   [--token-file=PATH]
reqad mcp serve   --token-file=PATH

How to connect an assistant: AI assistants (MCP). With --user=ACCOUNT these commands are refused.

Git deployments

reqad deploy list     [--account=ACCOUNT]
reqad deploy show     <id|domain> [--secret]
reqad deploy create   <domain> --repo=URL [settings]
reqad deploy edit     <id|domain> [settings] [--new-secret]
reqad deploy run      <id|domain> [--wait]
reqad deploy rollback <id|domain> [--release=NAME] [--wait]
reqad deploy log      <id|domain> [--run=ID]
reqad deploy delete   <id|domain> [--yes]

create prints the deploy key and the webhook address and secret. run --wait and log on a running deploy follow its output and exit with 1 when it fails, which suits scripts. With --user=ACCOUNT only that account's sites can be deployed. More on the Git deployments page.

Node.js and Python apps

reqad app list      [--account=ACCOUNT]
reqad app show      <id|domain>
reqad app create    <domain> --runtime=node:24|python:3.12 --start=CMD [settings] [--no-start]
reqad app edit      <id|domain> [settings]
reqad app start|stop|restart <id|domain>
reqad app logs      <id|domain> [--lines=N]
reqad app env       <id|domain> [--file=PATH]
reqad app delete    <id|domain> [--yes]
reqad app runtimes  [--available]
reqad app runtime   install|update|remove node <major> | python <3.x>

env prints the app's environment file, or replaces it with --file and restarts the app. --no-start on create waits for the code, for example for the first Git deploy. With --user=ACCOUNT, only that account's apps can be managed; installing runtimes is the server admin's. More on the apps page.

Passwords

No command takes a password as an argument - an argument would land in your shell history and in the process list, where any user on the server can read it. There are three ways to supply one:

# interactive: asks twice, echoes nothing
reqad account create bob example.com

# from a secret store, a file or a pipe
pass show hosting/bob | reqad account create bob example.com --password-stdin

# let Reqad pick one and print it
reqad email create sales@example.com --generate-password

Scripting

Add --json to any command to get a machine-readable result instead of a table or a message. Colors and box drawing are dropped automatically when the output is not a terminal, so piping is safe either way.

reqad account show bob --json

{
    "ok": true,
    "message": "",
    "warnings": [],
    "error": "",
    "data": {
        "uid": 1041,
        "user": "bob",
        "domain": "example.com",
        "status": "active",
        "created_at": "2026-09-14 11:20:07",
        "email": true,
        "disk_usage": 512,
        "disk_quota": 0,
        "php": "8.3",
        "php_handler": "fpm",
        "mailboxes": [
            "sales@example.com"
        ],
        "databases": [
            "bob_wp"
        ]
    }
}

warnings is where a change that went through but not cleanly reports itself - a DNS zone that could not be created, a certificate request that did not start, a DKIM key the provider refused. The operation succeeded; something around it did not.

Anything that deletes asks for confirmation when it has a terminal, and refuses to run without one. -y or --yes skips the question - which is what you want in a script and what you do not want in a shell.

Tab completion

Reqad installs bash completion for the command, so there is nothing to add to your profile. Press Tab after reqad and it completes commands, options and real values from the server - account names, databases, database users, mailboxes, mail domains and the PHP versions actually installed:

reqad account edit <TAB>              bob   shop
reqad account edit bob --php=8.<TAB>  8.2   8.3   8.4   8.5
reqad db delete bob_<TAB>            bob_wp   bob_shop
reqad email edit sa<TAB>             sales@example.com

It works behind sudo reqad too. Completion never prompts for a password: the values that need root are only offered to a shell that already is root.

Need a hand? Create a free account or contact us.