# Migration: flag renames

> Flag rename reference for migrating from `uipcli` to UiPath CLI, grouped by domain.

This page maps individual `uipcli` flags to their `uip` counterparts. Use it alongside the [Command map](./migration-command-map.md) — the Command map shows what verb to call; this page shows what to do with each flag on that verb.

Flags are grouped by domain. **Auth is first** because it changes for every command at once. The rest of the page covers the flags that differ per verb — package/solution output, job execution, test runner output, tracing, and so on.

Legacy flag entries reflect the public `uipcli` flag surface documented for `2025.10` and earlier. The `uip` column matches the current [reference pages](./command-reference.md).

## How to read the "Where it lives" column

`uip` gives you three places to put a value that was a flag in `uipcli`:

- **Flag on each command** — pass it literally every time (`--tenant <name>`, `--folder-path Shared`).
- **Session state from `uip login`** — the flag has become something you set once with `uip login`; subsequent commands pick it up automatically. Override per-call with the appropriate flag.
- **Environment variable** — read by the CLI at runtime. Where applicable, prefer the `--client-id env.VARNAME` / `--client-secret env.VARNAME` prefix form on `uip login` to keep the secret out of the command line.

The "Where it lives" column tells you which of those applies.

## Authentication

This is the block that changes most. The legacy CLI accepted three credential modes per command (user/pass, refresh token, external app). The new CLI accepts only external-app credentials and interactive OAuth — user/pass and refresh-token auth are removed. See [Breaking changes — auth modes removed](./migration-breaking-changes.md#auth-modes-removed).

### External Application (the CI flow)

| Legacy flag | Legacy purpose | `uip` flag | Where it lives | Notes |
|---|---|---|---|---|
| `-A, --accountForApp <name>` | Organization name for external app | `--organization <name>` | **Flag on `uip login`** | Often optional — the organization is inferred from the External App record. Pass it when you need to disambiguate. |
| `-I, --applicationId <id>` | External app client ID | `--client-id <id>` (or `--client-id env.VARNAME`) | **Flag on `uip login`** | Prefer `env.VARNAME` to read from an environment variable. |
| `-S, --applicationSecret <secret>` | External app client secret | `--client-secret <secret>` (or `--client-secret env.VARNAME`) | **Flag on `uip login`** | Always use the `env.` prefix in CI to avoid leaking the secret into shell history and `ps` output. |
| `--applicationScope "<space-separated>"` | OAuth scopes | `--scope "<space-separated>"` / `-s, --scope` | **Flag on `uip login`** | Same space-separated format. Legacy calls typically list all `OR.*` scopes; keep the same list. |
| `--identityUrl <url>` | Custom identity authority (Automation Suite / PaaS) | `--authority <url>` | **Flag on `uip login`** | Renamed; semantics identical. Omit for Automation Cloud. |
| *(positional)* `<orchestrator_url>` | Orchestrator base URL | *(implicit from session)* | **Flag on `uip login` is not needed** — the CLI resolves the Orchestrator URL from the tenant/organization chosen at login. | |
| *(positional)* `<orchestrator_tenant>` | Tenant name | `-t, --tenant <name>` | **Flag on `uip login`** (default) **or per-command `-t`** | Once set at login, every subsequent command uses this tenant; `-t` on any command overrides it for that one call. |
| `-o, --organizationUnit <folder>` | Default folder for the command | `--folder-path <path>` or `--folder-key <guid>` | **Flag on the command that needs it** | Not a session-level concept in `uip`; pass it on each `jobs`/`processes`/`resource *` call. Config file can pin defaults. |

### User/pass authentication — removed

| Legacy flag | Status in `uip` |
|---|---|
| `-u, --username <user>` | **Removed.** Create an External Application and use `--client-id`. |
| `-p, --password <pass>` | **Removed.** Use `--client-secret`. |

The legacy CLI supported user/password auth against Orchestrator for environments where an External App was not yet provisioned. `uip` does not; see [Breaking changes — auth modes removed](./migration-breaking-changes.md#auth-modes-removed).

### Refresh-token authentication — removed

| Legacy flag | Status in `uip` |
|---|---|
| `-t, --token <refresh-token>` | **Removed.** Legacy `-t` was the short form for `--token`; in `uip`, `-t` is the short form for `--tenant`. |
| `-a, --accountName <name>` | **Removed.** Use `--organization` with an External Application instead. |

If a legacy pipeline used refresh-token auth, migrate to External Application. Automation Cloud no longer provisions the refresh-token flow for new workloads.

### Token-in-hand (new — no legacy equivalent)

For containers or runners that already hold a UiPath access token and do not need to exchange credentials, `uip` supports **environment-variable auth**: set `UIPATH_CLI_ENABLE_ENV_AUTH=true` and pass the token + org + tenant via env vars. See [Authentication — Flow 3](./authentication.md#flow-3-environment-variable-auth-access-token-already-in-hand). No file is written; the token is not refreshed.

### env.VAR_NAME prefix

`uip login` accepts a literal secret on `--client-id` / `--client-secret`, or the `env.VAR_NAME` prefix form that reads the value from an environment variable at runtime:

```bash
# Resolves at runtime from $UIPATH_CLIENT_SECRET; the secret never appears on the command line.
uip login \
  --client-id env.UIPATH_CLIENT_ID \
  --client-secret env.UIPATH_CLIENT_SECRET \
  --tenant "$UIPATH_TENANT"
```

Unlike `uipcli`, `uip` does **not** implicitly read `UIPATH_CLIENT_ID` / `UIPATH_CLIENT_SECRET`; you must reference them through the `env.` prefix (or pass literal values). See [Authentication — `env.VAR_NAME` prefix](./authentication.md#the-envvar_name-prefix) and [Breaking changes — implicit env-var reading removed](./migration-breaking-changes.md#implicit-env-var-auth-reading-removed).

## Output, logging, and tracing

Applies to every `uipcli` verb.

| Legacy flag | Legacy purpose | `uip` flag | Where it lives | Notes |
|---|---|---|---|---|
| `--traceLevel <None\|Critical\|Error\|Warning\|Information\|Verbose>` | Log verbosity | `--log-level <debug\|info\|warn\|error>` | **Global flag** on every command | Value range narrowed to four levels; default `info`. `Verbose` → `debug`, `Information` → `info`, `Warning` → `warn`, everything else → `error`. See [Global options](./global-options.md#--log-level). |
| *(legacy text stdout; no flag)* | Structured output | `--output <json\|table\|yaml\|plain>` | **Global flag** | Default is `json` on every command. Legacy printed human-readable text; `uip` prints JSON. Use `--output table` for the human view. See [Output formats](./output-formats.md). |
| *(no equivalent)* | Post-filter output | `--output-filter "<JMESPath>"` | **Global flag** | New in `uip`. Lets pipelines extract specific fields without piping through `jq`. |
| *(no equivalent)* | Duplicate logs to a file | `--log-file <path>` | **Global flag** | New in `uip`. Appends JSON Lines. |
| `-l, --language <locale>` | Log language | *(no equivalent)* | **Removed.** | Log output is English in `uip`. |
| `--captureCommandToJsonFile <path>` | Serialize the invocation to JSON | *(no equivalent)* | **Removed.** | Used to drive `uipcli run`, which is also removed. See [Command map — run](./migration-command-map.md#run). |

## Package flags

Legacy PascalCase flags become kebab-case in `uip rpa`. For every row below, the equivalent `uip rpa pack` flag is the legacy name with camelCase split into words and joined with `-` (for example, `--autoVersion` → `--auto-version`). Run `uip rpa pack --help` for the complete list on your installed tool version.

### package pack

| Legacy flag | `uip rpa pack` | Notes |
|---|---|---|
| `<workspace_path>` *(positional)* | `<project>` *(positional)* | Path to `project.json` or containing directory. |
| `-o, --output <dir>` | `-o, --output <dir>` | Same shape. Output directory for the generated `.nupkg`. |
| `-v, --version <semver>` | `-v, --version <semver>` | Sets package version. |
| `--autoVersion` | `--auto-version` | Auto-generate version from date/timestamp. |
| `--outputType <Process\|Library\|Tests\|Objects>` | `--output-type <Process\|Library\|Tests\|Objects>` | Force the output type. |
| `--splitOutput` | `--split-output` | Split runtime and design libraries. |
| `--releaseNotes <text>` | `--release-notes <text>` | Embedded in the `.nupkg` metadata. |
| `--repositoryUrl`, `--repositoryCommit`, `--repositoryBranch`, `--repositoryType` | `--repository-url`, `--repository-commit`, `--repository-branch`, `--repository-type` | VCS metadata. |
| `--projectUrl <url>` | `--project-url <url>` | Automation Hub idea URL. |
| `--certificatePath`, `--certificatePassword`, `--timestampServerUrl` | `--certificate-path`, `--certificate-password`, `--timestamp-server-url` | Code signing. |
| `--author <name>` | `--author <name>` | Package author. |
| `--governanceFilePath <policy>` | `--governance-file-path <policy>` | Run analyzer as part of pack. |
| Library auth (`--libraryOrchestratorUrl`, `--libraryOrchestratorTenant`, `-u`/`-p`/`-t`/`-a`/`-A`/`-I`/`-S`, `--libraryOrchestratorApplicationScope`, `--libraryOrchestratorFolder`, `--libraryIdentityUrl`, `--libraryOrchestratorAccountForApp`, `--libraryOrchestratorAccountName`, `--libraryOrchestratorApplicationId`, `--libraryOrchestratorApplicationSecret`, `--libraryOrchestratorUsername`, `--libraryOrchestratorPassword`, `--libraryOrchestratorAuthToken`) | Session from `uip login` | All the `library*` auth flags collapse into the single session configured by `uip login`. Pack is offline except when it needs to resolve library dependencies from a private feed; in that case the CLI uses the active session. |

### package analyze

| Legacy flag | `uip rpa analyze` |
|---|---|
| `<workspace_path>` *(positional)* | `<project>` *(positional)* |
| `--governanceFilePath <policy>` | `--governance-file-path <policy>` |
| `--analyzerTraceLevel <Off\|Error\|Warning\|Info\|Verbose>` | *(not yet documented)* |
| `--stopOnRuleViolation` | *(not yet documented — likely a severity threshold)* |
| `--treatWarningsAsErrors` | *(not yet documented)* |
| `--resultPath <path>` | *(not yet documented)* |
| `--ignoredRules <id1,id2>` | *(not yet documented)* |

### package deploy

Legacy `deploy` is now two `uip` calls; see [Command map — package deploy](./migration-command-map.md#package-deploy). Per-flag:

| Legacy flag | `uip` equivalent | Notes |
|---|---|---|
| `<packages_path>` *(positional)* | `<file>` *(positional on `uip or packages upload`)* | Single file. For a folder of `.nupkg`s, loop in the shell. |
| `<orchestrator_url>` *(positional)* | *(session)* | Drop it; provided by `uip login`. |
| `<orchestrator_tenant>` *(positional)* | `-t, --tenant` on `uip login` or the command | Defaults to session. |
| `-c, --createProcess <true\|false>` | *(implicit)* | `uip or packages upload` never creates the process. Call `uip or processes create` after upload if you want a process. |
| `--processName <name>` | `--name <name>` on `uip or processes create` | Renamed; **note**: `--process <name>` does not exist on the new CLI. |
| `--processNames <csv>` | *(loop in shell — no direct equivalent)* | Script the CSV iteration; call `processes create` per row. |
| `--processDescription <text>` | `-d, --description <text>` on `uip or processes create` | |
| `--use-package-description` | *(default behavior)* | `processes create` inherits the package description by default on create. |
| `--ignoreLibraryDeployConflict` | *(no equivalent)* | Library uploads via `uip resource libraries upload` fail cleanly on duplicate version; adjust pipeline logic to skip if the version already exists. |
| `-e, --environments <csv>` | *(no equivalent; modern folders only)* | The legacy classic-folder "environments" concept is not represented in the modern folder model. |
| `-h, --entryPointsPath <csv>` | `--entry-point <path>` on `uip or processes create` | Single entry point per call; loop for multi-entry-point packages. |

### package restore

| Legacy flag | `uip rpa restore` |
|---|---|
| `<workspace_path>` *(positional)* | `<project>` *(positional)* |
| `--restoreFolder <dir>` | `[outputPath]` *(positional)* |
| `--nugetConfigFilePath <path>` | *(not yet documented)* |
| Library auth flags | Session from `uip login` |

## Job flags (uipcli job run → uip or jobs start)

| Legacy flag | `uip or jobs start` | Notes |
|---|---|---|
| `<process_name>` *(positional)* | `<process-key>` *(positional)* | **GUID, not name.** Resolve with `uip or processes list --name <name> --output-filter 'Data[0].Key' --output plain`. |
| `<orchestrator_url>` *(positional)* | *(session)* | — |
| `<orchestrator_tenant>` *(positional)* | `-t, --tenant` | Defaults to session. |
| `-i, --input_path <file>` | `--input-file <path>` (file) or `--input-arguments '<json>'` (inline) | Two alternatives, mutually exclusive. |
| `-P, --priority <Low\|Normal\|High>` | `--job-priority <Low\|Normal\|High>` | — |
| `-j, --jobscount <n>` | `--jobs-count <n>` | — |
| `-r, --robots <csv>` | *(no direct equivalent)* | Classic-folder-only in legacy. Use `--machine-keys` or `--user-keys` (GUIDs) for modern folders. |
| `-U, --user <user>` | `--user-keys <guid[,guid]>` | Must resolve the username to a user GUID first (`uip or users list`). |
| `-M, --machine <hostname>` | `--machine-keys <guid[,guid]>` | Must resolve the hostname to a machine GUID first (`uip or machines list`). |
| `-R, --result_path <file>` | *(redirect stdout, or use `--output-filter`)* | `uip` prints the job envelope to stdout. `uip or jobs start <key> --wait-for-completion > result.json` writes the full envelope. |
| `-W, --timeout <seconds>` | `--timeout <seconds>` | Requires `--wait-for-completion`. |
| `-f, --fail_when_job_fails <true\|false>` | *(always-on)* | With `--wait-for-completion`, exit code is `1` if the job ends `Faulted`. No opt-out. |
| `-w, --wait <true\|false>` | `--wait-for-completion` *(flag)* | The new form is a boolean flag (no value). |
| `-b, --job_type <Unattended\|NonProduction>` | `--runtime-type <Unattended\|Headless\|Serverless\|NonProduction\|Development\|TestAutomation>` | Wider enum. |
| `-o, --organizationUnit <folder>` | `--folder-path <path>` or `--folder-key <guid>` | Or omit — `uip` infers the folder from the process key. |

## Test flags

### uipcli test run → uip tm testsets run + uip tm wait + uip tm report get

| Legacy flag | `uip` target | Notes |
|---|---|---|
| `-s, --testset <name>` | `--test-set-key <key>` on `uip tm testsets run` | **Key, not name.** Format `PROJECT:NN`. Resolve with `uip tm testsets list --project-key <key>`. |
| `-t, --testsetkey <key>` | `--test-set-key <key>` | Same value. Note: legacy `-t` clashes with the new CLI's `-t, --tenant`; use the long form. |
| `-P, --project-path <project.json>` | *(rework)* | The legacy pack-and-test-on-the-fly flow is split: `uip rpa pack` → `uip or packages upload` → author test set in Test Manager → `uip tm testsets run`. Authoring the test set is a one-time setup. |
| `-a, --projectKey <key>` | `--project-key <key>` on `uip tm wait` / `uip tm report get` | Different `projectKey`: the legacy flag set projectKey for Test Manager; the new flag scopes the wait/report to a Test Manager project. Same underlying value. |
| `-e, --environment <name>` | *(no equivalent)* | Classic-folder concept. |
| `-o, --organizationUnit <folder>` | `--folder-path <path>` on `uip tm testsets list` | Used to find the test set; not on `execute`. |
| `--out <junit\|uipath>` | `--output-format <junit\|uipath>` on `uip tm result download` | Download after the run. |
| `-r, --result_path <file>` | `--destination <path>` on `uip tm result download` | Download after the run. |
| `-w, --timeout <seconds>` | `--timeout <seconds>` on `uip tm wait` | Same semantics, different verb. |
| `-i, --input_path <file>` | `--input-path <file>` on `uip tm testsets run` | Exact same flag; schema for the JSON file is unchanged. |
| `--attachRobotLogs` | *(use `uip tm attachment download` after the run)* | |
| `--retryCount <n>` | `uip tm executions retry --execution-id <id>` | Re-runs failed cases. No auto-retry at launch. |
| `--repositoryUrl`, `--repositoryCommit`, `--repositoryBranch`, `--repositoryType`, `--projectUrl`, `--releaseNotes`, `--disableBuiltInNugetFeeds`, `--nugetConfigFilePath`, `--author` | *(not on `uip tm`)* | These were pack-side inputs when `test run` had to pack first. They belong on `uip rpa pack`. |

### uipcli test parallel

| Legacy flag | `uip` equivalent |
|---|---|
| `--testsConfigurationFilePath <file>` | *(no equivalent)* — write a shell loop over `uip tm testsets run` |
| `--projectsRootDirectoryPath <dir>` | *(no equivalent)* |
| `--executionArtifactsDirectoryPath <dir>` | `--destination <path>` on `uip tm result download` and `uip tm attachment download`, run per execution |
| `--cliDirectoryPath <uipcli.dll>` | *(no equivalent)* |
| `--out <junit\|uipath>` | `--output-format` on `uip tm result download` |
| `--disableBuiltInNugetFeeds` | *(not on `uip tm`; use on `uip rpa pack` when packing test projects)* |
| `--projectKey <key>` | `--project-key <key>` |
| `--author <name>` | *(not on `uip tm`)* |

## Asset flags

Both legacy verbs (`asset deploy` and `asset delete`) consumed a CSV file; the new CLI has no bulk deploy — loop over CSV rows and call `uip resource assets create` / `delete` per row. See [Command map — asset](./migration-command-map.md#asset).

| Legacy flag | `uip` equivalent | Notes |
|---|---|---|
| `<assets_file>` *(positional)* | *(parse the CSV in the shell)* | — |
| `<orchestrator_url>` *(positional)* | *(session)* | — |
| `<orchestrator_tenant>` *(positional)* | `-t, --tenant` | — |
| CSV column `name` | `<name>` *(positional)* on `uip resource assets create` | — |
| CSV column `value` | `<value>` *(positional)* | — |
| CSV column `type` | `--type <Text\|Bool\|Integer\|Credential\|Secret>` | Case-insensitive. |
| CSV column `description` | `-d, --description <text>` | — |

## Solution flags

The verb structure is largely preserved; flag names were normalized to kebab-case and the auth block was collapsed to the session.

| Legacy flag (across verbs) | `uip` equivalent | Notes |
|---|---|---|
| `-o, --output <dir>` on `solution pack` | *(positional `<outputPath>`)* | — |
| `-v, --version <semver>` on `solution pack` | `--version <semver>` | — |
| `-n, --name <name>` on `solution pack` | `--name <name>` | — |
| Auth block (on every `solution` verb that touches Orchestrator) | Session from `uip login` | — |
| `--packageName <n>` on `solution deploy` | `--package-name <n>` on `uip solution deploy run` | — |
| `--packageVersion <v>` on `solution deploy` | `--package-version <v>` | — |
| `--folderName <n>` on `solution deploy` | `--folder-name <n>` | — |
| Positional `<deploymentName>` on `solution deploy-activate` / `solution deploy-uninstall` | `<deployment-name>` on `uip solution deploy activate` / `uip solution deploy uninstall` | — |

## Telemetry and hidden flags

| Legacy flag | Status |
|---|---|
| `-y, --disableTelemetry` (hidden) | Replaced by env var `UIPATH_TELEMETRY_DISABLED=1`. See [What's new — Telemetry](./whats-new.md#other-meaningful-shifts). |
| `--origin` (hidden) | Removed. |
| `--captureCommandToJsonFile` (hidden) | Removed along with `uipcli run`. |

## See also

- [Command map](./migration-command-map.md) — per-verb mapping with before/after snippets.
- [Breaking changes](./migration-breaking-changes.md) — auth, env vars, exit codes, stdout format.
- [Authentication](./authentication.md) — the three supported auth flows.
- [Configuration](./configuration.md) — environment variables and flag precedence.
- [Global options](./global-options.md) — `--output`, `--output-filter`, `--log-level`, `--log-file`.