---
name: pp-n8n
description: "Every n8n Public API endpoint, plus a local mirror that answers what is failing, what uses what, and what changed. Trigger phrases: `what n8n workflows are failing`, `which workflows use this credential`, `diff this workflow against prod`, `list my n8n workflows`, `use n8n`, `run n8n-pp-cli`."
author: "Mini"
license: "Apache-2.0"
argument-hint: "<command> [args] | install cli|mcp"
allowed-tools: "Read Bash"
metadata:
  openclaw:
    requires:
      bins:
        - n8n-pp-cli
    install:
      - kind: go
        bins: [n8n-pp-cli]
        module: github.com/mvanhorn/printing-press-library/library/developer-tools/n8n/cmd/n8n-pp-cli
---
<!-- GENERATED FILE — DO NOT EDIT.
     This file is a verbatim mirror of library/developer-tools/n8n/SKILL.md,
     regenerated post-merge by tools/generate-skills/. Hand-edits here are
     silently overwritten on the next regen. Edit the library/ source instead.
     See the repository agent guide, section "Generated artifacts: registry.json, cli-skills/". -->

# n8n — Printing Press CLI

## Prerequisites: Install the CLI

This skill drives the `n8n-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first:

1. Install via the Printing Press installer. It defaults binaries to `$HOME/.local/bin` on macOS/Linux and `%LOCALAPPDATA%\Programs\PrintingPress\bin` on Windows:
   ```bash
   npx -y @mvanhorn/printing-press-library install n8n --cli-only
   ```
2. Verify: `n8n-pp-cli --version`
3. Ensure the reported install directory is on `$PATH` for the agent/runtime that will invoke this skill.

If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.9 or newer). This installs into `$GOPATH/bin` (default `$HOME/go/bin`), so add that directory to `$PATH` instead:

```bash
go install github.com/mvanhorn/printing-press-library/library/developer-tools/n8n/cmd/n8n-pp-cli@latest
```

If `--version` reports "command not found" after install, the runtime cannot see the binary directory on `$PATH`. Do not proceed with skill commands until verification succeeds.

Manage workflows, executions, credentials, data tables, projects, and more on any self-hosted or cloud n8n instance. Sync once and get offline search, failure triage with 'executions failures', cross-workflow usage lookups with 'workflows uses', and node-level diffs between instances with 'workflows diff'.

## When to Use This CLI

Use this CLI to operate an n8n instance from a terminal or agent: list and edit workflows, triage failed executions, find which workflows use a credential or node, compare workflows between instances, and manage data tables, tags, variables, and projects through the public API.

## Anti-triggers

Do not use this CLI for:
- Designing new workflows from scratch with node documentation lookup; use n8n-mcp or the n8n editor
- Instance administration that needs the server shell (database backups, encryption keys, n8n export:credentials --decrypted)
- Reading credential secret values; the public API never returns them

## Unique Capabilities

> The local-store commands (`workflows uses`, `workflows stale`, `credentials usage`, `executions failures`) read the synced mirror. Run `n8n-pp-cli sync --resources workflows,executions,credentials` first and re-sync to refresh.

### Operations triage
- **`executions failures`** — See what broke recently, grouped by workflow and failing node, with the latest execution to retry.

  _Reach for this first when asked what is failing in n8n instead of paging through executions one by one._

  ```bash
  n8n-pp-cli executions failures --since 24h --agent
  ```
- **`workflows stale`** — Find active workflows with no recent successful run, workflows that never ran, and active workflows without an error workflow.

  _Use for hygiene sweeps to catch silently dead automations._

  ```bash
  n8n-pp-cli workflows stale --days 7 --agent
  ```

### Cross-workflow insight
- **`workflows uses`** — Find every workflow and node that uses a credential, node type, webhook path, variable, or sub-workflow.

  _Use before rotating a credential, retiring a webhook, or editing a shared sub-workflow to know the blast radius._

  ```bash
  n8n-pp-cli workflows uses --node-type n8n-nodes-base.slack --agent
  ```
- **`workflows diff`** — Compare a workflow across two instances or two saved versions at the node and connection level, ignoring layout noise.

  _Use before promoting dev to prod or after an edit to see exactly which nodes changed._

  ```bash
  n8n-pp-cli workflows diff 0vB2cZqgHEmb3RKs --against-config ~/.config/n8n-pp-cli/prod.toml --agent
  ```
- **`credentials usage`** — List unused credentials, credentials many workflows depend on, and workflow references to credentials that no longer exist.

  _Use before credential rotation or client handoff cleanup._

  ```bash
  n8n-pp-cli credentials usage --unused --agent
  ```

### Agent-native plumbing
- **`executions wait`** — Block until an execution finishes and exit non-zero if it failed, with the failing node and message.

  _Use in an edit-then-test loop to branch on whether the run passed without writing a polling script._

  ```bash
  n8n-pp-cli executions wait 1234 --max-wait 5m --agent
  ```

## Command Reference

**audit** — Operations about security audit

- `n8n-pp-cli audit` — Generate a security audit for your n8n instance.

**community-packages** — Operations about community packages

- `n8n-pp-cli community-packages install-package` — Install a community package by npm name and optional version.
- `n8n-pp-cli community-packages list-installed-packages` — Retrieve all installed community packages with pending update info.
- `n8n-pp-cli community-packages uninstall-package` — Uninstall a community package by name.
- `n8n-pp-cli community-packages update-package` — Update an installed community package to a new version.

**credential-type-policies** — Manage credential type policies

- `n8n-pp-cli credential-type-policies create-credential-type-policy-document` — Creates a reusable policy document that is not yet attached to any scope. Rule ids must be unique within the list.
- `n8n-pp-cli credential-type-policies delete-credential-type-policy-document` — Deletes a policy document. A document that is still attached to a scope is rejected with 409; detach it first.
- `n8n-pp-cli credential-type-policies get-credential-type-instance-policy` — Returns the composed instance-scope policy
- `n8n-pp-cli credential-type-policies get-credential-type-policy-document` — Retrieve a credential type policy document
- `n8n-pp-cli credential-type-policies get-credential-type-project-policy` — Returns the project's own composed policy, not the result of combining it with the instance policy.
- `n8n-pp-cli credential-type-policies list-credential-type-policy-documents` — Returns a cursor-paginated list of reusable policy documents.
- `n8n-pp-cli credential-type-policies put-credential-type-instance-policy` — Sets the instance default action and replaces the rules of its single policy document, creating both on first write.
- `n8n-pp-cli credential-type-policies put-credential-type-project-policy` — Sets the project's default action and replaces the rules of its single policy document, creating both on first write.
- `n8n-pp-cli credential-type-policies replace-credential-type-policy-attachments` — Replaces every attachment on a scope. `scopeId` comes from the scope's `GET` response once it has been written.
- `n8n-pp-cli credential-type-policies update-credential-type-policy-document` — Replaces the document's whole rule list. `version` must equal the version last read; a stale value is rejected with 409.

**credentials** — Operations about credentials

- `n8n-pp-cli credentials create` — Creates a credential that can be used by nodes of the specified type.
- `n8n-pp-cli credentials delete` — Deletes a credential from your instance. You must be the owner of the credential.
- `n8n-pp-cli credentials get` — Retrieves a credential by ID. Credential data (secrets) is not included.
- `n8n-pp-cli credentials get-type` — Show credential data schema
- `n8n-pp-cli credentials list` — Retrieve all credentials from your instance. Only available for the instance owner and admin.
- `n8n-pp-cli credentials test` — Tests a credential by ID using the stored credential data.
- `n8n-pp-cli credentials transfer` — Transfer a credential to another project.
- `n8n-pp-cli credentials update` — Updates an existing credential. You must be the owner of the credential.

**data-tables** — Operations about data tables and their rows

- `n8n-pp-cli data-tables create` — Create a new data table in your personal project or a team project you have access to.
- `n8n-pp-cli data-tables delete` — Delete a data table. This will also delete all rows in the table.
- `n8n-pp-cli data-tables get` — Retrieve a specific data table by ID.
- `n8n-pp-cli data-tables list` — Retrieve a list of all data tables with optional filtering, sorting, and pagination.
- `n8n-pp-cli data-tables update` — Update a data table's name.

**discover** — API capability discovery

- `n8n-pp-cli discover` — Returns a filtered capability map based on the caller's API key scopes.

**executions** — Operations about executions

- `n8n-pp-cli executions delete` — Deletes an execution from your instance.
- `n8n-pp-cli executions get` — Retrieve an execution from your instance.
- `n8n-pp-cli executions get-tags` — Get annotation tags for an execution.
- `n8n-pp-cli executions list` — Retrieve all executions from your instance.
- `n8n-pp-cli executions retry` — Retry an execution from your instance.
- `n8n-pp-cli executions stop` — Stop an execution by id.
- `n8n-pp-cli executions stop-many` — Stop multiple executions from your instance based on filter criteria.
- `n8n-pp-cli executions update-tags` — Update annotation tags of an execution.

**insights** — Operations about insights

- `n8n-pp-cli insights` — Retrieve the insights summary for the selected date range.

**n8n-packages** — Beta — breaking changes may still occur without major version bump.

- `n8n-pp-cli n8n-packages create` — **Beta** — breaking changes may still occur without major version bump.
- `n8n-pp-cli n8n-packages import-package` — **Beta** — breaking changes may still occur without major version bump. Imports a gzip-compressed tar package (`.
- `n8n-pp-cli n8n-packages import-package-selection` — **Beta** — breaking changes may still occur without major version bump.

**node-type-policies** — Manage node type policies

- `n8n-pp-cli node-type-policies create-node-type-policy-document` — Creates a reusable policy document that is not yet attached to any scope. Rule ids must be unique within the list.
- `n8n-pp-cli node-type-policies delete-node-type-policy-document` — Deletes a policy document. A document that is still attached to a scope is rejected with 409; detach it first.
- `n8n-pp-cli node-type-policies get-node-type-instance-policy` — Returns the composed instance-scope policy
- `n8n-pp-cli node-type-policies get-node-type-policy-document` — Retrieve a node type policy document
- `n8n-pp-cli node-type-policies get-node-type-project-policy` — Returns the project's own composed policy, not the result of combining it with the instance policy.
- `n8n-pp-cli node-type-policies list-node-type-policy-documents` — Returns a cursor-paginated list of reusable policy documents.
- `n8n-pp-cli node-type-policies put-node-type-instance-policy` — Sets the instance default action and replaces the rules of its single policy document, creating both on first write.
- `n8n-pp-cli node-type-policies put-node-type-project-policy` — Sets the project's default action and replaces the rules of its single policy document, creating both on first write.
- `n8n-pp-cli node-type-policies replace-node-type-policy-attachments` — Replaces every attachment on a scope. `scopeId` comes from the scope's `GET` response once it has been written.
- `n8n-pp-cli node-type-policies update-node-type-policy-document` — Replaces the document's whole rule list. `version` must equal the version last read; a stale value is rejected with 409.

**projects** — Operations about projects

- `n8n-pp-cli projects create` — Create a team project on your instance.
- `n8n-pp-cli projects delete` — Delete a project from your instance.
- `n8n-pp-cli projects list` — Retrieve projects from your instance.
- `n8n-pp-cli projects update` — Update a project on your instance.

**promotions** — Operations about promotion providers, connections, and package operations

- `n8n-pp-cli promotions add-project-to-connection` — Links a team project to a project-scoped connection. A project can be linked to only one connection.
- `n8n-pp-cli promotions apply-package` — Checks the full package at the configured branch tip.
- `n8n-pp-cli promotions apply-project-selection` — Applies selected workflow changes from the project's Apply branch. Send the selected change-list IDs in workflowIds.
- `n8n-pp-cli promotions clone-checkout` — Clones the configured branch into local storage on the instance that handles the request. Safe to call repeatedly.
- `n8n-pp-cli promotions continue-apply-package` — Rechecks the configured source and current target bindings.
- `n8n-pp-cli promotions continue-apply-project-selection` — Rechecks the project's Apply source and the current bindings for the selection.
- `n8n-pp-cli promotions create-connection` — Creates a connection on an existing provider, with up to one initial configuration for each direction.
- `n8n-pp-cli promotions create-provider` — Creates a provider and its authentication material.
- `n8n-pp-cli promotions delete-config` — Deletes the configuration and its local checkout. Nothing in Git changes.
- `n8n-pp-cli promotions delete-connection` — Deletes the connection with its configurations, project links, and local checkouts. Its provider is kept.
- `n8n-pp-cli promotions delete-provider` — A provider used by a connection cannot be deleted.
- `n8n-pp-cli promotions disconnect-checkout` — Removes the local checkout and keeps the configuration, its credentials, and the trusted SSH host keys.
- `n8n-pp-cli promotions get-changes` — Compares a team project on this instance with the branch of its promotion configuration and lists the workflows that
- `n8n-pp-cli promotions get-connection` — Returns the connection with its provider summary and its configurations.
- `n8n-pp-cli promotions get-connection-projects` — List projects linked to a promotion connection
- `n8n-pp-cli promotions get-provider` — Returns the provider with its public configuration. Secrets are never returned.
- `n8n-pp-cli promotions list-connections` — Returns a cursor-paginated list of connections with their configurations.
- `n8n-pp-cli promotions list-providers` — Returns a cursor-paginated list of providers, without their public configuration.
- `n8n-pp-cli promotions promote-package` — Exports every team project, commits it, and pushes to the configured base branch or a new timestamped branch.
- `n8n-pp-cli promotions promote-project-selection` — Promotes a chosen set of a team project's workflows to the Promote branch of the project's promotion configuration.
- `n8n-pp-cli promotions remove-project-from-connection` — Unlink a project from a promotion connection
- `n8n-pp-cli promotions update-connection` — Updates the name, target, or provider. Scope cannot change, and configurations have their own routes.
- `n8n-pp-cli promotions update-provider` — Renames the provider, and replaces its credentials when `auth` is sent.
- `n8n-pp-cli promotions upsert-apply-config` — Replaces the whole configuration, so an omitted name resets it to 'Apply'. Answers 200 whether it created or replaced.
- `n8n-pp-cli promotions upsert-promote-config` — Replaces the whole configuration

**role-mapping-rules** — Operations about identity-provider role-mapping rules

- `n8n-pp-cli role-mapping-rules create` — Creates a rule that maps an identity-provider claim expression to a role.
- `n8n-pp-cli role-mapping-rules delete` — Deletes a role-mapping rule.
- `n8n-pp-cli role-mapping-rules list` — Returns the configured role-mapping rules.
- `n8n-pp-cli role-mapping-rules update` — Updates a rule's claim expression, role, and/or project assignments.

**roles** — Operations about roles

- `n8n-pp-cli roles create` — Creates a custom role. Set `roleType` to `global` for an instance-wide role or `project` for a project role.
- `n8n-pp-cli roles delete` — Deletes a custom role. System roles cannot be deleted.
- `n8n-pp-cli roles get` — Returns a single role with its scopes. Set `withUsageCount` to include how many users and projects use the role.
- `n8n-pp-cli roles list` — Returns all roles grouped by type (global and project).
- `n8n-pp-cli roles update` — Replaces a custom role's display name, description, and scopes. System roles cannot be updated.

**settings** — Manage settings

- `n8n-pp-cli settings create-log-streaming-destination` — Create a log streaming destination.
- `n8n-pp-cli settings delete-log-streaming-destination` — Remove a log streaming destination.
- `n8n-pp-cli settings get-ldap-configuration` — Retrieve the current LDAP configuration, including every field exposed in the UI.
- `n8n-pp-cli settings get-ldap-sync` — Retrieve the history of LDAP synchronizations, most recent first.
- `n8n-pp-cli settings get-log-streaming-destination` — Retrieve a single log streaming destination by id.
- `n8n-pp-cli settings get-log-streaming-event-types` — List the event types that can be streamed to a log streaming destination.
- `n8n-pp-cli settings get-oidc-configuration` — Retrieve the current OIDC SSO configuration, including every field exposed in the UI.
- `n8n-pp-cli settings get-otel` — Retrieve the current OpenTelemetry configuration, including every field exposed in the UI.
- `n8n-pp-cli settings get-saml-configuration` — Retrieve the current SAML SSO configuration
- `n8n-pp-cli settings get-security-policy` — Retrieve the instance security policy: personal-space publishing and sharing
- `n8n-pp-cli settings list-log-streaming-destinations` — List the configured log streaming destinations.
- `n8n-pp-cli settings run-ldap-sync` — Manually trigger an LDAP synchronization. The response returns the new sync history record.
- `n8n-pp-cli settings set-oidc-configuration` — Set the OIDC SSO configuration. The update takes effect exactly as it would from the UI, using the same validation.
- `n8n-pp-cli settings test-log-streaming-destination` — Send a test message to the destination to verify it is reachable and configured correctly.
- `n8n-pp-cli settings test-otel-trace` — Send a single test span to the given OTLP collector and report whether it was accepted.
- `n8n-pp-cli settings update-ldap-configuration` — Replace the LDAP configuration with the provided full object (partial updates are not supported).
- `n8n-pp-cli settings update-log-streaming-destination` — Replace an existing log streaming destination.
- `n8n-pp-cli settings update-otel` — Set the OpenTelemetry configuration.
- `n8n-pp-cli settings update-saml-configuration` — Replace the SAML SSO configuration with the provided full object.
- `n8n-pp-cli settings update-security-policy` — Replace the instance security policy with the provided full object. Every writable field must be sent.

**source-control** — Operations about source control

- `n8n-pp-cli source-control get-status` — Previews the pending changes between the instance and the connected Git branch in either the `push` or `pull` direction.
- `n8n-pp-cli source-control pull` — Fetches changes from the connected Git branch into the instance.
- `n8n-pp-cli source-control push` — Commits and pushes the selected files to the connected Git branch.

**tags** — Operations about tags

- `n8n-pp-cli tags create` — Create a tag in your instance.
- `n8n-pp-c