Skip to main content

Botfather Commands

The slaw botfather sub-commands let you inspect and manage this instance's enrollment with a Botfather control tower, without touching the running server.

Prerequisites
  • A SLAW config file at ~/.slaw/instances/default/config.json (created by slaw onboard)
  • botfather.url set in the config — this is the switch that enables the control-tower integration. No enabled flag is needed; the URL's presence activates it.

slaw botfather status​

Print enrollment and reporting state for this instance:

slaw botfather status

Example output when enrolled:

SLAW Control Tower (botfather)
Tower:       https://tower.example.com
Enforcement: enforce
Status:      enrolled (active)
Machine ID:  sha256:4f3a...
Instance:    default
Enrolled:    2026-05-01T09:12:00.000Z

When no tower is configured:

Status: standalone — no control tower configured
Set botfather.url in config to enroll with a tower.

The status command reads the local config and the cached enrollment credentials — it does not make a network call.

Status values​

StatusMeaning
enrolled (active)Instance has a valid per-instance API key from the tower
not enrolledbotfather.url is set but the instance has not yet received a key (pending or never enrolled)
standalonebotfather.url is not set; the instance runs independently

slaw botfather reenroll​

Clear the local enrollment credentials so the server re-enrolls with the tower on its next start (or its next enrollment attempt if already running):

slaw botfather reenroll

Use this when:

  • The tower revoked the instance's API key and you need a fresh enrollment
  • Enrollment credentials appear stale or corrupted
  • You've moved the instance to a new machine and need to re-establish identity
note

botfather.url must be set in the config. If no tower is configured, this command exits with an error.

After running reenroll, the enrollment state goes back to not enrolled. The server re-initiates the enrollment flow automatically — the instance lands in the tower's pending queue until an Operator approves it.

slaw botfather disconnect​

Print instructions for disconnecting from the control tower:

slaw botfather disconnect

Disconnecting requires removing botfather.url from the config file and restarting the server.

Enforcement mode blocks disconnect

In enforce mode (the default), slaw botfather disconnect prints an error and exits:

Disconnect is blocked: enforcement is 'enforce'.
Your organisation manages this. Edit config only if permitted.

Disconnect is only available in advisory enforcement mode. If your instance is enforce-managed, contact your Botfather Operator to change the enforcement setting or revoke the instance from the tower.

Enforcement modes​

ModeBehaviour
enforceHard gate — SLAW blocks startup until the instance is active with the tower (fail-open if already enrolled and tower is unreachable)
advisorySoft — SLAW starts regardless of tower state; enrollment is attempted but not required

The enforcement mode is set in the config (botfather.enforcement) or managed by the tower. On MDM-provisioned machines, fields marked locked are read-only.

Next steps​