curl one-liners
Purpose: Interrogate an AEM instance from the shell: status, content, packages, replication.
Who this page is for
| Audience | Why it matters to you |
|---|---|
| All engineers | Scripting and spot checks |
Use -u user:pass against local/dev instances (never embed prod credentials in scripts — token/SSO mechanisms there). $AEM = e.g. http://localhost:4502.
Instance health
curl -s -u admin:admin "$AEM/system/console/bundles.json" | jq '[.data[] | select(.state!="Active" and .fragment==false)] | length'
curl -s -u admin:admin "$AEM/system/health?tags=*&format=json" | jq .
curl -s -o /dev/null -w "%{http_code} %{time_total}s\n" "$AEM/content/phi/plans/gold-hospital.html"Content inspection
curl -s -u admin:admin "$AEM/content/phi/plans/gold-hospital/jcr:content.json" | jq .
curl -s -u admin:admin "$AEM/content/phi/plans.1.json" | jq 'keys'
curl -s -u admin:admin "$AEM/bin/querybuilder.json?type=cq:Page&path=/content/phi&p.limit=5" | jq '.hits[].path'Write operations (Sling POST servlet — dev conveniences)
# set a property
curl -u admin:admin -F "jcr:title=Gold Hospital Cover" "$AEM/content/phi/plans/gold-hospital/jcr:content"
# create a node
curl -u admin:admin -F "jcr:primaryType=nt:unstructured" -F "label=Ambulance" \
"$AEM/content/phi/plans/gold-hospital/jcr:content/benefits/benefit-4"
# delete
curl -u admin:admin -F ":operation=delete" "$AEM/content/phi/plans/gold-hospital/jcr:content/benefits/benefit-4"Packages
curl -u admin:admin -F file=@mypackage.zip -F install=true "$AEM/crx/packmgr/service.jsp"
curl -u admin:admin -X POST "$AEM/crx/packmgr/service/.json/etc/packages/my_packages/mypackage.zip?cmd=install"
curl -s -u admin:admin "$AEM/crx/packmgr/list.jsp" | jq '.results[].name'Replication
# activate a page
curl -u admin:admin -F path=/content/phi/plans/gold-hospital -F cmd=Activate "$AEM/bin/replicate.json"
# deactivate
curl -u admin:admin -F path=/content/phi/plans/gold-hospital -F cmd=Deactivate "$AEM/bin/replicate.json"
# agent queue state
curl -s -u admin:admin "$AEM/etc/replication/agents.author/publish/jcr:content.queue.json" | jq .All of these hit endpoints that must be dispatcher-blocked in production (security) — if any works through your public domain, that IS the finding.