# Network

URL: https://docs.hanzo.ai/docs/cli/network

> The `hanzo network` commands.

Also for this capability: [API](https://docs.hanzo.ai/docs/openapi/network) · **CLI** · [MCP](https://docs.hanzo.ai/docs/mcp-tools/network) · [SDKs](https://docs.hanzo.ai/docs/sdks)

Mounts the Hanzo Cloud NETWORKING surface: the tenant's Hanzo Zero Trust footprint — the overlay network, its routers and its services — served as clean, org-scoped REST off the unified cloud binary and fronting the Hanzo Zero Trust controller (hanzoai/zt, an ZT-based fabric).

[API reference →](https://docs.hanzo.ai/docs/openapi/network)

```bash
hanzo network list
```

Every command takes `--json` for the raw response and `--help` for its own flags. Sign in once with `hanzo auth login`; the commands below use that session, and the org they act in is the one it carries.

| Command                  | What it does                                                       |
| ------------------------ | ------------------------------------------------------------------ |
| `hanzo network get <id>` | Returns one overlay network by id, scoped to the caller's org.     |
| `hanzo network list`     | Returns the caller's org overlay network on the Zero Trust fabric. |
| `hanzo network routers`  | Returns the Zero Trust routers the caller's org owns.              |

### Identities

| Command                            | What it does                                                 |
| ---------------------------------- | ------------------------------------------------------------ |
| `hanzo network identities create`  | Puts the caller on the org's overlay as its own IAM subject. |
| `hanzo network identities list`    | Returns the fabric identities the caller's org owns.         |
| `hanzo network identities rm <id>` | Takes one of the org's fabric identities out of the org.     |

### Services

| Command                         | What it does                                                                                                                                                                                                                                                                                                                          |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo network services create` | Puts a name on the org's overlay: a fabric service forwarding to host:port on whichever of the org's devices carries the "\<name>-host" role, dialable at "\<name>.\<org>.zt" by any of the org's identities — and by the cloud's own, which is what lets a BYO cluster's apiserver be attached to the fleet with a ".zt" kubeconfig. |
| `hanzo network services get`    | Returns the Zero Trust edge services the caller's org owns.                                                                                                                                                                                                                                                                           |