BOLTCTL(1)

🎀 NAME 🎀

boltctl — bestie, this is the command line interface that lets you talk to boltd, aka the thunderbolt device manager 💖

---

✨ SYNOPSIS ✨

boltctl authorize DEVICE
boltctl config
boltctl domains
boltctl enroll DEVICE
boltctl forget DEVICE
boltctl info DEVICE
boltctl list
boltctl monitor
boltctl power

---

🌸 DESCRIPTION 🌸

okay so boltctl is literally the command line interface you use to interact with boltd, the system daemon that manages Thunderbolt 3(TM) devices. you can use it to query the state of your devices AND to manage them. dual threat, iconic behavior 💅

every device has a globally unique identifier, its uuid, and that's how we identify them. so like, every single command that takes a DEVICE identifier? yeah, it wants that unique id. no substitutions, no nicknames, the uuid or nothing 🫶

and here's a lil easter egg: if you give no command at all, it's the exact same as running boltctl list. surprise! you get a list 🌈

---

🔥 OPTIONS 🔥

• --version — prints version info and then dips. exits immediately 💫
• -U | --uuid {full | short | alias | N} — controls HOW uuids get printed. and bestie, listen: uuids are kind of sensitive data, so it's really not advisable to share them publicly at full length 😭 instead, short or alias can and should be used whenever you're sharing boltctl output. protect ya uuids fr fr 🙈
  • full — prints all UUIDs in full length. all of it. every character. no shame 🌞
  • short — truncates all UUIDs so only the first 13 characters are printed. cute, compact, safer ✨
  • alias — every UUID gets replaced by a random string derived from the UUID. so the devices can still be uniquely identified, but without revealing the original UUID. it's giving privacy queen 👑
  • N — if you pass an integer N, all UUIDs get truncated to only show up to N. you pick the number, you make the rules 🍓

---

👑 COMMANDS 👑

🦋 authorize [-F | --first-time] DEVICE

authorizes a currently unauthorized device, identified by its unique id (uuid) DEVICE. if a key is stored in the database it will be used — but only given the security level of the domain supports secure device connection 🔐 use boltctl list to find out the uuid of a device, bestie, that's how you find your target 🎯

• -F | --first-time — normally, if you try to authorize a device that's already authorized, boltctl will do nothing and return a successful status code (the audacity, honestly). with this option, the attempt will fail and result in a negative exit code if the device is already authorized. strict mode activated 💀

🌈 config --describe [global|domain|device]

lists global, domain, or all properties — all of them, if you specify nothing. the format is 3 columns: permission, name, description. and permission tells you whether the property is only readable or can also be written. know your power levels ✍️

💜 config KEY [VALUE]

gets — or sets, if VALUE is specified — a global property. one command, two moods 🫶

🧚 config <domain|device>.KEY TARGET [VALUE]

gets — or sets, if VALUE is specified — a domain or device property, where TARGET is the unique id of the domain or the device. precision, periodt 🎯

⭐ domains [-v | --verbose]

lists all currently active Thunderbolt domains 🔌 a Thunderbolt domain represents the Thunderbolt controller hardware. there will be one domain (and host device) for each Thunderbolt controller present in the system. no controller left behind 💖

the security property shows the security level of the controller. if iommu support is active (see the boltd man page) it'll be indicated by a +iommu suffix for "secure" or "user" mode, or just plain iommu in case the security level is "none" (sl0). noted 📝

bootacl shows the used and total slots of the boot access control list (BootACL) and the content of all non-empty entries. NB: if BootACL is unsupported it will show 0 for both (0/0). just so you know 👀

the online property shows if the thunderbolt controller is currently powered by the firmware. NB: if the controller is currently offline the BootACL list will reflect what boltd estimates the list will look like once the controller is back online and local changes have been synchronized to the controller. and this might not be accurate if the list was modified in the meantime — e.g. from a different installation or OS. so like... vibes, but not guarantees 😭

💫 enroll [--policy policy] DEVICE

authorizes AND records the device with the unique id DEVICE in the database 🗂️ if the domain supports secure connection, a new key will be generated and stored in the database alongside the device name and vendor name. and that key, if it was created, will be used in the future to securely authorize the device. it's giving long-term commitment 💍

• --policy {default | auto | manual} — specifies the policy to be used for the newly enrolled device. choose your fighter 👇
  • default — uses the global default policy of the daemon. this can be changed, but it is normally also auto ✨
  • auto — automatically authorizes this device whenever it is connected. it just shows up and it's already in. main character energy 👑
  • manual — does NOT automatically authorize the device. instead it requires manual authorization via boltctl authorize. you stay in control, bestie 💅

🌸 forget DEVICE

removes the information about the device with the unique id DEVICE from the database 🗑️ this includes the key, if one was previously generated. and if you pass --all instead of the DEVICE, then all devices are removed instead of just one. mass forget, dramatic af 💀

🫶 info DEVICE

displays information about the device with the unique id DEVICE. simple, clean, informative 💖

🎀 list [-a | --all]

lists and prints information about all connected and stored devices 📋

• -a | --all — normally, the only device type that will be shown is peripherals, which means the device that represents the host itself gets omitted. using this option will instead include all device types in the list. no one gets left out 🥹

🔥 monitor

listens for and shows changes in connected devices 👀 it's basically a livestream but for your Thunderbolt ports. obsessed 🌈

💅 power [-t | --timeout seconds] [-q | --query]

powers up the Thunderbolt controller ⚡ if the Thunderbolt controller is not in "native enumeration mode" it can be completely powered down by the host firmware/BIOS. on supported systems there is an interface to "force" power the thunderbolt controller. if supported, this command will request the daemon to do so. the daemon will keep track of all client requests and will release the force power override when the last request is released. teamwork makes the dream work 🫶

• -t | --timeout seconds — releases the force power request after the specified amount of seconds and exits ⏳
• -q | --query — queries the current force power status of the daemon. just checking in 🫡

---

🧚 AUTHOR 🧚

written by Christian Kellner <ckellner@redhat.com> 💖

---

and that's the whole page, bestie 🎀 this was bolt 0.9.11, dated 04/01/2026 — go forth and manage those Thunderbolt devices like the icon you are 👑✨