> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cowboy.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# cowboy proxy

> Register, deregister, slash, and list CIP-24 CBSS proxies

## Synopsis

```bash theme={null}
cowboy proxy [--rpc-url <url>] [--private-key <path>] <subcommand>

cowboy proxy register --pubkey <hex> --hpke-pubkey <hex> --dkg-pubkey <hex> --tls-spki <hex> --network-addr <addr> --stake <n> [--statusz-url <url>]
cowboy proxy deregister --proxy-id <hex>
cowboy proxy slash --proxy-id <hex> --fault-class <class> (--evidence-hex <hex> | --evidence-file <path>) [--yes]
cowboy proxy list [--json]
```

`cowboy proxy` manages the on-chain registry of CIP-24 CBSS proxies -- the `cbssd` daemons that form the DKG committee for the secrets service. Operators register a proxy with its keys and stake; anyone can list proxies or submit a slashing claim with evidence.

Write subcommands sign with the key found by [key auto-discovery](https://docs.cowboy.inc/cli-specs/key-auto-discovery.md). `list` needs no key.

**Global flags:**

| Flag | Default | Description |
| - | - | - |
| `--rpc-url` | Auto-discovered | RPC URL (`--rpc-url`, then `COWBOY_RPC_URL`, then `.cowboy/config.json`, then `http://localhost:4000`) |
| `--private-key` | Auto-discovered | Private key file path, or set `COWBOY_PRIVATE_KEY` |

## Subcommands

### `cowboy proxy register`

Register a CBSS proxy.

**Behavior:**

1. Parse the key material; `--hpke-pubkey` and `--dkg-pubkey` must be exactly 32 bytes.
2. Build `RegisterCbssProxy` with the stake widened to the chain's 256-bit amount type.
3. Size the limits from the node's estimate, sign and submit; print the transaction hash and the node response.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--pubkey` | Required | secp256k1 public key bytes, hex |
| `--hpke-pubkey` | Required | HPKE public key (32-byte hex, `0x` optional) |
| `--dkg-pubkey` | Required | Commonware DKG public key (32-byte hex, `0x` optional) |
| `--tls-spki` | Required | TLS SubjectPublicKeyInfo DER bytes, hex |
| `--network-addr` | Required | Public proxy network address |
| `--statusz-url` | None | Operator-advertised `/statusz` base URL ([CIP-42](https://docs.cowboy.inc/cips/cip-42-statusz.md) discovery) |
| `--stake` | Required | Stake amount in the chain's smallest unit (`u64`) |

**Example:**

```bash theme={null}
$ cowboy proxy register --pubkey 0x02ab... --hpke-pubkey 0x11.. --dkg-pubkey 0x22.. \
    --tls-spki 0x3082... --network-addr proxy-01.example.com:8443 --stake 1000000000000
Transaction hash: 0xabc123...
CBSS proxy command submitted: <node response>
```

***

### `cowboy proxy deregister`

Deregister a CBSS proxy.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--proxy-id` | Required | Proxy id (32-byte hex, `0x` optional) |

***

### `cowboy proxy slash`

Submit a CBSS proxy slashing claim.

**Behavior:**

1. Unless `--yes` is passed, print a warning that evidence is consumed on success and cannot be reused, and that an invalid claim still spends gas; require the operator to type `yes`. If stdin is not a terminal or non-interactive mode is on and `--yes` is absent, the command refuses with `input_required` (exit `3`).
2. Read the evidence from exactly one of `--evidence-hex` or `--evidence-file`.
3. Sign and submit `SlashCbssProxy`.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--proxy-id` | Required | Proxy id (32-byte hex, `0x` optional) |
| `--fault-class` | Required | `invalid-partial`, `dkg-sabotage`, or `equivocation` |
| `--evidence-hex` | None | Evidence bytes as hex. Conflicts with `--evidence-file` |
| `--evidence-file` | None | Path to encoded evidence bytes. Conflicts with `--evidence-hex` |
| `--yes`, `-y` | `false` | Skip the confirmation prompt |

***

### `cowboy proxy list`

List all registered CBSS proxies. Read-only; `GET /cbss/proxies`.

**Behavior:**

1. Fetch `/cbss/proxies` from the RPC URL (10-second timeout).
2. With `--json`, print one versioned JSON result (`proxy.list`) wrapping the payload.
3. Otherwise print one block per proxy: `proxy_id`, `operator`, `network_addr`, `dkg_pubkey`, registration and eligibility heights, health in basis points (with `SUSPENDED` when applicable), and `unbond_at` if set. With no proxies, print a notice explaining the list populates once a `RegisterCbssProxy` transaction lands.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--json` | `false` | Emit one versioned JSON result instead of the human-readable listing |

**Example:**

```bash theme={null}
$ cowboy proxy list
CBSS proxies on chain (1):

  [1] proxy_id      = 0x0000...0001
       operator      = 0x7a3B...F92E
       network_addr  = proxy-01.example.com:8443
       dkg_pubkey    = 0x22..
       registered    = block 120, eligible after block 220
       health        = 10000 bps (10000 = full health)
```

## Edge Cases

* `--stake` is parsed as `u64`, so stakes above `2^64 - 1` base units cannot be submitted through this CLI even though the chain accepts larger values.
* `slash` requires exactly one evidence source; neither or both is an error.
* `slash` refuses to run without `--yes` when stdin is not a terminal or non-interactive mode is on.
* `list` errors are typed: a `404` is `not_found`, an unreachable node is retryable, and a non-JSON or oversized body is `invalid_response`.
* Write commands sign with limits from the node's estimate; if the estimate fails, nothing is submitted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.