Recovery and re-runs

Every migration command is safe to re-run. You do not need to clean up anything between runs. The following table describes what happens to each scenario when you re-run a command:

Scenario	What happens on re-run
Entity already MIGRATED	Skipped - not touched again.
Entity FAILED	Re-run the same command. Failed entities are retried automatically on the next run.
Entity stuck in MIGRATING (pod restarted)	The entity is verified against the target. If it exists, it is marked as MIGRATED. If not, it is re-created.
New entity added to the source since the last run	Picked up and migrated automatically.
Certificate renewed on APIM 5.x.x (trust/identity store)	Always synced — trust and identity store re-runs always write the latest cert data.
New OAuth tokens issued on APIM 5.x.x	Not picked up automatically. Re-run --export_tokens then --import_tokens to include them.

Migrate a single entity by UUID

To retry or migrate a single entity without running the full migration:

# ── No parent required ──────────────────────────────────────────────────────
migrate.py --organization --uuid <uuid>
migrate.py --role --uuid <uuid>
migrate.py --member --uuid <uuid>
migrate.py --https_client_profile --uuid <uuid>
migrate.py --domain --uuid <uuid>
migrate.py --api_definition --uuid <uuid>
migrate.py --package --uuid <uuid>
migrate.py --application --uuid <uuid>

# ── Child entities — parent flag required ───────────────────────────────────
migrate.py --error_set --api_definition_id <service_uuid>                           # all error sets for one service
migrate.py --error_set --api_definition_id <service_uuid> --uuid <error_set_uuid>   # single error set

migrate.py --endpoint --api_definition_id <service_uuid>                            # all endpoints for one service
migrate.py --endpoint --api_definition_id <service_uuid> --uuid <endpoint_uuid>     # single endpoint

migrate.py --plan --package_id <package_uuid>                                       # all plans for one package
migrate.py --plan --package_id <package_uuid> --uuid <plan_uuid>                    # single plan

migrate.py --package_key --application_id <application_uuid>                        # all keys for one application
migrate.py --package_key --application_id <application_uuid> --uuid <key_uuid>      # single key

note

--trust_store and --identity_store do not support --uuid. To retry, re-run the full command, so that failed and renewed certificates are picked up automatically.