opschain admin groups remove-member
Included from Basic tier
Removes a user from a local group: remove-member <group> <username>.
Since the verb rides the v2 lane: the username resolves to its user
id through UserService.GetUser (honouring --provider), then
GroupService.RemoveMember removes that id's membership; removing a
non-member is an idempotent no-op (the v1 surface's 404 does not carry
over). Only the local membership is removed — a user whose provider
also reports the same group name keeps it in their effective set, so
revoking a provider-sourced membership happens at the provider.
opschain admin groups remove-member platform-admins alice
Removed alice from platform-admins
Flags
| Flag | Meaning |
|---|---|
--provider <instance> | Select the identity provider instance (an auth_provider value: local, ldap:<key>, oidc:<key>, …) when the username exists under more than one; without it an ambiguous name is refused with the matches listed. |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
Exit codes: 0 on success, 1 when the server refused (including an ambiguous
username without --provider) or the token is rejected, 2 for usage —
wrong argument count, or the connection errors on
opschain docs cli/admin-users.
See also
opschain docs cli/admin-groups-add-member— the inverse.opschain docs cli/admin-users-show— a user's remaining effective groups.