opschain admin users
Included from Basic tier
Manage the server's local identity provider. The
reads (list, show) ride the admin-gated v2 UserService;
the lifecycle writes stay on the admin-gated /api/admin/users surface
until their v2 verbs land. Local users live in the
OpsChain database; directory (LDAP) identities are managed in the directory
— OpsChain never writes to an identity provider, so the lifecycle verbs
(update, disable, enable, reset-password) refuse a directory user
with a named server error explaining that its OpsChain row is only a shadow
account record.
Local accounts exist primarily as the break-glass fire door: a
break-glass account's every successful login emits the never-throttled
warn:auth:break_glass event, and a hardened security posture refuses
creating local users that are not break-glass.
| Subcommand | Purpose |
|---|---|
create | Create a local user — opschain docs cli/admin-users-create |
list | List all users — opschain docs cli/admin-users-list |
show | One user with effective groups — opschain docs cli/admin-users-show |
update | Change the break-glass designation — opschain docs cli/admin-users-update |
disable | Refuse logins, revoke live tokens — opschain docs cli/admin-users-disable |
enable | Re-enable a disabled user — opschain docs cli/admin-users-enable |
reset-password | Reset, online or offline — opschain docs cli/admin-users-reset-password |
reassign-automations | Move a leaver's automations onto a service account — opschain docs cli/admin-users-reassign-automations |
Connection and authentication
admin users itself takes no flags; every subcommand carries the admin
connection pair: --server <url> (default: the active context or
OPSCHAIN_SERVER) and --auth-token <token> (default:
OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
Shared named errors, all from the connection:
a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>'— exits 2.this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login'— exits 2.the server rejected the credential — run 'opschain login' again, or check the admin token— exits 1.
Any other server refusal passes through and exits 1: the v1 write verbs as
<METHOD> /api/admin/users…: <status>: <message>, the v2 reads as
the server answered <code>: <message>.
See also
opschain docs cli/admin-groups— group membership for these users.opschain docs cli/admin-authz— what an account is allowed to do.