opschain admin users list

Included from Basic tier

Lists every account the server knows — local users and the shadow accounts of every identity provider alike — with its provider instance, break-glass designation, disabled timestamp, dormancy, creation time, local group memberships (directory groups are per-login facts; show reports a user's effective set) and user id (the identity key assignments and memberships are recorded against — a same-named pair is two rows with two ids). Since the transport is the v2 UserService.ListUsers read under the same admin credential conventions; the displayed columns and -o json field names are unchanged. Dormant identities — users whose provider can no longer sign them in (a legacy ldap row, or a federated identity whose connection is deleted or disabled) — are listed WITH the DORMANT marker by default, because an auditing admin wants to see them; --active-only hides them. ghost rows (credential-less local duplicates of directory identities) are hidden by the server, and service accounts never appear on this roster. The server reads also take a provider filter — an open string match over the auth_provider vocabulary (local, ldap, oidc:<key>, …), never a closed set (opschain docs identity).

opschain admin users list
USERNAME         PROVIDER  BREAK-GLASS  DISABLED  DORMANT  CREATED               LOCAL-GROUPS     ID
alice            ldap      no           -         yes      2026-09-12T00:41:02Z  -                019a0d7e-10c2-7f7a-8b53-3b1c9a4f2e01
emergency.admin  local     yes          -         -        2026-10-01T03:12:44Z  platform-admins  019a0d7e-10c2-7f7a-8b53-3b1c9a4f2e02

-o, --output json|yaml emits the user rows as a machine document, each carrying id and auth_provider (dormant rows additionally carry dormant: true).

Flags

Flag	Meaning
--active-only	Hide dormant identities (users whose provider can no longer sign them in); by default they are listed with the dormant marker.
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--filter <column>[!]=<value>	Keep only rows matching the term (repeatable; terms AND). Columns are the printed table headers lowercased (spaces/dashes fold to _); * wildcards match the whole cell case-insensitively, != negates, commas mean any-of. Applied client-side. Grammar: opschain docs cli.

Exit codes: 0 on success, 1 when the call fails or the token is rejected, 2 for the connection usage errors on opschain docs cli/admin-users.

See also

• opschain docs cli/admin-users-show — one user with effective groups.