opschain admin users show
Included from Basic tier
Shows one user by username: user id (the identity key assignments and
memberships are recorded against), provider instance, break-glass
designation, disabled state, creation time, and two group lines — Local groups (the memberships OpsChain itself stores) and Groups (the
effective set: provider snapshot groups plus the local memberships, which
is what policy assignments match against). Since the transport is
the v2 UserService.GetUser read under the same admin credential
conventions; the displayed lines and -o json field names are unchanged.
opschain admin users show emergency.admin
Username: emergency.admin
Id: 019a0d7e-10c2-7f7a-8b53-3b1c9a4f2e02
Provider: local
Break-glass: yes
Disabled: -
Created: 2026-10-01T03:12:44Z
Local groups: platform-admins
Groups: platform-admins
-o, --output json|yaml emits the user as a machine document, carrying
id and auth_provider.
A username held by more than one provider — the deliberate break-glass
shape, or a federated shadow beside a local account — is ambiguous here:
the server refuses it (invalid_argument), listing the matching
providers, and --provider selects the row to show (an open
auth_provider match: local, ldap:<key>, oidc:<key>, …).
Flags
| Flag | Meaning |
|---|---|
--provider <instance> | Select the identity provider instance when the username exists under more than one. |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
Exit codes: 0 on success, 1 when the user does not exist, the name is
ambiguous without --provider, the call fails or the token is rejected, 2
for the connection usage errors on opschain docs cli/admin-users.
See also
opschain docs cli/admin-groups-list— the group-side view of memberships.