> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Manage Users > Use ZCLI to create, view, update, activate, deactivate, and delete users, set their enterprise access and roles, and manage credentials. Use the ZEDEDA CLI (ZCLI) to manage users from the command line. This article covers `zcli user` commands, with syntax and examples for each operation. A user is an account that signs in to Edge Infrastructure Services. Each user has one or more allowed enterprises, and a role in each of those enterprises that controls what the user can do there. For the console procedures, see [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md). To create or change the roles that you assign to users, see [Manage Roles](https://zededa.mintlify.site/zcli-reference/roles.md). ## Before You Start * ZCLI is installed and authenticated against your enterprise. See [Get Started](https://zededa.mintlify.site/zcli-reference/get-started.md). * You have a role that allows you to manage users in your enterprise. \[TBD: confirm the minimum role required to create, update, and delete users with ZCLI.] * To create local users (users who sign in with a ZEDEDA password), your enterprise uses local authentication. If an OAuth authentication profile is active, users are provisioned through your Identity Provider instead. See [Manage Authentication Profiles](https://zededa.mintlify.site/zcli-reference/authentication-profiles.md). > [!NOTE] > > The option list that `zcli user --help` prints contains several flag names that ZCLI does not accept. Use the flag names in the syntax lines on this page, which match the commands that ZCLI accepts. > > | Shown in `--help` options | Flag that ZCLI accepts | > | - | - | > | `--first-name` | `--firstname` | > | `--last-name` | `--lastname` | > | `--salesfoce-id` | `--salesforce-id` | > | `--public key` | `--public-key-path` (on `create`) or `--new-public-key` (on `change-credential` and `reset-credential`) | > | `--type=[oauth,local]` | `--oauth` (omit it for a local user) | > | `--` | `--ends` | ## Create a User Create a user record. Choose how the user signs in: with a password (`--password`), through your OAuth Identity Provider (`--oauth`), or with no credential set yet. ```text theme={"dark"} zcli user create [--password= | --public-key-path= | --oauth] [--allowed-enterprise=...] --email= [--firstname=] [--lastname=] [--locale=][--notify-pref=...] [--phone=] [--time-zone=] ``` | Flag | Description | | - | - | | `` | User name. This is the name that the user signs in with, and it is usually the email address. | | `--email=` | Email address of the user. Required. | | `--password=` | Password for a local user. ZCLI checks the password rules before it sends the request. See [Password rules](#password-rules). | | `--public-key-path=` | Accepted, but not used in the current ZCLI release. See the following warning. | | `--oauth` | Create the user as an OAuth user. The user signs in through your Identity Provider, and ZCLI does not create a local credential. | | `--allowed-enterprise=` | An enterprise that the user can access, and the user's role in it, in the format `:`. Repeat the flag for each enterprise. See [Enterprise access and roles](#enterprise-access-and-roles). | | `--firstname=` | First name. If you omit it, ZCLI uses the user name as the first name. | | `--lastname=` | Last name. ZCLI builds the full name from the first name and the last name. | | `--locale=` | Locale of the user, for example `EN`. | | `--notify-pref=` | How the user receives notifications, such as password-expiry notices: `email` or `sms`. Repeat the flag to set both. If you omit it, the user sees notifications only when signing in to the console. | | `--phone=` | Phone number of the user, for example `+14085550100`. | | `--time-zone=` | Preferred time zone of the user. | > [!WARNING] > > `--public-key-path` has no effect on `create`. ZCLI does not read the key file, and it creates the user with no credential. The same happens if you omit `--password`, `--public-key-path`, and `--oauth`. To give the user a credential afterwards, use [Reset the credential for another user](#reset-the-credential-for-another-user). > [!NOTE] > > Always pass `--lastname` when you create a user. If you omit it, ZCLI trims the text "None" from the generated full name, and this can also remove the letters N, o, n, or e from the start of the first name. For example, a user created with `--firstname=Nora` and no last name gets the full name `ra` instead of `Nora`. Example of a local user with access to two enterprises who receives notifications by email and SMS: ```text theme={"dark"} zcli user create user@example.com --email=user@example.com --firstname=Alex --lastname=Smith --locale=EN --password=Example@12345 --allowed-enterprise=MY_ENTERPRISE:SysOperator --allowed-enterprise=MY_CHILD_ENTERPRISE:SysMonitor --notify-pref=email --notify-pref=sms ``` Example of an OAuth user: ```text theme={"dark"} zcli user create user@example.com --email=user@example.com --firstname=Alex --lastname=Smith --oauth --allowed-enterprise=MY_ENTERPRISE:SysOperator ``` ### Password rules When you create a user with `--password`, ZCLI checks that the password meets the following rules before it sends the request. If a rule fails, ZCLI prints the reason and does not create the user. * At least 8 characters. * At least one number. * At least one capital letter. * At least one of the following special characters: `@ _ ! # $ % ^ & * ( ) < > ? / | } { ~ :`. Your enterprise's password policy can set stricter rules, which Edge Infrastructure Services applies when it receives the request. See [Password Policy Parameters](https://zededa.mintlify.site/zcli-reference/authentication-profiles.md#password-policy-parameters). ZCLI checks these rules only on `create`. It does not check them on `change-credential` or `reset-credential`, so a password that breaks your password policy is rejected by Edge Infrastructure Services instead. ### Enterprise access and roles Each `--allowed-enterprise` value pairs an enterprise with a role, in the format `:`. For example, `--allowed-enterprise=MY_ENTERPRISE:SysManager`. * The enterprise must be the enterprise you are signed in to or one of its child enterprises. If it is not, ZCLI prints `Invalid enterprise: . Valid enterprises are:` followed by the list of enterprises that you can use. * The value must contain exactly one colon. A value without a role, such as `--allowed-enterprise=MY_ENTERPRISE`, makes ZCLI print `Invalid input: MY_ENTERPRISE`. * ZCLI does not check that the role exists. Check the role name with `zcli role show` before you run the command. See [Manage Roles](https://zededa.mintlify.site/zcli-reference/roles.md). > [!WARNING] > > When an `--allowed-enterprise` value is invalid, ZCLI prints the error but does not stop the command. On `create`, ZCLI still sends the create request, without any allowed enterprises. On `update`, ZCLI still sends your other changes and leaves the user's enterprises unchanged. Check the output for `Invalid input` or `Invalid enterprise`, then run `zcli user show ` to confirm the result. ## View Users ### View a single user Show one user by name or UUID, or show your own user with `--self`. Add `--detail` for the full record, including phone, locale, time zone, notification preference, last sign-in and sign-out times, and revision history. ```text theme={"dark"} zcli user show [[[ | --self | --uuid=] [--detail]] | [[--salesforce-id=] [--hubspot-id=] [--summary] [--name-pattern=] [--page-size=]]] ``` To show a user by name: ```text theme={"dark"} zcli user show user@example.com ``` To show the full record for a user: ```text theme={"dark"} zcli user show user@example.com --detail ``` To show your own user: ```text theme={"dark"} zcli user show --self ``` The output lists each allowed enterprise and the user's role in it. The `Role` field shows the user's role in the enterprise that you are signed in to. A role that your own role does not allow you to read is left blank. ### List users Run `zcli user show` without a name to list all users in your enterprise. Filter the list with the following flags. | Flag | Description | | - | - | | `--name-pattern=` | List only users whose name contains this text. | | `--salesforce-id=` | List only users with this Salesforce ID. | | `--hubspot-id=` | List only users with this HubSpot ID. | | `--summary` | Show counts of users by state, by activity, and by role instead of the list. | | `--page-size=` | Number of records that ZCLI retrieves with each API call. ZCLI still returns the full list. Use a smaller value if the command times out. | Example: ```text theme={"dark"} zcli user show --name-pattern=example.com ``` Example response: ```text theme={"dark"} User Email FullName Role ---- ----- -------- ----- admin@example.com admin@example.com Admin User SysAdmin user@example.com user@example.com Alex Smith SysOperator ``` The `Role` column shows each user's role in the enterprise that you are signed in to. The column is blank for a user who has no role in that enterprise. ### View active users Show the users who performed an action in a time range, with the time of each user's most recent action. ```text theme={"dark"} zcli user show-active-users --starts= --ends= [--enterprise=] ``` | Flag | Description | | - | - | | `--starts=` | Start of the time range, in the format `YYYY-MM-DD HH:MM:SS`. Required. | | `--ends=` | End of the time range, in the same format. Required. | | `--enterprise=` | Show active users of this enterprise instead of the enterprise you are signed in to. | ZCLI reads the times in the local time zone of the system that runs ZCLI, and it shows the results in that time zone. Inside the ZCLI Docker container, the local time zone is usually UTC. Quote the values because they contain a space. Example: ```text theme={"dark"} zcli user show-active-users --starts='2026-01-15 09:00:00' --ends='2026-01-15 17:00:00' --enterprise=MY_ENTERPRISE ``` ## Update a User Update another user by name, or update your own user with `--self`. Pass only the values that you want to change. ZCLI keeps the other values. ```text theme={"dark"} zcli user update [|--self] [--firstname=] [--lastname=] [--locale=] [--salesforce-id=] [--hubspot-id=][--notify-pref=...] [--phone=] [--time-zone=] [--email=] [--allowed-enterprise=...] ``` The flags have the same meaning as on `create`, with the following additions: | Flag | Description | | - | - | | `` or `--self` | The user to update. Pass one of them. If you pass neither, ZCLI does not update anything. | | `--salesforce-id=` | Salesforce ID of the user. | | `--hubspot-id=` | HubSpot ID of the user. | | `--notify-pref=` | Replaces the user's notification preferences with the values that you pass. Repeat the flag to keep both `email` and `sms`. | | `--allowed-enterprise=` | Replaces the user's full list of allowed enterprises and roles. See the following warning. | > [!WARNING] > > `--allowed-enterprise` replaces the whole list of the user's enterprises. It does not add to it. Any enterprise that you leave out is removed from the user. To add an enterprise or change one role, first run `zcli user show ` to see the current list, then pass every enterprise that the user should keep. > [!NOTE] > > * `zcli user update --self` ignores `--allowed-enterprise`. You cannot change your own enterprise access or role with ZCLI. > * ZCLI rebuilds the full name from the first name and the last word of the current full name. If the current full name is a single word with no space, `user update` fails with a Python error. Pass both `--firstname` and `--lastname` to avoid this. Example of changing a user's last name: ```text theme={"dark"} zcli user update user@example.com --lastname=Jones ``` Example of giving a user access to two enterprises with a different role in each. The command replaces any enterprises that the user had before. ```text theme={"dark"} zcli user update user@example.com --allowed-enterprise=MY_ENTERPRISE:SysManager --allowed-enterprise=MY_CHILD_ENTERPRISE:SysOperator ``` Example of updating your own phone number and notification preference: ```text theme={"dark"} zcli user update --self --phone=+14085550100 --notify-pref=email ``` ## Manage Credentials ### Change your own credential Change the password or public key of the user that you are signed in as. ```text theme={"dark"} zcli user change-credential (--old-password= --new-password= | --new-public-key=) ``` | Flag | Description | | - | - | | `--old-password=` | Your current password. Required with `--new-password`. | | `--new-password=` | Your new password. | | `--new-public-key=` | Path to a file that contains your new public key. ZCLI reads the key from the file. The file must be inside the ZCLI container. See [Get Started](https://zededa.mintlify.site/zcli-reference/get-started.md). | Example: ```text theme={"dark"} zcli user change-credential --old-password=Example@12345 --new-password=Example@67890 ``` ### Reset the credential for another user Set a new password or public key for another user, for example when the user has forgotten the password or was created without a credential. ```text theme={"dark"} zcli user reset-credential (--new-password= | --new-public-key=) [--enterprise=] ``` | Flag | Description | | - | - | | `--new-password=` | The new password for the user. | | `--new-public-key=` | The new public key for the user. See the following note. | | `--enterprise=` | The enterprise of the user, if it is not the enterprise that you are signed in to. | > [!NOTE] > > Unlike `change-credential`, `reset-credential` does not read a file for `--new-public-key`. ZCLI sends the value exactly as you type it, so a file path is sent as the key. \[TBD: confirm with engineering whether `--new-public-key` on `reset-credential` expects the key text, and how to pass it.] Example: ```text theme={"dark"} zcli user reset-credential user@example.com --new-password=Example@24680 --enterprise=MY_CHILD_ENTERPRISE ``` ## Activate or Deactivate a User Deactivate a user to block access temporarily without deleting the user. Activate the user to restore access. To deactivate a user: ```text theme={"dark"} zcli user deactivate ``` To activate a user: ```text theme={"dark"} zcli user activate ``` The following example deactivates a user: ```text theme={"dark"} zcli user deactivate user@example.com ``` The following example activates the same user again: ```text theme={"dark"} zcli user activate user@example.com ``` ## Delete a User Delete a user permanently. ZCLI asks for confirmation unless you pass `-f`. ```text theme={"dark"} zcli user delete [-f] ``` Example: ```text theme={"dark"} zcli user delete user@example.com -f ``` ## Next Steps > [card] [Manage Roles](https://zededa.mintlify.site/zcli-reference/roles.md) > > Create and update the roles that you assign with `--allowed-enterprise`. > [card] [Manage Authentication Profiles](https://zededa.mintlify.site/zcli-reference/authentication-profiles.md) > > Set the password policy for local users or connect an Identity Provider. > [card] [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md) > > Manage users in the Edge Infrastructure Services console. > [card] [Overview](https://zededa.mintlify.site/zcli-reference/overview.md) > > All ZCLI command procedures, organized by resource type.