> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant and revoke vault permissions

export const guide_0 = "manage vault permissions"

With 1Password CLI, you can manage the permissions each [user](/cli/reference/management-commands/vault/#vault-user) or [group](/cli/reference/management-commands/vault/#vault-group) has in each vault, so that everyone has access to the items they need.

Some permissions require [dependent permissions](/cli/vault-permissions/). On interactive shells, you can specify any permission, and 1Password CLI will ask you whether you want to add or revoke dependent permissions. If you're using scripts, or your shell isn't interactive, you must [include dependent permissions](#scripting) in the command.

[Learn what permissions are available for your account type.](/cli/vault-permissions/)

## Requirements

<p>Before you can use 1Password CLI to {guide_0}, you'll need to:</p>

* <a href="https://1password.com/pricing/password-manager">Sign up for 1Password</a>
* <a href="/cli/get-started/#step-1-install-1password-cli">Install 1Password CLI</a>

You can manage vault permissions if you're an owner, administrator, or if you have the `manage_vault` permission in a vault.

## Grant permissions in vaults

### Users

Use [`op vault user grant`](/cli/reference/management-commands/vault/#vault-user-grant) to grant a user permissions in a vault.

For example, to grant the user Wendy Appleseed permission to edit items and manage vault permissions in the Prod vault:

```shell theme={null}
op vault user grant --user wendy.appleseed@agilebits.com --vault Prod --permissions allow_editing,allow_managing
```

If the permissions you want to grant require dependent permissions to be granted alongside them, 1Password CLI will prompt you to grant those permissions:

```
In order to grant [allow_editing,allow_managing], the permission(s) [allow_viewing] are also required.
Would you like to grant them as well? [Y/n]
```

To confirm which users have access to a vault and their current permissions:

```shell theme={null}
op vault user list <vault>
```

### Groups

Use [`op vault group grant`](/cli/reference/management-commands/vault/#vault-group-grant) to grant a group permissions in a vault.

For example, to grant the group IT permission to edit items and manage vault permissions in the Prod vault:

```shell theme={null}
op vault group grant --group "IT" --vault Prod --permissions allow_editing,allow_managing
```

If the permissions you want to grant require dependent permissions to be granted alongside them, 1Password CLI will prompt you to grant those permissions:

```
In order to grant [allow_editing,allow_managing], the permission(s) [allow_viewing] are also required.
Would you like to grant them as well? [Y/n]
```

To confirm which groups have access to a vault and their current permissions:

```shell theme={null}
op vault group list <vault>
```

## Revoke permissions in vaults

### Users

Use [`op vault user revoke`](/cli/reference/management-commands/vault/#vault-user-revoke) to revoke a user's permissions in a vault.

For example, to revoke the user Wendy Appleseed's permission to view items in the Prod vault:

```shell theme={null}
op vault user revoke --user wendy.appleseed@agilebits.com --vault Prod --permissions allow_viewing
```

If the permission you want to revoke requires dependent permissions to be revoked alongside it, 1Password CLI will prompt you to revoke those permissions:

```
In order to revoke [allow_viewing], the permission(s) [allow_editing,allow_managing] are also required.
Would you like to revoke them as well? [Y/n]
```

To confirm that the user's permissions have been revoked:

```shell theme={null}
op vault user list <vault>
```

### Groups

Use [`op vault group revoke`](/cli/reference/management-commands/vault/#vault-group-grant) to revoke a group's permissions in a vault.

For example, to revoke the group IT's permission to view items in the Prod vault:

```shell theme={null}
op vault group revoke --group "IT" --vault Prod --permissions allow_viewing
```

If the permission you want to revoke requires dependent permissions to be revoked alongside it, 1Password CLI will prompt you to revoke those permissions:

```
In order to revoke [allow_viewing], the permission(s) [allow_editing,allow_managing] are also required.
Would you like to revoke them as well? [Y/n]
```

To confirm the group's permissions have been revoked:

```shell theme={null}
op vault group list <vault>
```

## Scripting

If you're using scripts to grant and revoke vault permissions, or if your shell isn't interactive, you'll need to include the `--no-input` flag and specify all [dependent permissions](/cli/vault-permissions/) in a comma-separated list after the `--permissions` flag.

For example, the `allow_managing` permission requires the `allow_editing` and `allow_viewing` permission. To grant the user Wendy Appleseed permission to manage vault permissions in the Prod vault:

```shell theme={null}
op vault user grant --no-input --user wendy.appleseed@agilebits.com --vault Prod --permissions allow_managing,allow_editing,allow_viewing
```

To revoke `allow_editing` from a group that currently also has `allow_managing` granted in a vault:

```shell theme={null}

op vault group revoke --no-input --group "IT" --vault Prod --permissions allow_managing,allow_editing
```

## Learn more

* [Vault permission dependencies](/cli/vault-permissions/)
* [Workflow: Programmatically manage your organization](/get-started/manage-organization)
* [Administrator quickstart](/get-started/administrator-quickstart)