Documentation Index
Fetch the complete documentation index at: https://www.1password.dev/llms.txt
Use this file to discover all available pages before exploring further.
Subcommands
user confirm
Specify the user by their e-mail address, name, or ID.
op user confirm [{ <email> | <name> | <userID> | - }] [flags]
Flags
--all Confirm all unconfirmed users.
Specify the user by their e-mail address, name, or ID.
Examples
Confirm a user by specifying their name:
op user confirm "Wendy Appleseed"
Confirm a user by specifying their email:
op user confirm "wendy.appleseed@example.com"
user delete
Remove a user and all their data from the account.
op user delete [{ <email> | <name> | <userID> | - }] [flags]
Specify the user by their e-mail address, name, or ID.
user edit
Change a user’s name or Travel Mode status.
op user edit [{ <email> | <name> | <userID> | - }] [flags]
Flags
--name string Set the user's name.
--travel-mode on|off Turn Travel Mode on or off for the user. (default off)
Specify the user by their e-mail address, name, or ID.
user get
Get details about a user.
op user get [{ <email> | <name> | <userID> | --me | - }] [flags]
Flags
--fingerprint Get the user's public key fingerprint.
--me Get the authenticated user's details.
--public-key Get the user's public key.
Specify the user by their e-mail address, name, or ID.
If you enter a hyphen (-) instead of a single object for this command,
the tool will read object specifiers from standard input (stdin).
Separate each specifier with a new line. For more information about how
to specify objects, run op help.
You can also pass the command a list or array of JSON objects. The tool
will get an item for any object that has an ID, ignoring line
breaks. This is useful for passing information from one op command
to another.
Examples
Look up a user by name:
op user get "Wendy Appleseed"
Look up a user by e-mail:
op user get wendy.appleseed@example.com
Get details for all users:
op user list --format=json | op user get -
Get the public key for all users in a group:
op user list --group "Frontend Developers" --format=json | op user get - --publickey
Get details for all users who have access to a vault:
op user list --vault Staging --format=json | op user get -
user list
List users.
Flags
--group group List users who belong to a group.
--vault vault List users who have direct access to vault.
Returns all users in an account by default. Use flags to filter results.
When you use the --group option, the output includes the user’s role
in the group.
Examples
Get details for all users:
op user list --format=json | op user get -
Get the public key for all users in a group:
op user list --group "Frontend Developers" --format=json | op user get - --publickey
Get details for all users who have access to a vault:
op user list --vault Staging --format=json | op user get -
user provision
Provision a user in the authenticated account.
op user provision [flags]
Flags
--email string Provide the user's email address.
--language string Provide the user's account language. (default "en")
--name string Provide the user's name.
Provisioned users will receive an invitation email to join the 1Password
account.
Once a user accepts an invitation, an admin must confirm them on
1Password.com or using the op user confirm command.
Invited users will not be considered for billing until they accept their invitation.
Examples
Invite a user by specifying their e-mail address and name:
op user provision --name "Wendy Appleseed" --email "wendy.appleseed@example.com"
user reactivate
Reactivate a suspended user.
op user reactivate [{ <email> | <name> | <userID> | - }] [flags]
A user may be specified by their e-mail address, name, or ID.
user recovery
Subcommands
user recovery begin
Begin recovery for users in your 1Password account:
op user recovery begin [ { <email> | <name> | <userID> } ] [flags]
Examples
Begin recovery for multiple users by UUID:
op user recovery begin ZMAE4RTRONHN7LGELNYYO373KM WHPOFIMMYFFITBVTOTZUR3R324
user suspend
Suspend a user.
op user suspend [{ <email> | <name> | <userID> | - }] [flags]
Flags
--deauthorize-devices-after duration Deauthorize the user's devices after a time
(rounded down to seconds).
Specify the user by their e-mail address, name, or ID.
A suspended user will immediately be logged out of all devices and
will not be able to log in or access any data.
Users in a suspended state are not considered in billing.
You can reactivate a suspended user with the op user reactivate
command.