IAM The `hanzo iam` commands.
Also for this capability: API · CLI · MCP · SDKs
Hanzo's identity provider: users, organizations, applications, and the OIDC/OAuth2 endpoints every Hanzo service authenticates against.
API reference →
Every command takes --json for the raw response and --help for its own flags. Sign in once with hanzo auth login; the commands below use that session, and the org they act in is the one it carries.
Command What it does hanzo iam assumeSteps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see… hanzo iam delete-membershipTakes away a person's or an application's right to act in an organization. hanzo iam linkStarts connecting another sign-in identity to the account you are already signed in as. hanzo iam linked-accountsReturns the sign-in identities linked to the calling person's account — every provider they can currently sign in with. hanzo iam loginSigns a person in with the credential they typed, and — when the request is part of an OAuth flow — hands back the… hanzo iam onboardFinishes setting up the account of whoever is calling — it creates their organization if they have none and puts them… hanzo iam passwordReplaces the calling person's password. hanzo iam preferencesSaves the calling person's own settings and returns the full set afterwards. hanzo iam releaseSteps a platform operator back out: it returns their own access token with no organization assumed, which is the… hanzo iam signinCompletes a sign-in: it exchanges the one-time code your application was handed at the end of the login flow for a live… hanzo iam signupCreates an account from the sign-up form and applies the application's own sign-up rules — whether self-service… hanzo iam unlinkDisconnects one sign-in identity from an account, so that provider can no longer be used to sign in as that person. hanzo iam verification-codesValidates the request and asks otp to get a code to the person. hanzo iam whoamiTells you who the current caller is — the lightweight check a page makes on load to decide whether to render signed-in…
Command What it does hanzo iam .well-known jwksPublishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a… hanzo iam .well-known oauth-authorization-serverReturns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find… hanzo iam .well-known openid-configurationReturns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find…
Command What it does hanzo iam account getReturns the signed-in person's own account and the organization they belong to — what a console reads to draw the… hanzo iam account replaceSaves the calling person's own profile — the name they are shown by, their picture, a line about themselves and a link.
Command What it does hanzo iam admin applications upsertCreates an application or updates it in place, so a deployment can declare the applications it needs and run the same… hanzo iam admin provisionSets up an account on someone's behalf — the same onboarding a person gets themselves, driven by one of your own… hanzo iam admin users upsertCreates a person or updates them in place, so a deployment can declare the accounts it needs and re-run that…
Command What it does hanzo iam applications createRegisters an application in your organization — one product or site your people sign in to, with its own client… hanzo iam applications list --owner <owner>Returns the applications in one organization, newest first — each product or site your people sign in to, with the… hanzo iam applications owner get <owner> <name>Returns one application: its sign-in methods, its allowed redirect URIs and the client credentials your integration… hanzo iam applications owner rm <owner> <name>Removes an application. hanzo iam applications owner set <owner> <name>Changes an application's display, its sign-in methods and the redirect URIs it may return to — the call that makes…
Command What it does hanzo iam audit-logs createRecords an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records… hanzo iam audit-logs listReturns your organization's audit trail, newest first — who did what, when, and from where. hanzo iam audit-logs owner get <owner> <name>Returns one audit entry in full: the action, the person or key behind it, and the request it came in on. hanzo iam audit-logs owner rm <owner> <name>Removes an audit entry. hanzo iam audit-logs owner set <owner> <name>Corrects an audit entry.
Command What it does hanzo iam auth applicationReturns everything a login screen needs to draw itself for one application: its branding, and each sign-in method it… hanzo iam auth methodsReturns the sign-in methods one application actually has switched on, so a login screen can render the right buttons…
Command What it does hanzo iam certs createAdds a signing certificate your applications can verify tokens against — the call you make to stage the next one before… hanzo iam certs listReturns your organization's signing certificates, newest first — the keys the tokens your applications verify are… hanzo iam certs owner get <owner> <name>Returns one signing certificate — its algorithm, its validity window and its public half. hanzo iam certs owner rm <owner> <name>Removes a signing certificate. hanzo iam certs owner set <owner> <name>Changes a signing certificate's settings.
Command What it does hanzo iam consent getReturns the calling person's own privacy and communication choices. hanzo iam consent replaceRecords the calling person's privacy and communication choices.
Command What it does hanzo iam invitations createIssues an invitation to join your organization — the code or link a new member redeems, with the role they arrive… hanzo iam invitations listReturns your organization's invitations, newest first — who has been asked to join, on what terms, and how many seats… hanzo iam invitations owner get <owner> <name>Returns one invitation: who it is for, what it grants on acceptance, and when it expires. hanzo iam invitations owner rm <owner> <name>Withdraws an invitation. hanzo iam invitations owner set <owner> <name>Changes an invitation's terms — the role it grants, how many may redeem it, or when it expires.
Command What it does hanzo iam keys createIssues an API key. hanzo iam keys listReturns your organization's API keys, newest first — what each is called, what it may reach, and its publishable half. hanzo iam keys orgResolve a PUBLISHABLE key to the organization that owns it hanzo iam keys owner get <owner> <name>Returns one API key: what it is called, what it may reach, and when it was issued. hanzo iam keys owner rm <owner> <name>Revokes an API key. hanzo iam keys owner set <owner> <name>Changes what a key is called or what it may reach. hanzo iam keys principalResolve a SECRET key to the principal it authenticates
Command What it does hanzo iam memberships createLets a person or an application act in an organization. hanzo iam memberships getAnswers either question about who belongs where: which organizations one person can act in, or who can act in one…
Command What it does hanzo iam mfa clearTurns a factor off, so sign-in stops asking for it. hanzo iam mfa preferredPicks which second factor an account is asked for first when it has more than one. hanzo iam mfa setup enableFinishes the enrolment: from here the account's sign-ins ask for this factor. hanzo iam mfa setup initiateStarts enrolling a factor and hands over whatever the person needs to prove they hold it: app a fresh secret and the…
Command What it does hanzo iam oauth authorize createStarts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow. hanzo iam oauth authorize getStarts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow. hanzo iam oauth callbackCompletes the round-trip: it resolves and burns the single-use transaction (checking expiry + browser binding),… hanzo iam oauth device createStarts a sign-in on a device with no browser and no keyboard — a TV, a CLI, a headless box. hanzo iam oauth device infoAnswers "what am I approving?" for a pending device code. hanzo iam oauth federation mfaCompletes a sign-in that came in through another identity provider and still owes a second factor. hanzo iam oauth introspectAnswers whether an access token is still good, and what it is good for — the check a resource server of yours makes… hanzo iam oauth logout createEnds a sign-in and sends the browser somewhere sensible. hanzo iam oauth logout getEnds a sign-in and sends the browser somewhere sensible. hanzo iam oauth revokeRetires a token before it expires — what you call when someone signs out or a credential may have leaked. hanzo iam oauth tokenExchanges what your application is holding for the tokens it needs — the one-time code from a finished sign-in, a… hanzo iam oauth userinfo createReturns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is… hanzo iam oauth userinfo getReturns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is…
Command What it does hanzo iam organizations avatarChanges how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single… hanzo iam organizations createMakes a new organization — the account your users, applications, roles, projects and workspaces are all named inside. hanzo iam organizations listReturns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an… hanzo iam organizations owner get <owner> <name>Returns one organization: its display, its defaults and the sign-in rules everyone in it inherits. hanzo iam organizations owner rm <owner> <name>Removes an organization and everything named inside it. hanzo iam organizations owner set <owner> <name>Changes an organization's display, its defaults and the sign-in rules everyone in it inherits.
Command What it does hanzo iam permissions createGrants a permission — the call that gives a person or a role the ability to do something. hanzo iam permissions listReturns the permissions in one organization, newest first — each one a grant saying which people or roles may do what,… hanzo iam permissions owner get <owner> <name>Returns one permission: who it grants to, what it allows, and the resources it covers. hanzo iam permissions owner rm <owner> <name>Revokes a permission. hanzo iam permissions owner set <owner> <name>Changes who a permission grants to, what it allows, or the resources it covers.
Command What it does hanzo iam projects createMakes a project inside your organization — the scope people pick between when their work is separated by product or… hanzo iam projects listReturns your organization's projects, newest first — the scope people pick between when their work is separated by… hanzo iam projects owner get <owner> <name>Returns one project: what it is called and how it is set up. hanzo iam projects owner rm <owner> <name>Removes a project. hanzo iam projects owner set <owner> <name>Changes a project's settings.
Command What it does hanzo iam providers createAdds an identity provider your people can sign in with, or a service your applications send through — a social or… hanzo iam providers listReturns your organization's providers, newest first — the identity providers your people sign in with, and the senders… hanzo iam providers owner get <owner> <name>Returns one provider: what it connects to and how it is configured. hanzo iam providers owner rm <owner> <name>Removes a provider. hanzo iam providers owner set <owner> <name>Changes a provider's settings or rotates the credentials it holds.
Command What it does hanzo iam registry jwksPublishes the public key your registry uses to verify the tokens issued above — the one URL to configure so the… hanzo iam registry token createSigns a container client in to your registry. hanzo iam registry token getSigns a container client in to your registry.
Command What it does hanzo iam roles createMakes a role — a named group of people that permissions are granted to. hanzo iam roles listReturns your organization's roles, newest first — each a named group of people that permissions are granted to. hanzo iam roles owner get <owner> <name>Returns one role: who is in it, and the roles it includes. hanzo iam roles owner rm <owner> <name>Removes a role. hanzo iam roles owner set <owner> <name>Changes who is in a role, or which roles it includes.
Command What it does hanzo iam scim v2 ResourceTypes get <name>Returns one provisionable record kind in full. hanzo iam scim v2 ResourceTypes listReturns the kinds of record this directory provisions and the address of each, so your identity provider discovers them… hanzo iam scim v2 Schemas get <id>Returns one attribute definition in full. hanzo iam scim v2 Schemas listReturns the attribute definitions this directory understands, so your identity provider knows which fields it may send… hanzo iam scim v2 ServiceProviderConfigTells your identity provider which parts of SCIM this directory supports, so it configures itself instead of you… hanzo iam scim v2 Users createProvisions a person from your identity provider — how a new hire gets an account here automatically when they are added… hanzo iam scim v2 Users listReturns the people in your organization to your identity provider, in the standard SCIM shape, so an IdP can reconcile… hanzo iam scim v2 Users owner get <owner> <name>Returns one person in the standard SCIM shape. hanzo iam scim v2 Users owner rm <owner> <name>Deprovisions a person — how removing someone in your identity provider removes their access here. hanzo iam scim v2 Users owner set <owner> <name>Overwrites a person's SCIM attributes with what your identity provider sends — how a change made there lands here. hanzo iam scim v2 Users owner update <owner> <name>Applies a partial change from your identity provider — one attribute moved, not the whole record resent.
Command What it does hanzo iam service-accounts createMakes a service account — an identity for a program rather than a person, for a script, a bot or a deployment that has… hanzo iam service-accounts keys <name>Serves POST /v1/iam/service-accounts/:name/keys: mint a fresh key, invalidating the prior one, and return the new raw… hanzo iam service-accounts listReturns your organization's service accounts — what each is called and when it was created. hanzo iam service-accounts rm <name>Serves DELETE /v1/iam/service-accounts/:name.
Command What it does hanzo iam sessions create --application <application> --name <name> --owner <owner>Records a sign-in. hanzo iam sessions list --owner <owner>Returns who is currently signed in to your organization, newest first, and can be narrowed to one person or one… hanzo iam sessions owner name get <owner> <name> <application>Returns one person's session in one application — when it began and which browsers or devices are still carrying it. hanzo iam sessions owner name rm <owner> <name> <application>Signs a person out of one application — the session ends and every browser carrying it stops being authenticated. hanzo iam sessions owner name set <owner> <name> <application>Replaces the set of browsers a session covers — signing out the ones you leave off while the session itself stays live.
Command What it does hanzo iam tokens createRecords an access token — the credential an application or integration presents on a caller's behalf. hanzo iam tokens issueMints an access token for the ?id=<owner>/<name> target user (optional ?aud= resource, RFC 8707), issued by the… hanzo iam tokens listReturns the access tokens issued in your organization, newest first, and can be narrowed to one organization. hanzo iam tokens owner get <owner> <name>Returns one access token: who and what it was issued to, and when it expires. hanzo iam tokens owner rm <owner> <name>Revokes an access token. hanzo iam tokens owner set <owner> <name>Changes an access token's scope or expiry.
Command What it does hanzo iam users createAdds a person to your organization. hanzo iam users list --owner <owner>Returns a page of the people in your organization, with the total so you can page through the rest. hanzo iam users owner get <owner> <name>Returns one person in your organization, addressed by their username or by their email address. hanzo iam users owner keys clear <owner> <name>Clears the target user's key of the requested TYPE (immediate revoke). hanzo iam users owner keys create <owner> <name>(re)generates the target user's key of the requested TYPE and returns it once, over the shared authorizeMinter +… hanzo iam users owner rm <owner> <name>Removes a person from your organization. hanzo iam users owner set <owner> <name>Changes a person's profile, their roles, or the credentials they sign in with.
Command What it does hanzo iam web3 nonceStarts a wallet sign-in: it returns a one-time challenge for the wallet to sign. hanzo iam web3 verifyCompletes a wallet sign-in: it verifies the signed challenge and, if it holds, signs the wallet's owner in.
Command What it does hanzo iam webauthn signin beginStarts a passkey sign-in: it returns the challenge the person's authenticator signs. hanzo iam webauthn signin finishVerifies the signed challenge and signs the person in. hanzo iam webauthn signup beginStarts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator. hanzo iam webauthn signup finishVerifies the newly created passkey and stores it, so the person can sign in with their device from then on.
Command What it does hanzo iam webauthn-credentials createRegisters a passkey or security key for a person, so they can sign in with their device instead of a password. hanzo iam webauthn-credentials listReturns the passkeys and security keys registered to one person, newest first — which device each lives on and when it… hanzo iam webauthn-credentials owner get <owner> <name>Returns one passkey or security key: whose it is, what device it lives on, and when it was registered. hanzo iam webauthn-credentials owner rm <owner> <name>Removes a passkey or security key — what you call when a device is lost. hanzo iam webauthn-credentials owner set <owner> <name>Renames a registered passkey or security key, so a person can tell their devices apart.
Command What it does hanzo iam workspaces createMakes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. hanzo iam workspaces listReturns your organization's workspaces, newest first — the scope a team works in, alongside projects rather than… hanzo iam workspaces owner get <owner> <name>Returns one workspace: what it is called and how it is set up. hanzo iam workspaces owner rm <owner> <name>Removes a workspace. hanzo iam workspaces owner set <owner> <name>Changes a workspace's settings.
How is this guide?