CLIIAM
IAM
166 `hanzo` commands for IAM, each calling one operation on api.hanzo.ai.
Package iam is Hanzo's identity provider: users, organizations, applications, and the OIDC/OAuth2 endpoints every Hanzo service authenticates against.
166 commands · API reference →
| Command | Calls | What it does |
|---|---|---|
hanzo iam .well-known jwks | GET /v1/iam/.well-known/jwks | Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a… |
hanzo iam .well-known oauth-authorization-server | GET /v1/iam/.well-known/oauth-authorization-server | Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find… |
hanzo iam .well-known openid-configuration | GET /v1/iam/.well-known/openid-configuration | Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find… |
hanzo iam account get | GET /v1/iam/account | Returns the signed-in person's own account and the organization they belong to — what a console reads to draw the… |
hanzo iam account replace | PUT /v1/iam/account | Saves the calling person's own profile — the name they are shown by, their picture, a line about themselves and a link. |
hanzo iam add-membership | POST /v1/iam/add-membership | Lets a person or an application act in an organization. |
hanzo iam admin applications upsert | POST /v1/iam/admin/applications/upsert | Creates an application or updates it in place, so a deployment can declare the applications it needs and run the same… |
hanzo iam admin provision | POST /v1/iam/admin/provision | Sets up an account on someone's behalf — the same onboarding a person gets themselves, driven by one of your own… |
hanzo iam admin users upsert | POST /v1/iam/admin/users/upsert | Creates a person or updates them in place, so a deployment can declare the accounts it needs and re-run that… |
hanzo iam applications delete --name <name> --owner <owner> | POST /v1/iam/applications/delete | Removes an application. |
hanzo iam applications update | POST /v1/iam/applications/update | Changes an application's display, its sign-in methods and the redirect URIs it may return to — the call that makes… |
hanzo iam applications get --owner <owner> | GET /v1/iam/applications | Returns the applications in one organization, newest first — each product or site your people sign in to, with the… |
hanzo iam applications create | POST /v1/iam/applications | Registers an application in your organization — one product or site your people sign in to, with its own client… |
hanzo iam assume | POST /v1/iam/assume | Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see… |
hanzo iam audit-logs delete | POST /v1/iam/audit-logs/delete | Removes an audit entry. |
hanzo iam audit-logs get | POST /v1/iam/audit-logs/get | Returns one audit entry in full: the action, the person or key behind it, and the request it came in on. |
hanzo iam audit-logs update | POST /v1/iam/audit-logs/update | Corrects an audit entry. |
hanzo iam audit-logs create | POST /v1/iam/audit-logs | Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records… |
hanzo iam auth application | GET /v1/iam/auth/application | Returns everything a login screen needs to draw itself for one application: its branding, and each sign-in method it… |
hanzo iam auth methods | GET /v1/iam/auth/methods | Returns the sign-in methods one application actually has switched on, so a login screen can render the right buttons… |
hanzo iam certs delete | POST /v1/iam/certs/delete | Removes a signing certificate. |
hanzo iam certs get | POST /v1/iam/certs/get | Returns one signing certificate — its algorithm, its validity window and its public half. |
hanzo iam certs update | POST /v1/iam/certs/update | Changes a signing certificate's settings. |
hanzo iam certs create | POST /v1/iam/certs | Adds a signing certificate your applications can verify tokens against — the call you make to stage the next one before… |
hanzo iam consent get | GET /v1/iam/consent | Returns the calling person's own privacy and communication choices. |
hanzo iam consent replace | PUT /v1/iam/consent | Records the calling person's privacy and communication choices. |
hanzo iam delete-membership | POST /v1/iam/delete-membership | Takes away a person's or an application's right to act in an organization. |
hanzo iam delete-mfa | POST /v1/iam/delete-mfa | Turns a factor off, so sign-in stops asking for it. |
hanzo iam get-account | GET /v1/iam/get-account | Returns the signed-in person's own account and the organization they belong to — what a console reads to draw the… |
hanzo iam get-app-login | GET /v1/iam/get-app-login | Returns everything a login screen needs to draw itself for one application: its branding, and each sign-in method it… |
hanzo iam get-application | GET /v1/iam/get-application | Reads one record — the older spelling of the single reads on the REST surface, over the same data and the same… |
hanzo iam get-applications | GET /v1/iam/get-applications | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-cert | GET /v1/iam/get-cert | Reads one record — the older spelling of the single reads on the REST surface, over the same data and the same… |
hanzo iam get-certs | GET /v1/iam/get-certs | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-global-users | GET /v1/iam/get-global-users | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-invitations | GET /v1/iam/get-invitations | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-memberships | GET /v1/iam/get-memberships | Answers either question about who belongs where: which organizations one person can act in, or who can act in one… |
hanzo iam get-organization-projects | GET /v1/iam/get-organization-projects | Returns one organization's projects — what a scope switcher lists so somebody can move between them. |
hanzo iam get-organization-workspaces | GET /v1/iam/get-organization-workspaces | Returns one organization's workspaces — what a scope switcher lists so somebody can move between them. |
hanzo iam get-organization | GET /v1/iam/get-organization | Reads one record — the older spelling of the single reads on the REST surface, over the same data and the same… |
hanzo iam get-organizations | GET /v1/iam/get-organizations | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-permission | GET /v1/iam/get-permission | Reads one record — the older spelling of the single reads on the REST surface, over the same data and the same… |
hanzo iam get-permissions | GET /v1/iam/get-permissions | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-provider | GET /v1/iam/get-provider | Reads one record — the older spelling of the single reads on the REST surface, over the same data and the same… |
hanzo iam get-providers | GET /v1/iam/get-providers | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-records | GET /v1/iam/get-records | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-role | GET /v1/iam/get-role | Reads one record — the older spelling of the single reads on the REST surface, over the same data and the same… |
hanzo iam get-roles | GET /v1/iam/get-roles | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam get-user | GET /v1/iam/get-user | Reads one person, two ways. |
hanzo iam get-users | GET /v1/iam/get-users | Lists one kind of record in your organization — the older spelling of the collection reads on the REST surface, over… |
hanzo iam invitations delete | POST /v1/iam/invitations/delete | Withdraws an invitation. |
hanzo iam invitations get | POST /v1/iam/invitations/get | Returns one invitation: who it is for, what it grants on acceptance, and when it expires. |
hanzo iam invitations update | POST /v1/iam/invitations/update | Changes an invitation's terms — the role it grants, how many may redeem it, or when it expires. |
hanzo iam invitations create | POST /v1/iam/invitations | Issues an invitation to join your organization — the code or link a new member redeems, with the role they arrive… |
hanzo iam issue-user-token | POST /v1/iam/issue-user-token | Mints an access token for the ?id=<owner>/<name> target user (optional ?aud= resource, RFC 8707), issued by the… |
hanzo iam keys delete | POST /v1/iam/keys/delete | Revokes an API key. |
hanzo iam keys mint | POST /v1/iam/keys/mint | (re)generates the target user's key of the requested TYPE and returns it once, over the shared authorizeMinter +… |
hanzo iam keys revoke | POST /v1/iam/keys/revoke | Clears the target user's key of the requested TYPE (immediate revoke). |
hanzo iam keys update | POST /v1/iam/keys/update | Changes what a key is called or what it may reach. |
hanzo iam keys get | GET /v1/iam/keys | Returns your organization's API keys, newest first — what each is called, what it may reach, and its publishable half. |
hanzo iam keys create | POST /v1/iam/keys | Issues an API key. |
hanzo iam link | POST /v1/iam/link | Starts connecting another sign-in identity to the account you are already signed in as. |
hanzo iam linked-accounts | GET /v1/iam/linked-accounts | Returns the sign-in identities linked to the calling person's account — every provider they can currently sign in with. |
hanzo iam login | POST /v1/iam/login | Signs a person in with the credential they typed, and — when the request is part of an OAuth flow — hands back the… |
hanzo iam memberships get | GET /v1/iam/memberships | Answers either question about who belongs where: which organizations one person can act in, or who can act in one… |
hanzo iam memberships create | POST /v1/iam/memberships | Lets a person or an application act in an organization. |
hanzo iam mfa disable | POST /v1/iam/mfa/disable | Turns a factor off, so sign-in stops asking for it. |
hanzo iam mfa preferred | POST /v1/iam/mfa/preferred | Picks which second factor an account is asked for first when it has more than one. |
hanzo iam mfa setup enable | POST /v1/iam/mfa/setup/enable | Finishes the enrolment: from here the account's sign-ins ask for this factor. |
hanzo iam mfa setup initiate | POST /v1/iam/mfa/setup/initiate | Starts enrolling a factor and hands over whatever the person needs to prove they hold it: app a fresh secret and the… |
hanzo iam mint-user-keys | POST /v1/iam/mint-user-keys | (re)generates the target user's key of the requested TYPE and returns it once, over the shared authorizeMinter +… |
hanzo iam oauth authorize get | GET /v1/iam/oauth/authorize | Starts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow. |
hanzo iam oauth authorize create | POST /v1/iam/oauth/authorize | Starts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow. |
hanzo iam oauth callback | GET /v1/iam/oauth/callback | Completes the round-trip: it resolves and burns the single-use transaction (checking expiry + browser binding),… |
hanzo iam oauth device info | POST /v1/iam/oauth/device/info | Answers "what am I approving?" for a pending device code. |
hanzo iam oauth device create | POST /v1/iam/oauth/device | Starts a sign-in on a device with no browser and no keyboard — a TV, a CLI, a headless box. |
hanzo iam oauth federation mfa | POST /v1/iam/oauth/federation/mfa | Completes a sign-in that came in through another identity provider and still owes a second factor. |
hanzo iam oauth introspect | POST /v1/iam/oauth/introspect | Answers whether an access token is still good, and what it is good for — the check a resource server of yours makes… |
hanzo iam oauth logout get | GET /v1/iam/oauth/logout | Ends a sign-in and sends the browser somewhere sensible. |
hanzo iam oauth logout create | POST /v1/iam/oauth/logout | Ends a sign-in and sends the browser somewhere sensible. |
hanzo iam oauth revoke | POST /v1/iam/oauth/revoke | Retires a token before it expires — what you call when someone signs out or a credential may have leaked. |
hanzo iam oauth token | POST /v1/iam/oauth/token | Exchanges what your application is holding for the tokens it needs — the one-time code from a finished sign-in, a… |
hanzo iam oauth userinfo get | GET /v1/iam/oauth/userinfo | Returns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is… |
hanzo iam oauth userinfo create | POST /v1/iam/oauth/userinfo | Returns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is… |
hanzo iam onboard | POST /v1/iam/onboard | Finishes setting up the account of whoever is calling — it creates their organization if they have none and puts them… |
hanzo iam organizations avatar | POST /v1/iam/organizations/avatar | Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single… |
hanzo iam organizations delete | POST /v1/iam/organizations/delete | Removes an organization and everything named inside it. |
hanzo iam organizations search | GET /v1/iam/organizations/search | Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an… |
hanzo iam organizations update | POST /v1/iam/organizations/update | Changes an organization's display, its defaults and the sign-in rules everyone in it inherits. |
hanzo iam organizations get | GET /v1/iam/organizations | Returns the organizations you can see, newest first. |
hanzo iam organizations create | POST /v1/iam/organizations | Makes a new organization — the account your users, applications, roles, projects and workspaces are all named inside. |
hanzo iam password | PUT /v1/iam/password | Replaces the calling person's password. |
hanzo iam permissions delete | POST /v1/iam/permissions/delete | Revokes a permission. |
hanzo iam permissions update | POST /v1/iam/permissions/update | Changes who a permission grants to, what it allows, or the resources it covers. |
hanzo iam permissions get | GET /v1/iam/permissions | Returns the permissions in one organization, newest first — each one a grant saying which people or roles may do what,… |
hanzo iam permissions create | POST /v1/iam/permissions | Grants a permission — the call that gives a person or a role the ability to do something. |
hanzo iam preferences | POST /v1/iam/preferences | Saves the calling person's own settings and returns the full set afterwards. |
hanzo iam projects delete | POST /v1/iam/projects/delete | Removes a project. |
hanzo iam projects get | POST /v1/iam/projects/get | Returns one project: what it is called and how it is set up. |
hanzo iam projects update | POST /v1/iam/projects/update | Changes a project's settings. |
hanzo iam projects create | POST /v1/iam/projects | Makes a project inside your organization — the scope people pick between when their work is separated by product or… |
hanzo iam providers delete --name <name> --owner <owner> | POST /v1/iam/providers/delete | Removes a provider. |
hanzo iam providers get --name <name> --owner <owner> | POST /v1/iam/providers/get | Returns one provider: what it connects to and how it is configured. |
hanzo iam providers update | POST /v1/iam/providers/update | Changes a provider's settings or rotates the credentials it holds. |
hanzo iam providers create | POST /v1/iam/providers | Adds an identity provider your people can sign in with, or a service your applications send through — a social or… |
hanzo iam registry jwks | GET /v1/iam/registry/jwks | Publishes the public key your registry uses to verify the tokens issued above — the one URL to configure so the… |
hanzo iam registry token get | GET /v1/iam/registry/token | Signs a container client in to your registry. |
hanzo iam registry token create | POST /v1/iam/registry/token | Signs a container client in to your registry. |
hanzo iam release | POST /v1/iam/release | Steps a platform operator back out: it returns their own access token with no organization assumed, which is the… |
hanzo iam resolve-key | GET /v1/iam/resolve-key | Answers which organization a PUBLISHABLE key belongs to — what a service of yours calls to attribute a request that… |
hanzo iam revoke-user-keys | POST /v1/iam/revoke-user-keys | Clears the target user's key of the requested TYPE (immediate revoke). |
hanzo iam roles delete | POST /v1/iam/roles/delete | Removes a role. |
hanzo iam roles get | POST /v1/iam/roles/get | Returns one role: who is in it, and the roles it includes. |
hanzo iam roles update | POST /v1/iam/roles/update | Changes who is in a role, or which roles it includes. |
hanzo iam roles create | POST /v1/iam/roles | Makes a role — a named group of people that permissions are granted to. |
hanzo iam scim v2 ResourceTypes get <name> | GET /v1/iam/scim/v2/ResourceTypes/{name} | Returns one provisionable record kind in full. |
hanzo iam scim v2 ResourceTypes list | GET /v1/iam/scim/v2/ResourceTypes | Returns the kinds of record this directory provisions and the address of each, so your identity provider discovers them… |
hanzo iam scim v2 Schemas get <id> | GET /v1/iam/scim/v2/Schemas/{id} | Returns one attribute definition in full. |
hanzo iam scim v2 Schemas list | GET /v1/iam/scim/v2/Schemas | Returns the attribute definitions this directory understands, so your identity provider knows which fields it may send… |
hanzo iam scim v2 ServiceProviderConfig | GET /v1/iam/scim/v2/ServiceProviderConfig | Tells your identity provider which parts of SCIM this directory supports, so it configures itself instead of you… |
hanzo iam scim v2 Users owner get <owner> <name> | GET /v1/iam/scim/v2/Users/{owner}/{name} | Returns one person in the standard SCIM shape. |
hanzo iam scim v2 Users owner set <owner> <name> | PUT /v1/iam/scim/v2/Users/{owner}/{name} | Overwrites a person's SCIM attributes with what your identity provider sends — how a change made there lands here. |
hanzo iam scim v2 Users owner update <owner> <name> | PATCH /v1/iam/scim/v2/Users/{owner}/{name} | Applies a partial change from your identity provider — one attribute moved, not the whole record resent. |
hanzo iam scim v2 Users owner rm <owner> <name> | DELETE /v1/iam/scim/v2/Users/{owner}/{name} | Deprovisions a person — how removing someone in your identity provider removes their access here. |
hanzo iam scim v2 Users list | GET /v1/iam/scim/v2/Users | Returns the people in your organization to your identity provider, in the standard SCIM shape, so an IdP can reconcile… |
hanzo iam scim v2 Users create | POST /v1/iam/scim/v2/Users | Provisions a person from your identity provider — how a new hire gets an account here automatically when they are added… |
hanzo iam send-verification-code | POST /v1/iam/send-verification-code | Validates the request and asks otp to get a code to the person. |
hanzo iam service-accounts keys <name> | POST /v1/iam/service-accounts/{name}/keys | Serves POST /v1/iam/service-accounts/:name/keys: mint a fresh key, invalidating the prior one, and return the new raw… |
hanzo iam service-accounts rm <name> | DELETE /v1/iam/service-accounts/{name} | Serves DELETE /v1/iam/service-accounts/:name. |
hanzo iam service-accounts list | GET /v1/iam/service-accounts | Returns your organization's service accounts — what each is called and when it was created. |
hanzo iam service-accounts create | POST /v1/iam/service-accounts | Makes a service account — an identity for a program rather than a person, for a script, a bot or a deployment that has… |
hanzo iam sessions create --application <application> --name <name> --owner <owner> | POST /v1/iam/sessions/create | Records a sign-in. |
hanzo iam sessions delete --application <application> --name <name> --owner <owner> | POST /v1/iam/sessions/delete | Signs a person out of one application — the session ends and every browser carrying it stops being authenticated. |
hanzo iam sessions get --application <application> --name <name> --owner <owner> | POST /v1/iam/sessions/get | Returns one person's session in one application — when it began and which browsers or devices are still carrying it. |
hanzo iam sessions list --owner <owner> | POST /v1/iam/sessions/list | Returns who is currently signed in to your organization, newest first, and can be narrowed to one person or one… |
hanzo iam sessions update --application <application> --name <name> --owner <owner> | POST /v1/iam/sessions/update | Replaces the set of browsers a session covers — signing out the ones you leave off while the session itself stays live. |
hanzo iam set-preferred-mfa | POST /v1/iam/set-preferred-mfa | Picks which second factor an account is asked for first when it has more than one. |
hanzo iam signin | POST /v1/iam/signin | Completes a sign-in: it exchanges the one-time code your application was handed at the end of the login flow for a live… |
hanzo iam signup | POST /v1/iam/signup | Creates an account from the sign-up form and applies the application's own sign-up rules — whether self-service… |
hanzo iam tokens delete --name <name> --owner <owner> | POST /v1/iam/tokens/delete | Revokes an access token. |
hanzo iam tokens get --name <name> --owner <owner> | POST /v1/iam/tokens/get | Returns one access token: who and what it was issued to, and when it expires. |
hanzo iam tokens issue | POST /v1/iam/tokens/issue | Mints an access token for the ?id=<owner>/<name> target user (optional ?aud= resource, RFC 8707), issued by the… |
hanzo iam tokens update | POST /v1/iam/tokens/update | Changes an access token's scope or expiry. |
hanzo iam tokens create | POST /v1/iam/tokens | Records an access token — the credential an application or integration presents on a caller's behalf. |
hanzo iam unlink | POST /v1/iam/unlink | Disconnects one sign-in identity from an account, so that provider can no longer be used to sign in as that person. |
hanzo iam update-preferences | POST /v1/iam/update-preferences | Saves the calling person's own settings and returns the full set afterwards. |
hanzo iam users delete --name <name> --owner <owner> | POST /v1/iam/users/delete | Removes a person from your organization. |
hanzo iam users update | POST /v1/iam/users/update | Changes a person's profile, their roles, or the credentials they sign in with. |
hanzo iam users get --owner <owner> | GET /v1/iam/users | Returns a page of the people in your organization, with the total so you can page through the rest. |
hanzo iam users create | POST /v1/iam/users | Adds a person to your organization. |
hanzo iam verification-codes | POST /v1/iam/verification-codes | Validates the request and asks otp to get a code to the person. |
hanzo iam web3 nonce | GET /v1/iam/web3/nonce | Starts a wallet sign-in: it returns a one-time challenge for the wallet to sign. |
hanzo iam web3 verify | POST /v1/iam/web3/verify | Completes a wallet sign-in: it verifies the signed challenge and, if it holds, signs the wallet's owner in. |
hanzo iam webauthn-credentials delete --name <name> --owner <owner> | POST /v1/iam/webauthn-credentials/delete | Removes a passkey or security key — what you call when a device is lost. |
hanzo iam webauthn-credentials get --name <name> --owner <owner> | POST /v1/iam/webauthn-credentials/get | Returns one passkey or security key: whose it is, what device it lives on, and when it was registered. |
hanzo iam webauthn-credentials update | POST /v1/iam/webauthn-credentials/update | Renames a registered passkey or security key, so a person can tell their devices apart. |
hanzo iam webauthn-credentials create | POST /v1/iam/webauthn-credentials | Registers a passkey or security key for a person, so they can sign in with their device instead of a password. |
hanzo iam webauthn signin begin | GET /v1/iam/webauthn/signin/begin | Starts a passkey sign-in: it returns the challenge the person's authenticator signs. |
hanzo iam webauthn signin finish | POST /v1/iam/webauthn/signin/finish | Verifies the signed challenge and signs the person in. |
hanzo iam webauthn signup begin | GET /v1/iam/webauthn/signup/begin | Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator. |
hanzo iam webauthn signup finish | POST /v1/iam/webauthn/signup/finish | Verifies the newly created passkey and stores it, so the person can sign in with their device from then on. |
hanzo iam whoami | GET /v1/iam/whoami | Tells you who the current caller is — the lightweight check a page makes on load to decide whether to render signed-in… |
hanzo iam workspaces delete | POST /v1/iam/workspaces/delete | Removes a workspace. |
hanzo iam workspaces get | POST /v1/iam/workspaces/get | Returns one workspace: what it is called and how it is set up. |
hanzo iam workspaces update | POST /v1/iam/workspaces/update | Changes a workspace's settings. |
hanzo iam workspaces create | POST /v1/iam/workspaces | Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. |
How is this guide?