List or search users in the Zitadel instance. Returns user details including name, email, status, and login names.

Get detailed information about a specific user by their user ID.

Create a new human user in Zitadel. An invitation email will be sent automatically so the user can set their password. Optionally supply your own userId for idempotent retries (a re-create then conflicts cleanly).

Deactivate a user account. The user will no longer be able to log in. Requires confirm: true.

Reactivate a previously deactivated user account.

Lock a user account. The user will not be able to log in until unlocked. Requires confirm: true.

Unlock a previously locked user account.

Permanently delete a user. This action cannot be undone. Requires confirm: true. Consider using zitadel_deactivate_user instead (reversible).

List all projects in the Zitadel organization.

Get details of a specific project by its ID.

Create a new project in Zitadel. Projects contain applications, roles, and grants.

List all applications in a Zitadel project.

Get details of a specific application including its Client ID and OIDC configuration.

Create a new OIDC application in a Zitadel project. Returns the Client ID (and Client Secret for confidential clients). Configure redirect URIs, response types, and grant types.

Update an OIDC application's configuration (redirect URIs, auth method, grant types, etc.).

List all roles defined in a Zitadel project (e.g., "admin", "standard").

Create a new role in a Zitadel project. For the standardized RBAC model use the keys "admin" or "standard" (see zitadel_provision_user).

List role grants (authorizations) for a specific user, showing which project roles they have been assigned.

Assign project roles to a user via the v2 AuthorizationService. Validates that the roles exist in the project before granting. For the standardized two-role model prefer "admin"/"standard"; other keys are allowed but flagged as drift.

Remove a role grant (authorization) from a user by grant ID. Requires confirm: true.

Create a new service account (machine user) for API access. Service accounts authenticate via JWT keys, not passwords.

Generate a new key pair for a service account. The private key is returned ONLY at creation time — save it immediately.

List existing keys for a service account. Shows key metadata only (not private keys).

Get details of the current organization (based on the configured ZITADEL_ORG_ID).

List the org-level manager (administrator) role keys this Zitadel org supports (e.g. ORG_OWNER, ORG_USER_MANAGER, ORG_USER_PERMISSION_EDITOR). Use to confirm the exact keys before granting.

List users who hold org-level manager (administrator) grants, with their manager roles. Optionally filter to a single role key (e.g. ORG_OWNER) to see who holds it.

Grant org-level manager (administrator) role(s) to a user. For the no-super-admin pattern, grant ORG_USER_MANAGER to every Admin so they can manage any user. Idempotent: merges with any existing manager roles. Defaults to ["ORG_USER_MANAGER"].

Revoke org-level manager role(s) from a user. Omit roles to remove the entire manager membership. Guards against removing the last ORG_OWNER. Requires confirm: true.

Atomically provision a user for the core SSO apps (the app-portal cascade-up). Creates the human user (idempotent by email or supplied userId), assigns the Admin|Standard project role via the v2 AuthorizationService, and — for Admins — grants ORG_USER_MANAGER so they can manage any user (no-super-admin pattern). Returns { zitadelUserId, role, authorizationId }. Safe to re-run.

Offboard a user: remove their Admin|Standard project role assignment, revoke any org-manager grant, and deactivate the account. Guards: cannot remove the last Admin, cannot self-demote (pass actingUserId), cannot remove the last ORG_OWNER. Requires confirm: true.

Get the login policy of the current organization (ZITADEL_ORG_ID), including whether self-registration (allowRegister) is on and whether the policy is inherited from the instance default or a custom org policy.

Read the Login V2 (new "hosted login" / TypeScript login) text overrides for a locale, via the Settings v2 API. This is the ONLY text-customization that affects the new login — the legacy Management "Custom Login Texts" do not. By default returns the merged, effective file (your overrides on top of the shipped defaults); pass onlyOverrides=true to see just what is stored at this level. Defaults to the configured org; pass level:"instance" for the whole instance. Override keys mirror apps/login/locales/.json in zitadel/zitadel (e.g. "password.errors.couldNotCreateSessionForUser").

Override texts of the Login V2 (new "hosted login" / TypeScript login) for a locale, via the Settings v2 API — the correct lever for the new login (the legacy Management "Custom Login Texts" are ignored by it). Pass translations as flat dot-path keys mirroring apps/login/locales/.json in zitadel/zitadel, e.g. {"password.errors.couldNotCreateSessionForUser":"Benutzername oder Passwort falsch."}. Only the keys you send are changed: the tool reads this level's existing overrides, deep-merges yours in, and writes the result — so other overrides and untouched defaults stay intact (idempotent). Defaults to the configured org (ORG-LEVEL — affects every app whose login resolves to this org); pass level:"instance" for the whole instance (needs an IAM-level grant). Set one locale per call; repeat for each language you support.

Get the environment variables needed for a new application's .env.local file. Fetches the app details and formats them as ready-to-paste configuration.