List or search users in the Zitadel instance. Returns user details including name, email, status, and login names.

Get detailed information about a specific user by their user ID.

Create a new human user in Zitadel. An invitation email will be sent automatically so the user can set their password.

Deactivate a user account. The user will no longer be able to log in. Requires confirm: true.

Reactivate a previously deactivated user account.

Lock a user account. The user will not be able to log in until unlocked. Requires confirm: true.

Unlock a previously locked user account.

Permanently delete a user. This action cannot be undone. Requires confirm: true. Consider using zitadel_deactivate_user instead (reversible).

List all projects in the Zitadel organization.

Get details of a specific project by its ID.

Create a new project in Zitadel. Projects contain applications, roles, and grants.

List all applications in a Zitadel project.

Get details of a specific application including its Client ID and OIDC configuration.

Create a new OIDC application in a Zitadel project. Returns the Client ID (and Client Secret for confidential clients). Configure redirect URIs, response types, and grant types.

Update an OIDC application's configuration (redirect URIs, auth method, etc.).

List all roles defined in a Zitadel project (e.g., "admin", "app:finance").

Create a new role in a Zitadel project. Use key format "app:{slug}" for app-specific access roles.

List role grants for a specific user, showing which roles they have been assigned.

Assign roles to a user by creating a grant. Validates that the roles exist in the project before granting.

Remove a role grant from a user by grant ID. Requires confirm: true.

Create a new service account (machine user) for API access. Service accounts authenticate via JWT keys, not passwords.

Generate a new key pair for a service account. The private key is returned ONLY at creation time — save it immediately.

List existing keys for a service account. Shows key metadata only (not private keys).

Get details of the current organization (based on the configured ZITADEL_ORG_ID).

Get the environment variables needed for a new application's .env.local file. Fetches the app details and formats them as ready-to-paste configuration.