> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/commands/end-users.md).

# end-users

Manage end users — external people who sign in through MCP OAuth (optionally via your IdP) to use the account's MCP servers. End users never get workspace access; your team's account collaborators live under [workspace-users](/cli/commands/workspace-users.md).

An end user's effective access is the union of group memberships ([groups](/cli/commands/groups.md)), roles ([roles](/cli/commands/roles.md)), and direct grants. Every command that targets one takes the access-record id (the `_id` from `end-users list`, also called the "ashareId").

There is no `get`, `create`, `update`, `set`, or `delete` — records are created by `invite` (or JIT sign-in through an IdP) and removed by `revoke`, the platform's own name for the operation: access is withdrawn and the record soft-deleted, nothing is destroyed the way a `workspace-users delete` removes its record.

**REST API**: [End Users](https://developer.celigo.com/api/api-reference/end-users)

```
celigo end-users <subcommand> [args] [flags]
```

Supports all [global flags](/cli/getting-started/global-flags.md).

***

## Subcommands

| Subcommand                    | Purpose                                                                                                         |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------- |
| `list`                        | List end users with identity fields (email, name, last sign-in) joined in.                                      |
| `effective-access <ashareId>` | Compile one end user's effective MCP access: groups, roles, and the merged grant list with each grant's source. |
| `invite`                      | Invite end users by email — one address or a bulk batch of up to 100.                                           |
| `revoke <ashareId>`           | Withdraw an end user's access (soft-deletes the access record).                                                 |

***

## `celigo end-users list`

List the account's end users, with identity fields joined from the underlying user record. The `_id` column is the access-record id (ashareId) that `effective-access`, `revoke`, and the [groups](/cli/commands/groups.md) membership commands take.

**Signature**

```bash
celigo end-users list [--provisioned-by <invite|jit>]
```

**Arguments**

None.

**Flags**

| Flag                        | Type            | Default | Description                                                                                                                                                  |
| --------------------------- | --------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--provisioned-by <source>` | `invite \| jit` | —       | Only end users created by this source: `invite` (explicit invitation) or `jit` (auto-provisioned on first IdP sign-in). Any other value is rejected locally. |

Default table columns: `_id`, `email`, `name`, `provisionedBy`, `accepted`, `disabled`, `lastSignIn`.

**Example**

```bash
# Everyone, with identity fields
celigo end-users list --format table

# Only the records an IdP sign-in auto-created
celigo end-users list --provisioned-by jit
```

**Corresponds to**: [`GET /v1/endusers`](https://developer.celigo.com/api/api-reference/end-users)

***

## `celigo end-users effective-access <ashareId>`

Compile an end user's effective MCP access: their group memberships, roles, and the merged access list, with the source of each grant (`direct`, `group:<name>`, `pset:<name>`, `role:<name>`). The per-server mirror of this view is [`mcp-servers effective-access`](/cli/commands/mcp-servers.md#celigo-mcp-servers-effective-access-id), which compiles the same picture for every end user who can reach one server.

**Signature**

```bash
celigo end-users effective-access <ashareId>
```

**Arguments**

| Argument     | Type   | Required | Description                                         |
| ------------ | ------ | -------- | --------------------------------------------------- |
| `<ashareId>` | string | Yes      | Access-record id (the `_id` from `end-users list`). |

**Example**

```bash
celigo end-users effective-access 68f0a9b2c7d3e8f1a2b3c4d5 --jq '.access'
```

**Corresponds to**: [`GET /v1/endusers/{ashareId}/effective-access`](https://developer.celigo.com/api/api-reference/end-users)

***

## `celigo end-users invite`

Invite end users by email. Sends real invitation emails, so it requires `full` mode.

One command, two endpoints: exactly one `--email` goes to the single-invite endpoint and prints the created record (`{_userId, _ashareId, status}`); two or more (up to 100) go to the bulk endpoint, which applies the same access to every address and prints `{summary, results}` with a per-address outcome. Bulk invites are sequential and partial-success — a failed address never aborts the batch.

**Signature**

```bash
celigo end-users invite --email <email> [--email <email> ...] [--name <name>] \
  [--group <groupId> ...] [--grant <mcpServerId|all>=<capability,...> ...]
```

**Arguments**

None.

**Flags**

| Flag                    | Type                                              | Default              | Description                                                                                                                                                                         |
| ----------------------- | ------------------------------------------------- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--email <emails...>`   | string                                            | —                    | **Required.** Email address(es) to invite (normalized to lowercase). Repeatable.                                                                                                    |
| `--name <name>`         | string                                            | the email local-part | Display name — single invite only. The bulk endpoint doesn't accept it, and end users have no update op, so a display name can only ever be set here.                               |
| `--group <groupIds...>` | string                                            | —                    | Group(s) to add every invited end user to as manual memberships. Repeatable.                                                                                                        |
| `--grant <grants...>`   | `<mcpServerId\|all>=<capability[,capability...]>` | —                    | Direct MCP-server grant. Capabilities: `tool:all`, `tool:<id>`, `api:all`, `api:<id>`, or `pset:<permissionSetId>`; `all` as the target grants across every MCP server. Repeatable. |

**Examples**

```bash
# One person, into a group, with a direct grant on one server
celigo end-users invite --email a@example.com \
  --group 68a1b2c3d4e5f6a7b8c9d0e1 \
  --grant 6a1b2c3d4e5f6a7b8c9d0e1f=tool:all

# A bulk batch — the same access for every address
celigo end-users invite --email a@example.com --email b@example.com \
  --grant all=tool:all
```

**Corresponds to**: [`POST /v1/endusers/invite`](https://developer.celigo.com/api/api-reference/end-users) (single), or [`POST /v1/endusers/invite/bulk`](https://developer.celigo.com/api/api-reference/end-users) (two or more addresses, max 100).

***

## `celigo end-users revoke <ashareId>`

Withdraw an end user's access: soft-deletes the access record and clears its group memberships. The person's own user record is untouched. Prompts for confirmation unless `-y` is passed. Requires `full` mode.

`revoke` — not the CLI's usual `delete` — is the platform's own name for this operation: access is being withdrawn, no resource is destroyed.

**Signature**

```bash
celigo end-users revoke <ashareId> [-y]
```

**Arguments**

| Argument     | Type   | Required | Description                             |
| ------------ | ------ | -------- | --------------------------------------- |
| `<ashareId>` | string | Yes      | Access-record id from `end-users list`. |

**Flags**

| Flag        | Type    | Default | Description                   |
| ----------- | ------- | ------- | ----------------------------- |
| `-y, --yes` | boolean | `false` | Skip the confirmation prompt. |

**Example**

```bash
celigo end-users revoke 68f0a9b2c7d3e8f1a2b3c4d5 -y
```

**Corresponds to**: [`DELETE /v1/endusers/{ashareId}`](https://developer.celigo.com/api/api-reference/end-users)

***

## Gotchas

* **End users are not workspace users.** They authenticate through MCP OAuth to use your MCP servers and never see the integrator.io workspace. Team members who build and operate integrations belong under [workspace-users](/cli/commands/workspace-users.md). The two surfaces use separate APIs and separate access records.
* **The working id is the ashareId.** Every command here takes the access-record `_id` from `end-users list` — the same id `groups add-members` and `mcp-servers assign-end-users` take. The person's own user id (`_userId`) is not accepted.
* **`invite` sends real emails.** It requires `full` mode, as do `revoke` and the group membership commands — they change who can access your servers.
* **`--name` only works on a single invite.** The bulk endpoint doesn't accept a display name, and end users have no update operation, so the invite is the only place a name can ever be set. It defaults to the email local-part.
* **Bulk invites are partial-success.** Two or more `--email` values route to the bulk endpoint, which processes addresses sequentially and reports a per-address outcome — a failed address never aborts the rest of the batch.
* **`provisionedBy` tells you how a record was created.** `invite` means someone ran an explicit invitation; `jit` means the record was auto-provisioned when the person first signed in through your IdP.
* **`revoke` is a soft delete.** The access record is withdrawn and group memberships cleared, but nothing is destroyed — unlike `workspace-users delete`, which removes its access record entirely.

## Related

* [workspace-users](/cli/commands/workspace-users.md) — your team's account collaborators (the other kind of user).
* [groups](/cli/commands/groups.md) — bundle roles and grants, then manage membership with ashareIds from `list`.
* [roles](/cli/commands/roles.md) — named, reusable sets of MCP-server grants.
* [mcp-servers](/cli/commands/mcp-servers.md) — the resources being granted; `effective-access` and the `assign-*` commands mirror this group's per-user view.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.celigo.com/cli/commands/end-users.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.