end-users

Manage end users — external people who sign in through MCP OAuth (optionally via your IdP) to use the account's MCP servers. End users never get workspace access; your team's account collaborators live under workspace-users.

An end user's effective access is the union of group memberships (groups), roles (roles), and direct grants. Every command that targets one takes the access-record id (the _id from end-users list, also called the "ashareId").

There is no get, create, update, set, or delete — records are created by invite (or JIT sign-in through an IdP) and removed by revoke, the platform's own name for the operation: access is withdrawn and the record soft-deleted, nothing is destroyed the way a workspace-users delete removes its record.

REST API: End Users

celigo end-users <subcommand> [args] [flags]

Supports all global flags.

---

Subcommands

Subcommand	Purpose
list	List end users with identity fields (email, name, last sign-in) joined in.
effective-access <ashareId>	Compile one end user's effective MCP access: groups, roles, and the merged grant list with each grant's source.
invite	Invite end users by email — one address or a bulk batch of up to 100.
revoke <ashareId>	Withdraw an end user's access (soft-deletes the access record).

---

celigo end-users list

List the account's end users, with identity fields joined from the underlying user record. The _id column is the access-record id (ashareId) that effective-access, revoke, and the groups membership commands take.

Signature

celigo end-users list [--provisioned-by <invite|jit>]

Arguments

None.

Flags

Flag	Type	Default	Description
--provisioned-by <source>	invite | jit	—	Only end users created by this source: invite (explicit invitation) or jit (auto-provisioned on first IdP sign-in). Any other value is rejected locally.

Default table columns: _id, email, name, provisionedBy, accepted, disabled, lastSignIn.

Example

# Everyone, with identity fields
celigo end-users list --format table

# Only the records an IdP sign-in auto-created
celigo end-users list --provisioned-by jit

Corresponds to: GET /v1/endusers

---

celigo end-users effective-access <ashareId>

Compile an end user's effective MCP access: their group memberships, roles, and the merged access list, with the source of each grant (direct, group:<name>, pset:<name>, role:<name>). The per-server mirror of this view is mcp-servers effective-access, which compiles the same picture for every end user who can reach one server.

Signature

celigo end-users effective-access <ashareId>

Arguments

Argument	Type	Required	Description
<ashareId>	string	Yes	Access-record id (the _id from end-users list).

Example

celigo end-users effective-access 68f0a9b2c7d3e8f1a2b3c4d5 --jq '.access'

Corresponds to: GET /v1/endusers/{ashareId}/effective-access

---

celigo end-users invite

Invite end users by email. Sends real invitation emails, so it requires full mode.

One command, two endpoints: exactly one --email goes to the single-invite endpoint and prints the created record ({_userId, _ashareId, status}); two or more (up to 100) go to the bulk endpoint, which applies the same access to every address and prints {summary, results} with a per-address outcome. Bulk invites are sequential and partial-success — a failed address never aborts the batch.

Signature

celigo end-users invite --email <email> [--email <email> ...] [--name <name>] \
  [--group <groupId> ...] [--grant <mcpServerId|all>=<capability,...> ...]

Arguments

None.

Flags

Flag	Type	Default	Description
--email <emails...>	string	—	Required. Email address(es) to invite (normalized to lowercase). Repeatable.
--name <name>	string	the email local-part	Display name — single invite only. The bulk endpoint doesn't accept it, and end users have no update op, so a display name can only ever be set here.
--group <groupIds...>	string	—	Group(s) to add every invited end user to as manual memberships. Repeatable.
--grant <grants...>	<mcpServerId|all>=<capability[,capability...]>	—	Direct MCP-server grant. Capabilities: tool:all, tool:<id>, api:all, api:<id>, or pset:<permissionSetId>; all as the target grants across every MCP server. Repeatable.

Examples

# One person, into a group, with a direct grant on one server
celigo end-users invite --email [e-mail] \
  --group 68a1b2c3d4e5f6a7b8c9d0e1 \
  --grant 6a1b2c3d4e5f6a7b8c9d0e1f=tool:all

# A bulk batch — the same access for every address
celigo end-users invite --email [e-mail] --email [e-mail] \
  --grant all=tool:all

Corresponds to: POST /v1/endusers/invite (single), or POST /v1/endusers/invite/bulk (two or more addresses, max 100).

---

celigo end-users revoke <ashareId>

Withdraw an end user's access: soft-deletes the access record and clears its group memberships. The person's own user record is untouched. Prompts for confirmation unless -y is passed. Requires full mode.

revoke — not the CLI's usual delete — is the platform's own name for this operation: access is being withdrawn, no resource is destroyed.

Signature

celigo end-users revoke <ashareId> [-y]

Arguments

Argument	Type	Required	Description
<ashareId>	string	Yes	Access-record id from end-users list.

Flags

Flag	Type	Default	Description
-y, --yes	boolean	false	Skip the confirmation prompt.

Example

celigo end-users revoke 68f0a9b2c7d3e8f1a2b3c4d5 -y

Corresponds to: DELETE /v1/endusers/{ashareId}

---

Gotchas

• End users are not workspace users. They authenticate through MCP OAuth to use your MCP servers and never see the integrator.io workspace. Team members who build and operate integrations belong under workspace-users. The two surfaces use separate APIs and separate access records.
• The working id is the ashareId. Every command here takes the access-record _id from end-users list — the same id groups add-members and mcp-servers assign-end-users take. The person's own user id (_userId) is not accepted.
• invite sends real emails. It requires full mode, as do revoke and the group membership commands — they change who can access your servers.
• --name only works on a single invite. The bulk endpoint doesn't accept a display name, and end users have no update operation, so the invite is the only place a name can ever be set. It defaults to the email local-part.
• Bulk invites are partial-success. Two or more --email values route to the bulk endpoint, which processes addresses sequentially and reports a per-address outcome — a failed address never aborts the rest of the batch.
• provisionedBy tells you how a record was created. invite means someone ran an explicit invitation; jit means the record was auto-provisioned when the person first signed in through your IdP.
• revoke is a soft delete. The access record is withdrawn and group memberships cleared, but nothing is destroyed — unlike workspace-users delete, which removes its access record entirely.

Related

• workspace-users — your team's account collaborators (the other kind of user).
• groups — bundle roles and grants, then manage membership with ashareIds from list.
• roles — named, reusable sets of MCP-server grants.
• mcp-servers — the resources being granted; effective-access and the assign-* commands mirror this group's per-user view.