origin iam commands

This page lists every origin iam command. Logging in is origin id login; see Use the CLI.

invite-member

Invite a person to an org by email. Grants access immediately if they already have an account; otherwise stores a pending invite applied automatically the first time they authenticate.

terminal

origin iam invite-member --org-id <ORG_ID> --email <EMAIL> --role-urn <ROLE_URN>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--email <EMAIL>`	yes	Email address to invite.
`--role-urn <ROLE_URN>`	yes	URN of the built-in role to grant once accepted.

remove-member

Remove a member’s access to an org - revokes every role they hold in it, at every project scope.

terminal

origin iam remove-member --org-id <ORG_ID> --principal <PRINCIPAL>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--principal <PRINCIPAL>`	yes	The principal to remove, e.g. `user:<user-id>`

revoke-invite

Cancel a pending invite before it’s been accepted.

terminal

origin iam revoke-invite --org-id <ORG_ID> --invite-id <INVITE_ID>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--invite-id <INVITE_ID>`	yes	ID of the invite to revoke (see `list-invites`)

list-members

List every principal with an active role assignment on an org.

terminal

origin iam list-members --org-id <ORG_ID>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.

list-invites

List pending (not yet accepted) invites for an org.

terminal

origin iam list-invites --org-id <ORG_ID>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.

Create a service account for an organization. The response contains an OAuth client ID and client secret for the client-credentials grant; the secret is shown once, so store it now. The service account starts with no roles; grant it access with assign-role.

terminal

origin iam create-service-account --org-id <ORG_ID> --name <NAME>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--name <NAME>`	yes	Display name for the service account.

revoke-service-account

Revoke a service account. Its credential stops working immediately: every request for a new access token is refused. An access token issued before the revocation stays valid until it expires. Its role assignments are kept; remove them with revoke-role. See Service accounts.

terminal

origin iam revoke-service-account --org-id <ORG_ID> --service-account-id <SERVICE_ACCOUNT_ID>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--service-account-id <SERVICE_ACCOUNT_ID>`	yes	ID of the service account to revoke (see `list-service-accounts`)

list-service-accounts

List every service account (active or revoked) created for an org.

terminal

origin iam list-service-accounts --org-id <ORG_ID>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.

assign-role

Assign a built-in role to a principal, org-wide or project-scoped.

terminal

origin iam assign-role [OPTIONS] --org-id <ORG_ID> --principal <PRINCIPAL> --role-urn <ROLE_URN>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--project-id <PROJECT_ID>`	no	Narrows the assignment to a single project. Omit for an org-wide grant.
`--principal <PRINCIPAL>`	yes	The principal to grant the role to, e.g. `user:<user-id>`
`--role-urn <ROLE_URN>`	yes	URN of the built-in role to assign.

revoke-role

Revoke a previously assigned role from a principal.

terminal

origin iam revoke-role [OPTIONS] --org-id <ORG_ID> --principal <PRINCIPAL> --role-urn <ROLE_URN>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--project-id <PROJECT_ID>`	no	Must match the scope (org-wide vs. the given project) the role was originally assigned with.
`--principal <PRINCIPAL>`	yes	The principal to revoke the role from, e.g. `user:<user-id>`
`--role-urn <ROLE_URN>`	yes	URN of the role to revoke.

current-user

Show the currently authenticated user.

terminal

origin iam current-user

This command takes no options.

current-user-grants

List the currently authenticated user’s role grants.

terminal

origin iam current-user-grants

This command takes no options.

principal-grants

List every role a principal holds in an org, with each grant’s project scope.

terminal

origin iam principal-grants --org-id <ORG_ID> --principal <PRINCIPAL>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.
`--principal <PRINCIPAL>`	yes	The principal to look up, e.g. `user:<user-id>`

list-roles

List the built-in roles available in an organization.

terminal

origin iam list-roles --org-id <ORG_ID>

Option	Required	Description
`--org-id <ORG_ID>`	yes	ID of the organisation.

get-role

Get a single built-in role and its permissions.

terminal

origin iam get-role --role-urn <ROLE_URN>

Option	Required	Description
`--role-urn <ROLE_URN>`	yes	URN of the role.

permissions

List every permission the platform knows about.

terminal

origin iam permissions

This command takes no options.

has-permission

Check whether a principal has a given permission on a resource.

terminal

origin iam has-permission --on-resource-urn <ON_RESOURCE_URN> --principal <PRINCIPAL> --permission-key <PERMISSION_KEY>

Option	Required	Description
`--on-resource-urn <ON_RESOURCE_URN>`	yes	URN of the resource to check the permission against.
`--principal <PRINCIPAL>`	yes	The principal to check, e.g. `user:<user-id>`
`--permission-key <PERMISSION_KEY>`	yes	Permission key to check, e.g. `network.vpc.list`