# origin iam commands Every origin iam command with its flags: members, invites, service accounts, role assignments and permission checks. This page lists every `origin iam` command. Logging in is `origin id login`; see [Use the CLI](/docs/platform/access/cli). ## invite-member [#invite-member] Invite a person to an org by email. Grants access immediately if they already have an account; otherwise stores a pending invite applied automatically the first time they authenticate. ```sh origin iam invite-member --org-id --email --role-urn ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--email ` | yes | Email address to invite. | | `--role-urn ` | yes | URN of the built-in role to grant once accepted. | ## remove-member [#remove-member] Remove a member’s access to an org - revokes every role they hold in it, at every project scope. ```sh origin iam remove-member --org-id --principal ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--principal ` | yes | The principal to remove, e.g. `user:` | ## revoke-invite [#revoke-invite] Cancel a pending invite before it’s been accepted. ```sh origin iam revoke-invite --org-id --invite-id ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--invite-id ` | yes | ID of the invite to revoke (see [`list-invites`](#list-invites)) | ## list-members [#list-members] List every principal with an active role assignment on an org. ```sh origin iam list-members --org-id ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | ## list-invites [#list-invites] List pending (not yet accepted) invites for an org. ```sh origin iam list-invites --org-id ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | ## create-service-account [#create-service-account] Create a service account for an organization. The response contains an OAuth client ID and client secret for the client-credentials grant; the secret is shown once, so store it now. The service account starts with no roles; grant it access with [`assign-role`](#assign-role). ```sh origin iam create-service-account --org-id --name ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--name ` | yes | Display name for the service account. | ## revoke-service-account [#revoke-service-account] Revoke a service account. Its credential stops working immediately: every request for a new access token is refused. An access token issued before the revocation stays valid until it expires. Its role assignments are kept; remove them with [`revoke-role`](#revoke-role). See [Service accounts](/docs/iam/service-accounts). ```sh origin iam revoke-service-account --org-id --service-account-id ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--service-account-id ` | yes | ID of the service account to revoke (see [`list-service-accounts`](#list-service-accounts)) | ## list-service-accounts [#list-service-accounts] List every service account (active or revoked) created for an org. ```sh origin iam list-service-accounts --org-id ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | ## assign-role [#assign-role] Assign a built-in role to a principal, org-wide or project-scoped. ```sh origin iam assign-role [OPTIONS] --org-id --principal --role-urn ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--project-id ` | no | Narrows the assignment to a single project. Omit for an org-wide grant. | | `--principal ` | yes | The principal to grant the role to, e.g. `user:` | | `--role-urn ` | yes | URN of the built-in role to assign. | ## revoke-role [#revoke-role] Revoke a previously assigned role from a principal. ```sh origin iam revoke-role [OPTIONS] --org-id --principal --role-urn ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--project-id ` | no | Must match the scope (org-wide vs. the given project) the role was originally assigned with. | | `--principal ` | yes | The principal to revoke the role from, e.g. `user:` | | `--role-urn ` | yes | URN of the role to revoke. | ## current-user [#current-user] Show the currently authenticated user. ```sh origin iam current-user ``` This command takes no options. ## current-user-grants [#current-user-grants] List the currently authenticated user’s role grants. ```sh origin iam current-user-grants ``` This command takes no options. ## principal-grants [#principal-grants] List every role a principal holds in an org, with each grant’s project scope. ```sh origin iam principal-grants --org-id --principal ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | | `--principal ` | yes | The principal to look up, e.g. `user:` | ## list-roles [#list-roles] List the built-in roles available in an organization. ```sh origin iam list-roles --org-id ``` | Option | Required | Description | | --- | --- | --- | | `--org-id ` | yes | ID of the organisation. | ## get-role [#get-role] Get a single built-in role and its permissions. ```sh origin iam get-role --role-urn ``` | Option | Required | Description | | --- | --- | --- | | `--role-urn ` | yes | URN of the role. | ## permissions [#permissions] List every permission the platform knows about. ```sh origin iam permissions ``` This command takes no options. ## has-permission [#has-permission] Check whether a principal has a given permission on a resource. ```sh origin iam has-permission --on-resource-urn --principal --permission-key ``` | Option | Required | Description | | --- | --- | --- | | `--on-resource-urn ` | yes | URN of the resource to check the permission against. | | `--principal ` | yes | The principal to check, e.g. `user:` | | `--permission-key ` | yes | Permission key to check, e.g. `network.vpc.list` |