IAM_USER(1)

NAME
iam_user -

DESCRIPTION

An individual employee or system that needs to manage or use your company's Oracle Cloud Infrastructure resources. Users might need to launch instances, manage remote disks, work with your cloud network, etc. Users have one or more IAM Service credentials (ApiKey <https://docs.cloud.oracle.com/api/#/en/identity/20160918/ApiKey/>, UIPassword <https://docs.cloud.oracle.com/api/#/en/identity/20160918/UIPassword/>, SwiftPassword <https://docs.cloud.oracle.com/api/#/en/identity/20160918/SwiftPassword/> and AuthToken <https://docs.cloud.oracle.com/api/#/en/identity/20160918/AuthToken/>). For more information, see User Credentials <https://docs.cloud.oracle.com/Content/API/Concepts/usercredentials.htm>). End users of your application are not typically IAM Service users. For conceptual information about users and other IAM Service components, see Overview of the IAM Service <https://docs.cloud.oracle.com/Content/Identity/Concepts/overview.htm>.

These users are created directly within the Oracle Cloud Infrastructure system, via the IAM service. They are different from federated users, who authenticate themselves to the Oracle Cloud Infrastructure Console via an identity provider. For more information, see Identity Providers and Federation <https://docs.cloud.oracle.com/Content/Identity/Concepts/federation.htm>.

To use any of the API operations, you must be authorized in an IAM policy. If you're not authorized, talk to an administrator. If you're an administrator who needs to write policies to give users access, see Getting Started with Policies <https://docs.cloud.oracle.com/Content/Identity/Concepts/policygetstarted.htm>.

Warning: Oracle recommends that you avoid using any confidential information when you supply string values using the API.

AVAILABLE COMMANDS

•   api-key

•   delete

•   list

•   upload

•   create

•   delete

•   get

•   list

•   list-groups

•   oauth2-credential

•   create

•   delete

•   list

•   update

•   swift-password

•   create

•   delete

•   list

•   update

•   ui-password

•   create-or-reset

•   update

•   update-user-capabilities

•   update-user-state

  api-key

  Description

A PEM-format RSA credential for securing requests to the Oracle Cloud Infrastructure REST API. Also known as an API signing key. Specifically, this is the public key from the key pair. The private key remains with the user calling the API. For information about generating a key pair in the required PEM format, see Required Keys and OCIDs <https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm>.

Important: This is not the SSH key for accessing compute instances.

Each user can have a maximum of three API signing keys.

For more information about user credentials, see User Credentials <https://docs.cloud.oracle.com/Content/API/Concepts/usercredentials.htm>.

  Available Commands

•   delete

•   list

•   upload

  delete

  Description

Deletes the specified API signing key for the specified user.

Every user has permission to use this operation to delete a key for their own user ID. An administrator in your organization does not need to write a policy to give users this ability. To compare, administrators who have permission to the tenancy can use this operation to delete a key for any user, including themselves.

  Usage

oci iam user api-key delete [OPTIONS]

  Required Parameters

--fingerprint [text]

    The key's fingerprint.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--force

    Perform deletion without prompting for confirmation.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  list

  Description

Lists the API signing keys for the specified user. A user can have a maximum of three keys.

Every user has permission to use this API call for their own user ID. An administrator in your organization does not need to write a policy to give users this ability.

  Usage

oci iam user api-key list [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--all

    Fetches all pages of results.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  upload

  Description

Uploads an API signing key for the specified user.

Every user has permission to use this operation to upload a key for their own user ID. An administrator in your organization does not need to write a policy to give users this ability. To compare, administrators who have permission to the tenancy can use this operation to upload a key for any user, including themselves.

Important: Even though you have permission to upload an API key, you might not yet have permission to do much else. If you try calling an operation unrelated to your own credential management (e.g., ListUsers, LaunchInstance) and receive an "unauthorized" error, check with an administrator to confirm which IAM Service group(s) you're in and what access you have. Also confirm you're working in the correct compartment.

After you send your request, the new object's lifecycleState will temporarily be CREATING. Before using the object, first make sure its lifecycleState has changed to ACTIVE.

  Usage

oci iam user api-key upload [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--key [text]

    The public key. Must be an RSA key in PEM format. Either this option or --key-file must be specified

--key-file [filename]

    A file containing the public key. Must be an RSA key in PEM format. Either this option or --key must be specified

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  create

  Description

Creates a new user in your tenancy. For conceptual information about users, your tenancy, and other IAM Service components, see Overview of the IAM Service <https://docs.cloud.oracle.com/Content/Identity/Concepts/overview.htm>.

You must specify your tenancy's OCID as the compartment ID in the request object (remember that the tenancy is simply the root compartment). Notice that IAM resources (users, groups, compartments, and some policies) reside within the tenancy itself, unlike cloud resources such as compute instances, which typically reside within compartments inside the tenancy. For information about OCIDs, see Resource Identifiers <https://docs.cloud.oracle.com/Content/General/Concepts/identifiers.htm>.

You must also specify a name for the user, which must be unique across all users in your tenancy and cannot be changed. Allowed characters: No spaces. Only letters, numerals, hyphens, periods, underscores, +, and @. If you specify a name that's already in use, you'll get a 409 error. This name will be the user's login to the Console. You might want to pick a name that your company's own identity system (e.g., Active Directory, LDAP, etc.) already uses. If you delete a user and then create a new user with the same name, they'll be considered different users because they have different OCIDs.

You must also specify a description for the user (although it can be an empty string). It does not have to be unique, and you can change it anytime with UpdateUser <https://docs.cloud.oracle.com/api/#/en/identity/20160918/User/UpdateUser>. You can use the field to provide the user's full name, a description, a nickname, or other information to generally identify the user.

After you send your request, the new object's lifecycleState will temporarily be CREATING. Before using the object, first make sure its lifecycleState has changed to ACTIVE.

A new user has no permissions until you place the user in one or more groups (see AddUserToGroup <https://docs.cloud.oracle.com/api/#/en/identity/20160918/UserGroupMembership/AddUserToGroup>). If the user needs to access the Console, you need to provide the user a password (see CreateOrResetUIPassword <https://docs.cloud.oracle.com/api/#/en/identity/20160918/UIPassword/CreateOrResetUIPassword>). If the user needs to access the Oracle Cloud Infrastructure REST API, you need to upload a public API signing key for that user (see Required Keys and OCIDs <https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm> and also UploadApiKey <https://docs.cloud.oracle.com/api/#/en/identity/20160918/ApiKey/UploadApiKey>).

Important: Make sure to inform the new user which compartment(s) they have access to.

  Usage

oci iam user create [OPTIONS]

  Required Parameters

--description [text]

    The description you assign to the user during creation. Does not have to be unique, and it's changeable.

--name [text]

    The name you assign to the user during creation. This is the user's login for the Console. The name must be unique across all users in the tenancy and cannot be changed.

  Optional Parameters

--compartment-id, -c [text]

    The OCID of the tenancy containing the user. If not provided, this parameter will use the tenancy's OCID (root compartment's OCID) from the config file.

--defined-tags [complex type]

    Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags <https://docs.cloud.oracle.com/Content/General/Concepts/resourcetags.htm>. Example: {"Operations": {"CostCenter": "42"}} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

    The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--email [text]

    The email you assign to the user. Has to be unique across the tenancy.

--freeform-tags [complex type]

    Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags <https://docs.cloud.oracle.com/Content/General/Concepts/resourcetags.htm>. Example: {"Department": "Finance"} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

    The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--max-wait-seconds [integer]

    The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

--wait-for-state [text]

    This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

    Accepted values are:

    ACTIVE, CREATING, DELETED, DELETING, INACTIVE

--wait-interval-seconds [integer]

    Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  delete

  Description

Deletes the specified user. The user must not be in any groups.

  Usage

oci iam user delete [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--force

    Perform deletion without prompting for confirmation.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

--max-wait-seconds [integer]

    The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

--wait-for-state [text]

    This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

    Accepted values are:

    ACTIVE, CREATING, DELETED, DELETING, INACTIVE

--wait-interval-seconds [integer]

    Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  get

  Description

Gets the specified user's information.

  Usage

oci iam user get [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  list

  Description

Lists the users in your tenancy. You must specify your tenancy's OCID as the value for the compartment ID (remember that the tenancy is simply the root compartment). See Where to Get the Tenancy's OCID and User's OCID <https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm#five>.

  Usage

oci iam user list [OPTIONS]

  Optional Parameters

--all

    Fetches all pages of results. If you provide this option, then you cannot provide the --limit option.

--compartment-id, -c [text]

    The OCID of the compartment (remember that the tenancy is simply the root compartment). If not provided, this parameter will use the tenancy's OCID (root compartment's OCID) from the config file.

--external-identifier [text]

    The id of a user in the identity provider.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--identity-provider-id [text]

    The id of the identity provider.

--limit [integer]

    The maximum number of items to return in a paginated "List" call.

--page [text]

    The value of the opc-next-page response header from the previous "List" call.

--page-size [integer]

    When fetching results, the number of results to fetch per call. Only valid when used with --all or --limit, and ignored otherwise.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  list-groups

  Description

Lists the groups for which the specified user is a member. You must specify your tenancy's OCID as the value for the compartment ID (remember that the tenancy is simply the root compartment). See Where to Get the Tenancy's OCID and User's OCID <https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm#five>.

  Usage

oci iam user list-groups [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--all

    Fetches all pages of results. If you provide this option, then you cannot provide the --limit option.

--compartment-id, -c [text]

    The OCID of the compartment (remember that the tenancy is simply the root compartment). If not provided, this parameter will use the tenancy's OCID (root compartment's OCID) from the config file.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--limit [integer]

    The maximum number of items to return in a paginated "List" call.

--page [text]

    The value of the opc-next-page response header from the previous "List" call.

--page-size [integer]

    When fetching results, the number of results to fetch per call. Only valid when used with --all or --limit, and ignored otherwise.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  oauth2-credential

  Description

The OAuth 2.0 Client Credentials grant type is used by clients to obtain an access token outside of the context of a user.

For more information about OAuth 2.0 client credentials, see User Credentials <https://docs.cloud.oracle.com/Content/API/Concepts/usercredentials.htm>.

  Available Commands

•   create

•   delete

•   list

•   update

  create

  Description

Creates Oauth token for the user

  Usage

oci iam user oauth2-credential create [OPTIONS]

  Required Parameters

--description [text]

    Description of the oauth credential to help user differentiate them.

--name [text]

    Name of the oauth credential to help user differentiate them.

--scopes [complex type]

    Allowed scopes for the given oauth credential. This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

    The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  delete

  Description

Delete Oauth token for the user

  Usage

oci iam user oauth2-credential delete [OPTIONS]

  Required Parameters

--oauth2-client-credential-id [text]

    The ID of the Oauth credential.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--force

    Perform deletion without prompting for confirmation.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  list

  Description

List of Oauth tokens for the user

  Usage

oci iam user oauth2-credential list [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--all

    Fetches all pages of results. If you provide this option, then you cannot provide the --limit option.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--lifecycle-state [text]

    A filter to only return resources that match the given lifecycle state. The state value is case-insensitive.

    Accepted values are:

    ACTIVE, CREATING, DELETED, DELETING, INACTIVE

--limit [integer]

    The maximum number of items to return in a paginated "List" call.

--page [text]

    The value of the opc-next-page response header from the previous "List" call.

--page-size [integer]

    When fetching results, the number of results to fetch per call. Only valid when used with --all or --limit, and ignored otherwise.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  update

  Description

Updates Oauth token for the user

  Usage

oci iam user oauth2-credential update [OPTIONS]

  Required Parameters

--description [text]

    Description of the oauth credential to help user differentiate them.

--oauth2-client-credential-id [text]

    The ID of the Oauth credential.

--scopes [complex type]

    Allowed scopes for the given oauth credential. This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

    The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--force

    Perform update without prompting for confirmation.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

--is-reset-password [boolean]

    Indicate if the password to be reset or not in the update.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  swift-password

  Description

Deprecated. Use `AuthToken <https://docs.cloud.oracle.com/api/#/en/identity/20160918/AuthToken/>`__ instead.

Swift is the OpenStack object storage service. A SwiftPassword is an Oracle-provided password for using a Swift client with the Object Storage Service. This password is associated with the user's Console login. Swift passwords never expire. A user can have up to two Swift passwords at a time.

Note: The password is always an Oracle-generated string; you can't change it to a string of your choice.

For more information, see Managing User Credentials <https://docs.cloud.oracle.com/Content/Identity/Tasks/managingcredentials.htm>.

  Available Commands

•   create

•   delete

•   list

•   update

  create

  Description

Deprecated. Use `CreateAuthToken <https://docs.cloud.oracle.com/api/#/en/identity/20160918/AuthToken/CreateAuthToken>`__ instead.

Creates a new Swift password for the specified user. For information about what Swift passwords are for, see Managing User Credentials <https://docs.cloud.oracle.com/Content/Identity/Tasks/managingcredentials.htm>.

You must specify a description for the Swift password (although it can be an empty string). It does not have to be unique, and you can change it anytime with UpdateSwiftPassword <https://docs.cloud.oracle.com/api/#/en/identity/20160918/SwiftPassword/UpdateSwiftPassword>.

Every user has permission to create a Swift password for their own user ID. An administrator in your organization does not need to write a policy to give users this ability. To compare, administrators who have permission to the tenancy can use this operation to create a Swift password for any user, including themselves.

  Usage

oci iam user swift-password create [OPTIONS]

  Required Parameters

--description [text]

    The description you assign to the Swift password during creation. Does not have to be unique, and it's changeable.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  delete

  Description

Deprecated. Use `DeleteAuthToken <https://docs.cloud.oracle.com/api/#/en/identity/20160918/AuthToken/DeleteAuthToken>`__ instead.

Deletes the specified Swift password for the specified user.

  Usage

oci iam user swift-password delete [OPTIONS]

  Required Parameters

--swift-password-id [text]

    The OCID of the Swift password.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--force

    Perform deletion without prompting for confirmation.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  list

  Description

Deprecated. Use `ListAuthTokens <https://docs.cloud.oracle.com/api/#/en/identity/20160918/AuthToken/ListAuthTokens>`__ instead.

Lists the Swift passwords for the specified user. The returned object contains the password's OCID, but not the password itself. The actual password is returned only upon creation.

  Usage

oci iam user swift-password list [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--all

    Fetches all pages of results.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  update

  Description

Deprecated. Use `UpdateAuthToken <https://docs.cloud.oracle.com/api/#/en/identity/20160918/AuthToken/UpdateAuthToken>`__ instead.

Updates the specified Swift password's description.

  Usage

oci iam user swift-password update [OPTIONS]

  Required Parameters

--swift-password-id [text]

    The OCID of the Swift password.

--user-id [text]

    The OCID of the user.

  Optional Parameters

--description [text]

    The description you assign to the Swift password. Does not have to be unique, and it's changeable.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  ui-password

  Description

A text password that enables a user to sign in to the Console, the user interface for interacting with Oracle Cloud Infrastructure.

For more information about user credentials, see User Credentials <https://docs.cloud.oracle.com/Content/API/Concepts/usercredentials.htm>.

  Available Commands

•   create-or-reset

  create-or-reset

  Description

Creates a new Console one-time password for the specified user. For more information about user credentials, see User Credentials <https://docs.cloud.oracle.com/Content/API/Concepts/usercredentials.htm>.

Use this operation after creating a new user, or if a user forgets their password. The new one-time password is returned to you in the response, and you must securely deliver it to the user. They'll be prompted to change this password the next time they sign in to the Console. If they don't change it within 7 days, the password will expire and you'll need to create a new one-time password for the user.

Note: The user's Console login is the unique name you specified when you created the user (see CreateUser <https://docs.cloud.oracle.com/api/#/en/identity/20160918/User/CreateUser>).

  Usage

oci iam user ui-password create-or-reset [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  update

  Description

Updates the description of the specified user.

  Usage

oci iam user update [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--defined-tags [complex type]

    Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags <https://docs.cloud.oracle.com/Content/General/Concepts/resourcetags.htm>. Example: {"Operations": {"CostCenter": "42"}} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

    The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--description [text]

    The description you assign to the user. Does not have to be unique, and it's changeable.

--email [text]

    The email address you assign to the user. Has to be unique across the tenancy.

--force

    Perform update without prompting for confirmation.

--freeform-tags [complex type]

    Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags <https://docs.cloud.oracle.com/Content/General/Concepts/resourcetags.htm>. Example: {"Department": "Finance"} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

    The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

--max-wait-seconds [integer]

    The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

--wait-for-state [text]

    This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

    Accepted values are:

    ACTIVE, CREATING, DELETED, DELETING, INACTIVE

--wait-interval-seconds [integer]

    Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  update-user-capabilities

  Description

Updates the capabilities of the specified user.

  Usage

oci iam user update-user-capabilities [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--can-use-api-keys [boolean]

    Indicates if the user can use API keys.

--can-use-auth-tokens [boolean]

    Indicates if the user can use SWIFT passwords / auth tokens.

--can-use-console-password [boolean]

    Indicates if the user can log in to the console.

--can-use-customer-secret-keys [boolean]

    Indicates if the user can use SigV4 symmetric keys.

--can-use-o-auth2-client-credentials [boolean]

    Indicates if the user can use OAuth2 credentials and tokens.

--can-use-smtp-credentials [boolean]

    Indicates if the user can use SMTP passwords.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

--max-wait-seconds [integer]

    The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

--wait-for-state [text]

    This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

    Accepted values are:

    ACTIVE, CREATING, DELETED, DELETING, INACTIVE

--wait-interval-seconds [integer]

    Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

  update-user-state

  Description

Updates the state of the specified user.

  Usage

oci iam user update-user-state [OPTIONS]

  Required Parameters

--user-id [text]

    The OCID of the user.

  Optional Parameters

--blocked [boolean]

    Update state to blocked or unblocked. Only "false" is supported (for changing the state to unblocked).

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id --> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our "using CLI with advanced JSON options" link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--if-match [text]

    For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.

--max-wait-seconds [integer]

    The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

--wait-for-state [text]

    This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

    Accepted values are:

    ACTIVE, CREATING, DELETED, DELETING, INACTIVE

--wait-interval-seconds [integer]

    Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

  Global Parameters

Use oci --help for help on global parameters.

--auth, --cert-bundle, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --request-id, --version, -?, -d, -h, -v

AUTHOR
Oracle

COPYRIGHT
2016, 2020, Oracle