Identity & Access CLI Reference

openstack project list
openstack project list --domain Default

openstack project create \
  --domain Default \
  --description "Production workloads" \
  my-project

openstack project show my-project

openstack project set my-project --name new-project-name

openstack project set --enable my-project
openstack project set --disable my-project

openstack project delete my-project

openstack user list
openstack user list --domain Default

openstack user create \
  --domain Default \
  --password-prompt \
  --email user@example.com \
  john.doe

openstack user create \
  --project my-project \
  --password PASSWORD \
  john.doe

openstack user show john.doe

openstack user set john.doe \
  --name john.smith \
  --email john.smith@example.com

openstack user set --password-prompt john.doe

openstack user set --enable john.doe
openstack user set --disable john.doe

openstack user delete john.doe

openstack role list

openstack role show member

openstack role create network-operator

openstack role create --domain my-domain billing-reader

openstack role delete network-operator

openstack role add \
  --user john.doe \
  --project my-project \
  member

openstack role add \
  --user john.doe \
  --domain my-domain \
  member

openstack role add \
  --group operators \
  --project my-project \
  member

openstack role assignment list --names

openstack role assignment list \
  --user john.doe \
  --names

openstack role assignment list \
  --project my-project \
  --names

openstack role remove \
  --user john.doe \
  --project my-project \
  member

openstack role remove \
  --group operators \
  --project my-project \
  member

openstack implied role create admin --implied-role member

openstack implied role list

openstack implied role delete admin --implied-role member

openstack domain list

openstack domain create \
  --description "Engineering department" \
  engineering

openstack domain show engineering

openstack domain set --enable engineering
openstack domain set --disable engineering

openstack domain delete engineering

openstack group list

openstack group create \
  --domain Default \
  --description "Cloud operators" \
  operators

openstack group add user operators john.doe

openstack group contains user operators john.doe

openstack group list --user john.doe

openstack group remove user operators john.doe

openstack group delete operators

openstack application credential list

openstack application credential create \
  --role member \
  --description "CI/CD pipeline credential" \
  ci-pipeline

openstack application credential create \
  --role member \
  --expiration "2026-12-31T00:00:00" \
  temp-credential

openstack application credential create \
  --role member \
  --access-rules '[{"service": "compute", "method": "GET", "path": "/v2.1/servers"}]' \
  readonly-compute

openstack application credential show ci-pipeline

openstack application credential delete ci-pipeline

openstack token issue

openstack token issue \
  --os-project-name my-project \
  --os-domain-name Default

openstack token revoke <token-id>

openstack endpoint list

openstack endpoint list --interface public

openstack endpoint show <endpoint-id>

openstack service list