# noust user

Manage the accounts that sign in to the console, each with its roles.

```bash
noust user [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`create`](#noust-user-create), [`disable`](#noust-user-disable), [`enable`](#noust-user-enable), [`exception`](#noust-user-exception), [`invite`](#noust-user-invite), [`list`](#noust-user-list), [`remove`](#noust-user-remove), [`reset-mfa`](#noust-user-reset-mfa), [`roles`](#noust-user-roles), [`set-email`](#noust-user-set-email), [`set-role`](#noust-user-set-role), [`unlock`](#noust-user-unlock)

## noust user create

Create an account with a password, typed at a hidden prompt.

```bash
noust user create [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--role` | A role of the account (repeat for several; the first is the one it is known by). 'noust access role list' lists them. |  |
| `--display-name` | How the console greets them. |  |
| `--person-ref` | Who the account belongs to (an e-mail), for separation of duties. |  |
| `--stdin` | Read the password from standard input. |  |
| `--team` | Put the account in this team instead of the default one. |  |
| `--team-role` | Its role in --team (viewer when omitted). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user disable

Disable an account: its sessions and tokens stop working at once.

```bash
noust user disable [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why, for the record. |  |

## noust user enable

Enable a disabled account again.

```bash
noust user enable [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user exception

Documented exceptions to the separation of duties, with a reason and an end.

```bash
noust user exception [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-user-exception-add), [`list`](#noust-user-exception-list), [`revoke`](#noust-user-exception-revoke)

## noust user exception add

Let PERSON_REF hold incompatible roles, for a documented reason and a time.

```bash
noust user exception add [OPTIONS] PERSON_REF
```

Arguments: `person_ref`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why; what an auditor reads. |  |
| `--days` | How long it applies. | `90` |

## noust user exception list

List every separation-of-duties exception ever recorded.

```bash
noust user exception list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the exceptions as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user exception revoke

Withdraw an exception before it runs out.

```bash
noust user exception revoke [OPTIONS] EXCEPTION_ID
```

Arguments: `exception_id`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user invite

Invite a person: they set their own password and authenticator.

```bash
noust user invite [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--role` | Role of a new account (repeat for several; the first is the one it is known by). |  |
| `--display-name` | Display name of a new account. |  |
| `--person-ref` | Person reference of a new account. |  |
| `--expires-hours` | How long the invitation code is valid. | `24` |
| `--team` | Invite them into this team only, instead of the default one (a new account). |  |
| `--team-role` | Their role in --team (viewer when omitted). |  |
| `--email` | Mail the invitation to this address, which is also who the person is. Needs mail set up and web.public_url; without them the invitation is still made and the code is yours to hand over. |  |
| `--json` | Print the account, the code and whether it was mailed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user list

List every account, its roles, status and last sign-in.

```bash
noust user list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the accounts as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user remove

Remove an account. Prefer 'disable': a removed account's name in the audit log no longer names a record.

```bash
noust user remove [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user reset-mfa

Remove an account's authenticator; it enrols a new one at its next sign-in.

```bash
noust user reset-mfa [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user roles

Set every role an account holds; what it may do is what they hold together.

```bash
noust user roles [OPTIONS] USERNAME ROLES...
```

Arguments: `username`, `roles`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user set-email

Set the address an account's invitations and password resets are mailed to.

```bash
noust user set-email [OPTIONS] USERNAME [ADDRESS]
```

Arguments: `username`, `address`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the account as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user set-role

Change the role an account is known by, leaving the others it holds.

```bash
noust user set-role [OPTIONS] USERNAME ROLE
```

Arguments: `username`, `role`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust user unlock

Lift an account's lockout before it runs out.

```bash
noust user unlock [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |