Pages in Reference

noust user

Manage the accounts that sign in to the console, each with its roles.

Reference Updated 29 October 2026 View as Markdown

Shell

noust user [OPTIONS] COMMAND [ARGS]...

Subcommands: create, disable, enable, exception, invite, list, remove, reset-mfa, roles, set-email, set-role, unlock

noust user create

Create an account with a password, typed at a hidden prompt.

Shell

noust user create [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--role`	A role of the account (repeat for several; the first is the one it is known by). 'noust access role list' lists them.
`--display-name`	How the console greets them.
`--person-ref`	Who the account belongs to (an e-mail), for separation of duties.
`--stdin`	Read the password from standard input.
`--team`	Put the account in this team instead of the default one.
`--team-role`	Its role in --team (viewer when omitted).
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user disable

Disable an account: its sessions and tokens stop working at once.

Shell

noust user disable [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--reason`	Why, for the record.

noust user enable

Enable a disabled account again.

Shell

noust user enable [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user exception

Documented exceptions to the separation of duties, with a reason and an end.

Shell

noust user exception [OPTIONS] COMMAND [ARGS]...

Subcommands: add, list, revoke

noust user exception add

Let PERSON_REF hold incompatible roles, for a documented reason and a time.

Shell

noust user exception add [OPTIONS] PERSON_REF

Arguments: person_ref

Option	What it does	Default
`--reason`	Why; what an auditor reads.
`--days`	How long it applies.	`90`

noust user exception list

List every separation-of-duties exception ever recorded.

Shell

noust user exception list [OPTIONS]

Option	What it does	Default
`--json`	Print the exceptions as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user exception revoke

Withdraw an exception before it runs out.

Shell

noust user exception revoke [OPTIONS] EXCEPTION_ID

Arguments: exception_id

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user invite

Invite a person: they set their own password and authenticator.

Shell

noust user invite [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--role`	Role of a new account (repeat for several; the first is the one it is known by).
`--display-name`	Display name of a new account.
`--person-ref`	Person reference of a new account.
`--expires-hours`	How long the invitation code is valid.	`24`
`--team`	Invite them into this team only, instead of the default one (a new account).
`--team-role`	Their role in --team (viewer when omitted).
`--email`	Mail the invitation to this address, which is also who the person is. Needs mail set up and web.public_url; without them the invitation is still made and the code is yours to hand over.
`--json`	Print the account, the code and whether it was mailed as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user list

List every account, its roles, status and last sign-in.

Shell

noust user list [OPTIONS]

Option	What it does	Default
`--json`	Print the accounts as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user remove

Remove an account. Prefer 'disable': a removed account's name in the audit log no longer names a record.

Shell

noust user remove [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`-f`, `--force`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user reset-mfa

Remove an account's authenticator; it enrols a new one at its next sign-in.

Shell

noust user reset-mfa [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user roles

Set every role an account holds; what it may do is what they hold together.

Shell

noust user roles [OPTIONS] USERNAME ROLES...

Arguments: username, roles

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user set-email

Set the address an account's invitations and password resets are mailed to.

Shell

noust user set-email [OPTIONS] USERNAME [ADDRESS]

Arguments: username, address

Option	What it does	Default
`--json`	Print the account as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user set-role

Change the role an account is known by, leaving the others it holds.

Shell

noust user set-role [OPTIONS] USERNAME ROLE

Arguments: username, role

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust user unlock

Lift an account's lockout before it runs out.

Shell

noust user unlock [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Something on this page is wrong or unclear? Report it on GitHub.

Help, contributing and the project’s policies are under Project.