# kindgi people > The tenant's people: add one, send their invitation again, list, get, their grants, tenant admin given or taken (grant / ungrant), their second factor (read, or reset for a lost phone), and remove one ## `kindgi people` **Synopsis** ```sh signature kindgi people ``` The tenant's people: add one, send their invitation again, list, get, their grants, tenant admin given or taken (grant / ungrant), their second factor (read, or reset for a lost phone), and remove one. **Commands** | Command | Description | | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`kindgi people add`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-add) | Add a person to the tenant; prints their id. | | [`kindgi people invite`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-invite) | Send a person's invitation again, for one who hasn't signed in yet: it gets a new expiry, and is emailed where the deployment sends email (it says whether it was). | | [`kindgi people list`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-list) | List the tenant's people; `--query` matches the start of a name, `--pending` keeps the people invited who haven't signed in yet (STATE: pending or expired). | | [`kindgi people get`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-get) | One person, by id. | | [`kindgi people grants`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-grants) | What a person may do, as granted directly: tenant admin, tenant member (reads the tenant's settings), project and team roles, the reviewer roster. | | [`kindgi people grant`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-grant) | Make a person a tenant admin, before it answers: their next request holds it. | | [`kindgi people ungrant`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-ungrant) | Remove tenant admin from a person. | | [`kindgi people second-factor`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-second-factor) | Whether a person has a second factor set up (an authenticator app), since when, how many recovery codes they have left, and whether the workspace requires one. | | [`kindgi people reset-second-factor`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-reset-second-factor) | Remove a person's second factor, for a lost phone or lost recovery codes: they're told by email where the deployment sends it, and it's audited. | | [`kindgi people remove`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people-remove) | Remove a person from the tenant: every API key and session of theirs is revoked, and every role and membership taken away, before it answers (their keys get 401 at once). | **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [Turn on sign-in](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/sign-in.md) ### `kindgi people add` **Synopsis** ```sh signature kindgi people add --name= [--email=] [--no-invite] ``` Add a person to the tenant; prints their id. They can read the tenant's settings at once; give them a project role to work on its agents and runs, and their first key (`kindgi tokens create --for=user:`). Where the runtime invites people, one added with an email is invited, and the invitation emailed unless `--no-invite`; it says whether it was. Tenant admins only. **Options** | Option | Default | Description | | ----------------- | -------- | ----------------------------------------------------------------- | | `--email ` | none | Their email; unique among the tenant's people. | | `--name ` | required | Their name, as people see it. | | `--no-invite` | off | Don't email the invitation: you tell them. They're still invited. | Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** Add a person and email them their invitation. ```sh kindgi people add --name="Sam Lee" --email=sam@acme.example ``` Add a person without emailing the invitation: you tell them. ```sh kindgi people add --name="Sam Lee" --email=sam@acme.example --no-invite ``` From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md): ```sh npx --yes @kindgi/cli@0.1 people add --name="Sam Rivera" --email=sam@acme.example ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people invite` **Synopsis** ```sh signature kindgi people invite ``` Send a person's invitation again, for one who hasn't signed in yet: it gets a new expiry, and is emailed where the deployment sends email (it says whether it was). Refused for someone who has joined or was never invited. Tenant admins only. **Options** Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** Send a person's invitation again, with a new expiry. ```sh kindgi people invite ``` From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md): ```sh npx --yes @kindgi/cli@0.1 people invite ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people list` **Synopsis** ```sh signature kindgi people list [--query=] [--pending] [--include-removed] [--limit=] [--cursor=] [--table] ``` List the tenant's people; `--query` matches the start of a name, `--pending` keeps the people invited who haven't signed in yet (STATE: pending or expired). People who were removed are left out unless `--include-removed`. **Options** | Option | Default | Description | | ------------------- | -------------------- | ------------------------------------------------------------- | | `--cursor ` | none | The next page, from `nextCursor`. | | `--include-removed` | off | People who were removed too, with when (`unregisteredAt`). | | `--limit ` | `25` (at most `100`) | Page size. | | `--pending` | off | Only the people invited who haven't signed in yet (`invite`). | | `--query ` | none | Only names starting with this. | Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** Find people whose name starts with Sam. ```sh kindgi people list --query=Sam ``` List the people invited who haven't signed in yet. ```sh kindgi people list --pending --table ``` List everyone, removed people too, as a table. ```sh kindgi people list --include-removed --table ``` From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md): ```sh npx --yes @kindgi/cli@0.1 people list --pending --table ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people get` **Synopsis** ```sh signature kindgi people get ``` One person, by id. **Options** Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** Show one person. ```sh kindgi people get ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [Turn on sign-in](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/sign-in.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people grants` **Synopsis** ```sh signature kindgi people grants [--table] ``` What a person may do, as granted directly: tenant admin, tenant member (reads the tenant's settings), project and team roles, the reviewer roster. A tenant admin reads anyone's; anyone else only their own. **Options** Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** Show what a person may do, as a table. ```sh kindgi people grants --table ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [Turn on sign-in](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/sign-in.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people grant` **Synopsis** ```sh signature kindgi people grant --tenant-admin ``` Make a person a tenant admin, before it answers: their next request holds it. Tenant admins only. **Options** | Option | Default | Description | | ---------------- | ------- | ------------- | | `--tenant-admin` | off | Tenant admin. | Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md): ```sh npx --yes @kindgi/cli@0.1 people grant --tenant-admin ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people ungrant` **Synopsis** ```sh signature kindgi people ungrant --tenant-admin ``` Remove tenant admin from a person. Refused for the only person who holds it (make someone else one first) and for the seed user (unset KINDGI_SEED_USER_ID and restart the runtime first). Tenant admins only. **Options** | Option | Default | Description | | ---------------- | ------- | ------------- | | `--tenant-admin` | off | Tenant admin. | Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md): ```sh npx --yes @kindgi/cli@0.1 people ungrant --tenant-admin ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people second-factor` **Synopsis** ```sh signature kindgi people second-factor ``` Whether a person has a second factor set up (an authenticator app), since when, how many recovery codes they have left, and whether the workspace requires one. Tenant admins only. **Options** Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** See whether a person has a second factor set up, and how many recovery codes are left. ```sh kindgi people second-factor ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [Turn on sign-in](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/sign-in.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people reset-second-factor` **Synopsis** ```sh signature kindgi people reset-second-factor ``` Remove a person's second factor, for a lost phone or lost recovery codes: they're told by email where the deployment sends it, and it's audited. Their sessions stay. Where the workspace requires one, they set one up again at their next sign-in. Tenant admins only, for anyone but themselves: your own you take off on My access, with a code from it. **Options** Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** Remove the second factor of a person who lost their phone: they set one up again at their next sign-in. ```sh kindgi people reset-second-factor ``` From [Turn on sign-in](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/sign-in.md): ```sh npx --yes @kindgi/cli@0.1 people reset-second-factor ``` **See also** - [Turn on sign-in](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/sign-in.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people) ### `kindgi people remove` **Synopsis** ```sh signature kindgi people remove ``` Remove a person from the tenant: every API key and session of theirs is revoked, and every role and membership taken away, before it answers (their keys get 401 at once). Their record stays, so their history still says who they were; their email is free again (adding it makes a new person). Refused for yourself, the seed user and the only tenant admin. Tenant admins only. **Options** Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md): ```sh npx --yes @kindgi/cli@0.1 people remove ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.9/deploy/people-and-keys.md) - [`kindgi people`](https://docs.kindgi.com/v0.1.9/reference/cli/people.md#kindgi-people)