User, session and organization administration on Clerk — look up and search users, inspect their email addresses, phone numbers, linked social accounts, passkeys and trusted devices, read and revoke active sessions, and remediate a compromised account by banning, locking, resetting multi-factor methods or clearing a password. Also manages organizations, their members and roles, invitations to an organization or to the application itself, organization domains, the allow and block lists that decide who may sign up, and read-only views of the sign-in configuration.
omni-cli clerk allowlist create
Allow an email address, phone number or wallet address to sign up.
write
omni-cli clerk allowlist delete
Remove an identifier from the allow-list, withdrawing its permission to sign up.
write
omni-cli clerk allowlist list
List the identifiers allowed to sign up, when the application restricts sign-ups to an allow-list.
read
omni-cli clerk blocklist create
Bar an email address, phone number or wallet address from signing up or signing in.
write
omni-cli clerk blocklist delete
Remove an identifier from the block-list, letting it sign in again.
write
omni-cli clerk blocklist list
List the identifiers barred from signing up or signing in.
read
omni-cli clerk invitation create
Invite someone to sign up for the application, emailing them a join link.
write
omni-cli clerk invitation list
List invitations to the application itself, filtered by state or email address.
read
omni-cli clerk invitation revoke
Revoke a pending application invitation so its join link stops working.
write
omni-cli clerk backup-code delete
Remove a user's backup codes so a fresh set can be issued.
write
omni-cli clerk external-account delete
Unlink a social account from a user, so that provider can no longer be used to sign in as them.
write
omni-cli clerk mfa delete
Turn off every multi-factor method on a user's account — use it to let someone back in after they lose all their factors.
write
omni-cli clerk passkey delete
Remove one passkey from a user's account.
write
omni-cli clerk totp delete
Remove a user's authenticator-app factor so they can enrol a new one.
write
omni-cli clerk trusted-device delete
Withdraw trust from one of a user's devices, so signing in from it faces the usual checks again.
write
omni-cli clerk trusted-device list
List the devices a user has marked as trusted, which skip extra checks at sign-in.
read
omni-cli clerk user remove-password
Remove a user's password so they sign in another way. Only possible when the instance offers another sign-in method.
write
omni-cli clerk user set-password-compromised
Mark a user's password as compromised, forcing them to choose a new one at their next sign-in.
write
omni-cli clerk user unset-password-compromised
Clear the compromised mark from a user's password.
write
omni-cli clerk client get
Show one browser or app, including the sessions started from it.
read
omni-cli clerk session get
Show one session, including which user it belongs to, when it was last active and when it expires.
read
omni-cli clerk session list
List a user's sessions, optionally narrowed to one browser or app or to a single state.
read
omni-cli clerk session revoke
End one session immediately, signing that browser or app out.
write
omni-cli clerk domain list
List the domains the application is served from, including any satellite domains.
read
omni-cli clerk instance get-communication
Show which countries are blocked from receiving verification messages.
read
omni-cli clerk instance get-oauth-settings
Show how the application registers and scopes third-party clients that sign users in.
read
omni-cli clerk instance get-organization-settings
Show whether organizations are turned on for the application, and the caps and defaults they use — the settings the organization actions depend on.
read
omni-cli clerk instance get-protect
Show which sign-up and sign-in abuse protections are turned on.
read
omni-cli clerk jwt-template list
List the token templates the application issues, with the claims each one carries.
read
omni-cli clerk redirect-url list
List the URLs the application is allowed to send people back to after they sign in.
read
omni-cli clerk email get
Show one email address, including whether it is verified and how it was verified.
read
omni-cli clerk phone get
Show one phone number, including whether it is verified and whether it serves as a second factor.
read
omni-cli clerk instance get
Show which instance the key opens, including whether it is a development or a production instance.
read
omni-cli clerk membership create
Add an existing user to an organization in the given role, without sending an invitation.
write
omni-cli clerk membership delete
Remove a member from an organization. The user account itself is untouched.
write
omni-cli clerk membership list
List every organization membership across the instance — who belongs to which organization, in what role.
read
omni-cli clerk membership list-by-org
List one organization's members, filtered by role, email address, name or activity.
read
omni-cli clerk membership update
Change a member's role in an organization.
write
omni-cli clerk org-domain create
Add a domain to an organization so people with an address there can join it.
write
omni-cli clerk org-domain delete
Remove a domain from an organization, so an address there no longer grants a way in.
write
omni-cli clerk org-domain list
List organization domains across the instance, filtered by verification state or how they enrol people.
read
omni-cli clerk org-domain list-by-org
List one organization's domains.
read
omni-cli clerk org-domain update
Change how an organization domain enrols people, or its verification state.
write
omni-cli clerk org-domain verify
Mark an organization domain's ownership as verified.
write
omni-cli clerk org-invitation create
Invite someone to join an organization in the given role, emailing them a join link.
write
omni-cli clerk org-invitation get
Show one organization invitation, including its state and expiry.
read
omni-cli clerk org-invitation list
List organization invitations across the instance, filtered by state or invitee email address.
read
omni-cli clerk org-invitation list-by-org
List one organization's invitations, filtered by state or invitee email address.
read
omni-cli clerk org-invitation revoke
Revoke a pending organization invitation so its join link stops working.
write
omni-cli clerk organization create
Create an organization and make a user its first administrator.
write
omni-cli clerk organization delete
Delete an organization permanently, along with its memberships, invitations and domains.
write
omni-cli clerk organization get
Show one organization, including its member count and membership cap.
read
omni-cli clerk organization list
List and search organizations by name, slug or member (discovers the organization id the membership, invitation and domain actions need).
read
omni-cli clerk organization update
Rename an organization, change its slug or membership cap, or allow its administrators to delete it.
write
omni-cli clerk organization update-metadata
Merge your own data into an organization's metadata, leaving keys you do not mention untouched.
write
omni-cli clerk user ban
Ban a user — their active sessions are revoked and they cannot sign in again until they are unbanned.
write
omni-cli clerk user count
Count the users matching a filter — the companion total for paging through user.list.
read
omni-cli clerk user create
Create a user with the given email addresses, phone numbers, username and profile details.
write
omni-cli clerk user delete
Delete a user permanently, along with their identifiers, linked accounts and sessions.
write
omni-cli clerk user get
Show one user in full — identifiers, verification state, linked social accounts, passkeys, multi-factor methods, organization memberships, and whether the account is banned or locked.
read
omni-cli clerk user list
Search and list users by email address, phone number, username, name, sign-up or activity date, or banned state (discovers the user id every other user action needs).
read
omni-cli clerk user list-invitations
List the organization invitations sent to a user, filtered by whether they are still pending, accepted, revoked or expired.
read
omni-cli clerk user list-memberships
List the organizations a user belongs to, with the role held in each.
read
omni-cli clerk user lock
Lock a user out of signing in. Unlike a ban, a lock expires on its own when the instance sets a lockout duration.
write
omni-cli clerk user unban
Lift a ban so the user can sign in again.
write
omni-cli clerk user unlock
Clear a lock and the failed-attempt count so the user can sign in again.
write
omni-cli clerk user update
Update a user's profile details, primary identifiers and self-service permissions. Setting a password is deliberately not supported here — create a user with one, or have the person reset it themselves.
write
omni-cli clerk user update-metadata
Merge your own data into a user's metadata, leaving keys you do not mention untouched.
write
Read this catalog as markdown — the copy your coding agent fetches.
Sign up, choose the actions your workflow needs, and get a copy-paste install one-liner.