# Clerk

User, session and organization administration on Clerk — look up and search users, inspect their email addresses, phone numbers, linked social accounts, passkeys and trusted devices, read and revoke active sessions, and remediate a compromised account by banning, locking, resetting multi-factor methods or clearing a password. Also manages organizations, their members and roles, invitations to an organization or to the application itself, organization domains, the allow and block lists that decide who may sign up, and read-only views of the sign-in configuration.

Run these through `omni-cli` once a human has connected the platform (`omni-cli clerk login`). Full parameter and output schemas come from `omni-cli discovery clerk`.

## access

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk allowlist create` | Allow an email address, phone number or wallet address to sign up. | write |
| `omni-cli clerk allowlist delete` | Remove an identifier from the allow-list, withdrawing its permission to sign up. | write |
| `omni-cli clerk allowlist list` | List the identifiers allowed to sign up, when the application restricts sign-ups to an allow-list. | read |
| `omni-cli clerk blocklist create` | Bar an email address, phone number or wallet address from signing up or signing in. | write |
| `omni-cli clerk blocklist delete` | Remove an identifier from the block-list, letting it sign in again. | write |
| `omni-cli clerk blocklist list` | List the identifiers barred from signing up or signing in. | read |
| `omni-cli clerk invitation create` | Invite someone to sign up for the application, emailing them a join link. | write |
| `omni-cli clerk invitation list` | List invitations to the application itself, filtered by state or email address. | read |
| `omni-cli clerk invitation revoke` | Revoke a pending application invitation so its join link stops working. | write |

## credentials

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk backup-code delete` | Remove a user's backup codes so a fresh set can be issued. | write |
| `omni-cli clerk external-account delete` | Unlink a social account from a user, so that provider can no longer be used to sign in as them. | write |
| `omni-cli clerk mfa delete` | Turn off every multi-factor method on a user's account — use it to let someone back in after they lose all their factors. | write |
| `omni-cli clerk passkey delete` | Remove one passkey from a user's account. | write |
| `omni-cli clerk totp delete` | Remove a user's authenticator-app factor so they can enrol a new one. | write |
| `omni-cli clerk trusted-device delete` | Withdraw trust from one of a user's devices, so signing in from it faces the usual checks again. | write |
| `omni-cli clerk trusted-device list` | List the devices a user has marked as trusted, which skip extra checks at sign-in. | read |
| `omni-cli clerk user remove-password` | Remove a user's password so they sign in another way. Only possible when the instance offers another sign-in method. | write |
| `omni-cli clerk user set-password-compromised` | Mark a user's password as compromised, forcing them to choose a new one at their next sign-in. | write |
| `omni-cli clerk user unset-password-compromised` | Clear the compromised mark from a user's password. | write |

## sessions

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk client get` | Show one browser or app, including the sessions started from it. | read |
| `omni-cli clerk session get` | Show one session, including which user it belongs to, when it was last active and when it expires. | read |
| `omni-cli clerk session list` | List a user's sessions, optionally narrowed to one browser or app or to a single state. | read |
| `omni-cli clerk session revoke` | End one session immediately, signing that browser or app out. | write |

## configuration

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk domain list` | List the domains the application is served from, including any satellite domains. | read |
| `omni-cli clerk instance get-communication` | Show which countries are blocked from receiving verification messages. | read |
| `omni-cli clerk instance get-oauth-settings` | Show how the application registers and scopes third-party clients that sign users in. | read |
| `omni-cli clerk instance get-organization-settings` | Show whether organizations are turned on for the application, and the caps and defaults they use — the settings the organization actions depend on. | read |
| `omni-cli clerk instance get-protect` | Show which sign-up and sign-in abuse protections are turned on. | read |
| `omni-cli clerk jwt-template list` | List the token templates the application issues, with the claims each one carries. | read |
| `omni-cli clerk redirect-url list` | List the URLs the application is allowed to send people back to after they sign in. | read |

## identifiers

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk email get` | Show one email address, including whether it is verified and how it was verified. | read |
| `omni-cli clerk phone get` | Show one phone number, including whether it is verified and whether it serves as a second factor. | read |

## discovery

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk instance get` | Show which instance the key opens, including whether it is a development or a production instance. | read |

## organizations

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk membership create` | Add an existing user to an organization in the given role, without sending an invitation. | write |
| `omni-cli clerk membership delete` | Remove a member from an organization. The user account itself is untouched. | write |
| `omni-cli clerk membership list` | List every organization membership across the instance — who belongs to which organization, in what role. | read |
| `omni-cli clerk membership list-by-org` | List one organization's members, filtered by role, email address, name or activity. | read |
| `omni-cli clerk membership update` | Change a member's role in an organization. | write |
| `omni-cli clerk org-domain create` | Add a domain to an organization so people with an address there can join it. | write |
| `omni-cli clerk org-domain delete` | Remove a domain from an organization, so an address there no longer grants a way in. | write |
| `omni-cli clerk org-domain list` | List organization domains across the instance, filtered by verification state or how they enrol people. | read |
| `omni-cli clerk org-domain list-by-org` | List one organization's domains. | read |
| `omni-cli clerk org-domain update` | Change how an organization domain enrols people, or its verification state. | write |
| `omni-cli clerk org-domain verify` | Mark an organization domain's ownership as verified. | write |
| `omni-cli clerk org-invitation create` | Invite someone to join an organization in the given role, emailing them a join link. | write |
| `omni-cli clerk org-invitation get` | Show one organization invitation, including its state and expiry. | read |
| `omni-cli clerk org-invitation list` | List organization invitations across the instance, filtered by state or invitee email address. | read |
| `omni-cli clerk org-invitation list-by-org` | List one organization's invitations, filtered by state or invitee email address. | read |
| `omni-cli clerk org-invitation revoke` | Revoke a pending organization invitation so its join link stops working. | write |
| `omni-cli clerk organization create` | Create an organization and make a user its first administrator. | write |
| `omni-cli clerk organization delete` | Delete an organization permanently, along with its memberships, invitations and domains. | write |
| `omni-cli clerk organization get` | Show one organization, including its member count and membership cap. | read |
| `omni-cli clerk organization list` | List and search organizations by name, slug or member (discovers the organization id the membership, invitation and domain actions need). | read |
| `omni-cli clerk organization update` | Rename an organization, change its slug or membership cap, or allow its administrators to delete it. | write |
| `omni-cli clerk organization update-metadata` | Merge your own data into an organization's metadata, leaving keys you do not mention untouched. | write |

## users

| Command | What it does | Kind |
|---|---|---|
| `omni-cli clerk user ban` | Ban a user — their active sessions are revoked and they cannot sign in again until they are unbanned. | write |
| `omni-cli clerk user count` | Count the users matching a filter — the companion total for paging through user.list. | read |
| `omni-cli clerk user create` | Create a user with the given email addresses, phone numbers, username and profile details. | write |
| `omni-cli clerk user delete` | Delete a user permanently, along with their identifiers, linked accounts and sessions. | write |
| `omni-cli clerk user get` | Show one user in full — identifiers, verification state, linked social accounts, passkeys, multi-factor methods, organization memberships, and whether the account is banned or locked. | read |
| `omni-cli clerk user list` | Search and list users by email address, phone number, username, name, sign-up or activity date, or banned state (discovers the user id every other user action needs). | read |
| `omni-cli clerk user list-invitations` | List the organization invitations sent to a user, filtered by whether they are still pending, accepted, revoked or expired. | read |
| `omni-cli clerk user list-memberships` | List the organizations a user belongs to, with the role held in each. | read |
| `omni-cli clerk user lock` | Lock a user out of signing in. Unlike a ban, a lock expires on its own when the instance sets a lockout duration. | write |
| `omni-cli clerk user unban` | Lift a ban so the user can sign in again. | write |
| `omni-cli clerk user unlock` | Clear a lock and the failed-attempt count so the user can sign in again. | write |
| `omni-cli clerk user update` | Update a user's profile details, primary identifiers and self-service permissions. Setting a password is deliberately not supported here — create a user with one, or have the person reset it themselves. | write |
| `omni-cli clerk user update-metadata` | Merge your own data into a user's metadata, leaving keys you do not mention untouched. | write |