Skip to main content

​
Users

Listing users and groups needs the Admin or Analytics Viewer role. Creating, updating or deleting a group needs Admin — an Analytics Viewer gets Admin access required back instead. Roles are assigned in the dashboard, not from the CLI. users effective-policies <id> also works for a Manager (for themselves and anyone who reports to them) and for a Member (for themselves); user-groups effective-policies is Admin or Analytics Viewer only.

​
User groups

Groups let you scope policies to specific teams or roles. Policy changes apply automatically to all group members.

​
Membership flags on create / update

create and update accept the same membership flags:
create includes the whole organization by default. On create, --user-ids only takes effect alongside --no-all-org-users — pass it on its own and you get an org-wide group, with the IDs ignored. Scope a policy to that group and the policy applies to everyone. update has no such default.
A group synced from your directory cannot be renamed, re-membered or deleted here; change it in the directory. create also fails if the name is already taken.

​
Tool connections

View which AI tools are connected to Unbound, and manage approved tool types. Admins and Analytics Viewers see everyone; other roles see only themselves. --json also lists every tool per person (connected_tools). tools connect is open to every role and returns the caller’s own key; tools approved needs Admin or Analytics Viewer.
You get one API key per person, not one per tool — connecting a second tool type returns the same key. If your organization restricts tools to an approved list, connect is refused for anything not on it; unbound tools approved shows the list and whether the restriction is switched on.
unbound tools connect <TOOL_TYPE> prints your API key in plaintext. Treat that output as a secret and redact it before pasting it into a ticket or a chat.Re-running connect returns the same key — it does not rotate. If a key is exposed, rotate it from the dashboard’s Configure → Rotate API Keys dialog, which invalidates the member’s existing key immediately. There is no CLI path for it.
Tool types connect accepts: CLAUDE_CODE, CURSOR, COPILOT, AUGMENT_CODE, ROO_CODE, CLINE, GEMINI_CLI, CODEX, KILO_CODE, CUSTOM_ACCESS.
users list, users effective-policies, user-groups list, user-groups get, user-groups effective-policies, tools list, tools connect and tools approved support --json. user-groups create, update and delete don’t.