oz0 account groups

Usage and flags for oz0 account groups.

For: Operators and developers looking up a command.

Replace the person's groups at the provider with --group (repeat it; none clears them), and recompute the account's cluster role and memberships with the provider's group rules, the rules a sign-in through it applies. Memberships an owner set by hand stay and are listed. --version, a number that grows with each change at the provider, makes a retry or a late update change nothing.

Usage

oz0 account groups [flags]

Flags

FlagTypeDefaultDescription
--groupstringArraya group the person is in at the provider (repeat it)
--jsonboolprint JSON instead of a table
--providerstringthe identity provider's ID, as oidc list shows it
--subjectstringthe provider's immutable ID for the person (its sub)
--versionint0: apply whatever was set beforethe provider's version of the groups

Inherited flags

FlagTypeDefaultDescription
--contextstring$OZ0_CONTEXT or <config dir>/orchestrator-zero/context.jsonCLI context file written by server init
--log-levelstringinfolog level: debug, info, warn or error

See all oz0 commands and the global flags.

On this page
Copyright © 2026