# keystone.api.users module

class keystone.api.users.OAuth1AccessTokenCRUDResource

  Bases: `_OAuth1ResourceBase`

  delete(user_id, access_token_id)

    Delete specific access token.

    DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}

  get(user_id, access_token_id)

    Get specific access token.

    GET/HEAD /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}

  methods: ClassVar[Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.OAuth1AccessTokenRoleListResource

  Bases: `ResourceBase`

  collection_key: str = 'roles'
  get(user_id, access_token_id)

    List roles for a user access token.

    GET/HEAD /v3/users/{user_id}/OS-OAUTH1/access_tokens/

      {access_token_id}/roles

  member_key: str = 'role'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.OAuth1AccessTokenRoleResource

  Bases: `ResourceBase`

  collection_key: str = 'roles'
  get(user_id, access_token_id, role_id)

    Get role for access token.

    GET/HEAD /v3/users/{user_id}/OS-OAUTH1/access_tokens/

      {access_token_id}/roles/{role_id}

  member_key: str = 'role'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.OAuth1ListAccessTokensResource

  Bases: `_OAuth1ResourceBase`

  get(user_id)

    List OAuth1 Access Tokens for user.

    GET /v3/users/{user_id}/OS-OAUTH1/access_tokens

  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAPI(blueprint_url_prefix='', api_url_prefix='', default_mediatype='application/json', decorators=None, errors=None)

  Bases: `APIBase`

  resource_mapping = [(<class 'keystone.api.users.UsersResource'>, '/users', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/users', 'stable', {})), (<class 'keystone.api.users.UserResource'>, '/users/<string:user_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserChangePasswordResource'>, '/users/<string:user_id>/password', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_change_password', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserGroupsResource'>, '/users/<string:user_id>/groups', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_groups', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserProjectsResource'>, '/users/<string:user_id>/projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_projects', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserOSEC2CredentialsResourceListCreate'>, '/users/<string:user_id>/credentials/OS-EC2', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-EC2/1.0/rel/user_credentials', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserOSEC2CredentialsResourceGetDelete'>, '/users/<string:user_id>/credentials/OS-EC2/<string:credential_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-EC2/1.0/rel/user_credential', 'stable', {'credential_id': 'https://docs.openstack.org/api/openstack-identity/3/param/credential_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1ListAccessTokensResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_tokens', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1AccessTokenCRUDResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens/<string:access_token_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_token', 'stable', {'access_token_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/param/access_token_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1AccessTokenRoleListResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens/<string:access_token_id>/roles', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_token_roles', 'stable', {'access_token_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/param/access_token_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1AccessTokenRoleResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens/<string:access_token_id>/roles/<string:role_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_token_role', 'stable', {'access_token_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/param/access_token_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAppCredListCreateResource'>, '/users/<string:user_id>/application_credentials', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/application_credentials', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAppCredGetDeleteResource'>, '/users/<string:user_id>/application_credentials/<string:application_credential_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/application_credential', 'stable', {'application_credential_id': 'https://docs.openstack.org/api/openstack-identity/3/param/application_credential_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAccessRuleListResource'>, '/users/<string:user_id>/access_rules', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/access_rules', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAccessRuleGetDeleteResource'>, '/users/<string:user_id>/access_rules/<string:access_rule_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/access_rule', 'stable', {'access_rule_id': 'https://docs.openstack.org/api/openstack-identity/3/param/access_rule_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserTokensResource'>, '/users/<string:user_id>/tokens', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_tokens', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'}))]

class keystone.api.users.UserAccessRuleGetDeleteResource

  Bases: `ResourceBase`

  collection_key: str = 'access_rules'
  delete(user_id, access_rule_id)

    Delete access rule resource.

    DELETE /v3/users/{user_id}/access_rules/{access_rule_id}

  get(user_id, access_rule_id)

    Get access rule resource.

    GET/HEAD /v3/users/{user_id}/access_rules/{access_rule_id}

  member_key: str = 'access_rule'
  methods: ClassVar[Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAccessRuleListResource

  Bases: `ResourceBase`

  collection_key: str = 'access_rules'
  get(user_id)

    List access rules for user.

    GET/HEAD /v3/users/{user_id}/access_rules

  member_key: str = 'access_rule'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAppCredGetDeleteResource

  Bases: `ResourceBase`

  collection_key: str = 'application_credentials'
  delete(user_id, application_credential_id)

    Delete application credential resource.

    DELETE /v3/users/{user_id}/application_credentials/

      {application_credential_id}

  get(user_id, application_credential_id)

    Get application credential resource.

    GET/HEAD /v3/users/{user_id}/application_credentials/

      {application_credential_id}

  member_key: str = 'application_credential'
  methods: ClassVar[Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAppCredListCreateResource

  Bases: `ResourceBase`

  collection_key: str = 'application_credentials'
  get(user_id)

    List application credentials for user.

    GET/HEAD /v3/users/{user_id}/application_credentials

  member_key: str = 'application_credential'
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(user_id)

    Create application credential.

    POST /v3/users/{user_id}/application_credentials

class keystone.api.users.UserChangePasswordResource

  Bases: `ResourceBase`

  get(user_id)
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(user_id)

class keystone.api.users.UserGroupsResource

  Bases: `ResourceBase`

  collection_key: str = 'groups'
  get(user_id)

    Get groups for a user.

    GET/HEAD /v3/users/{user_id}/groups

  get_member_from_driver
  member_key: str = 'group'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserOSEC2CredentialsResourceGetDelete

  Bases: `_UserOSEC2CredBaseResource`

  delete(user_id, credential_id)

    Delete a specific EC2 credential.

    DELETE /users/{user_id}/credentials/OS-EC2/{credential_id}

  get(user_id, credential_id)

    Get a specific EC2 credential.

    GET/HEAD /users/{user_id}/credentials/OS-EC2/{credential_id}

  methods: ClassVar[Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserOSEC2CredentialsResourceListCreate

  Bases: `_UserOSEC2CredBaseResource`

  get(user_id)

    List EC2 Credentials for user.

    GET/HEAD /v3/users/{user_id}/credentials/OS-EC2

  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(user_id)

    Create EC2 Credential for user.

    POST /v3/users/{user_id}/credentials/OS-EC2

class keystone.api.users.UserProjectsResource

  Bases: `ResourceBase`

  collection_key: str = 'projects'
  get(user_id)
  get_member_from_driver
  member_key: str = 'project'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserResource

  Bases: `ResourceBase`

  collection_key: str = 'users'
  delete(user_id: str)

    Delete a user.

    DELETE /v3/users/{user_id}

  get(user_id: str)

    Get a user resource.

    GET/HEAD /v3/users/{user_id}

  get_member_from_driver
  member_key: str = 'user'
  methods: ClassVar[Collection[str] | None] = {'DELETE', 'GET', 'PATCH'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  patch(user_id: str)

    Update a user.

    PATCH /v3/users/{user_id}

class keystone.api.users.UserTokensResource

  Bases: `ResourceBase`

  collection_key: str = 'tokens'
  delete(user_id)

    Revoke all tokens for a user.

    DELETE /v3/users/{user_id}/tokens

    Revokes every token issued for the given user by creating a revocation event scoped to user_id. This is the self-service remedy for users who cannot change their password (LDAP, federated, OIDC) and need to invalidate all active sessions.

    Users may revoke their own tokens. Admins may revoke tokens for any user.

  member_key: str = 'token'
  methods: ClassVar[Collection[str] | None] = {'DELETE'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UsersResource

  Bases: `ResourceBase`

  collection_key: str = 'users'
  get()

    List users.

    GET/HEAD /v3/users

  get_member_from_driver
  member_key: str = 'user'
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post()

    Create a user.

    POST /v3/users

this page last updated: 2026-08-17 12:45:24

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug