# keystone.api.users module

class keystone.api.users.OAuth1AccessTokenCRUDResource

  Bases: `_OAuth1ResourceBase`

  delete(user_id, access_token_id)

    Delete specific access token.

    DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}

  get(user_id, access_token_id)

    Get specific access token.

    GET/HEAD /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.OAuth1AccessTokenRoleListResource

  Bases: `ResourceBase`

  collection_key: str = 'roles'
  get(user_id, access_token_id)

    List roles for a user access token.

    GET/HEAD /v3/users/{user_id}/OS-OAUTH1/access_tokens/

      {access_token_id}/roles

  member_key: str = 'role'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.OAuth1AccessTokenRoleResource

  Bases: `ResourceBase`

  collection_key: str = 'roles'
  get(user_id, access_token_id, role_id)

    Get role for access token.

    GET/HEAD /v3/users/{user_id}/OS-OAUTH1/access_tokens/

      {access_token_id}/roles/{role_id}

  member_key: str = 'role'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.OAuth1ListAccessTokensResource

  Bases: `_OAuth1ResourceBase`

  get(user_id)

    List OAuth1 Access Tokens for user.

    GET /v3/users/{user_id}/OS-OAUTH1/access_tokens

  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAPI(blueprint_url_prefix='', api_url_prefix='', default_mediatype='application/json', decorators=None, errors=None)

  Bases: `APIBase`

  resource_mapping = [(<class 'keystone.api.users.UsersResource'>, '/users', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/users', 'stable', {})), (<class 'keystone.api.users.UserResource'>, '/users/<string:user_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserChangePasswordResource'>, '/users/<string:user_id>/password', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_change_password', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserGroupsResource'>, '/users/<string:user_id>/groups', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_groups', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserProjectsResource'>, '/users/<string:user_id>/projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/user_projects', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserOSEC2CredentialsResourceListCreate'>, '/users/<string:user_id>/credentials/OS-EC2', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-EC2/1.0/rel/user_credentials', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserOSEC2CredentialsResourceGetDelete'>, '/users/<string:user_id>/credentials/OS-EC2/<string:credential_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-EC2/1.0/rel/user_credential', 'stable', {'credential_id': 'https://docs.openstack.org/api/openstack-identity/3/param/credential_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1ListAccessTokensResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_tokens', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1AccessTokenCRUDResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens/<string:access_token_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_token', 'stable', {'access_token_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/param/access_token_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1AccessTokenRoleListResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens/<string:access_token_id>/roles', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_token_roles', 'stable', {'access_token_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/param/access_token_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.OAuth1AccessTokenRoleResource'>, '/users/<string:user_id>/OS-OAUTH1/access_tokens/<string:access_token_id>/roles/<string:role_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/user_access_token_role', 'stable', {'access_token_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/param/access_token_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAppCredListCreateResource'>, '/users/<string:user_id>/application_credentials', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/application_credentials', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAppCredGetDeleteResource'>, '/users/<string:user_id>/application_credentials/<string:application_credential_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/application_credential', 'stable', {'application_credential_id': 'https://docs.openstack.org/api/openstack-identity/3/param/application_credential_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAccessRuleListResource'>, '/users/<string:user_id>/access_rules', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/access_rules', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.users.UserAccessRuleGetDeleteResource'>, '/users/<string:user_id>/access_rules/<string:access_rule_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/access_rule', 'stable', {'access_rule_id': 'https://docs.openstack.org/api/openstack-identity/3/param/access_rule_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'}))]

class keystone.api.users.UserAccessRuleGetDeleteResource

  Bases: `ResourceBase`

  collection_key: str = 'access_rules'
  delete(user_id, access_rule_id)

    Delete access rule resource.

    DELETE /v3/users/{user_id}/access_rules/{access_rule_id}

  get(user_id, access_rule_id)

    Get access rule resource.

    GET/HEAD /v3/users/{user_id}/access_rules/{access_rule_id}

  member_key: str = 'access_rule'
  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAccessRuleListResource

  Bases: `ResourceBase`

  collection_key: str = 'access_rules'
  get(user_id)

    List access rules for user.

    GET/HEAD /v3/users/{user_id}/access_rules

  member_key: str = 'access_rule'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAppCredGetDeleteResource

  Bases: `ResourceBase`

  collection_key: str = 'application_credentials'
  delete(user_id, application_credential_id)

    Delete application credential resource.

    DELETE /v3/users/{user_id}/application_credentials/

      {application_credential_id}

  get(user_id, application_credential_id)

    Get application credential resource.

    GET/HEAD /v3/users/{user_id}/application_credentials/

      {application_credential_id}

  member_key: str = 'application_credential'
  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserAppCredListCreateResource

  Bases: `ResourceBase`

  collection_key: str = 'application_credentials'
  get(user_id)

    List application credentials for user.

    GET/HEAD /v3/users/{user_id}/application_credentials

  member_key: str = 'application_credential'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(user_id)

    Create application credential.

    POST /v3/users/{user_id}/application_credentials

class keystone.api.users.UserChangePasswordResource

  Bases: `ResourceBase`

  get(user_id)
  methods: t.ClassVar[t.Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(user_id)

class keystone.api.users.UserGroupsResource

  Bases: `ResourceBase`

  collection_key: str = 'groups'
  get(user_id)

    Get groups for a user.

    GET/HEAD /v3/users/{user_id}/groups

  get_member_from_driver
  member_key: str = 'group'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserOSEC2CredentialsResourceGetDelete

  Bases: `_UserOSEC2CredBaseResource`

  delete(user_id, credential_id)

    Delete a specific EC2 credential.

    DELETE /users/{user_id}/credentials/OS-EC2/{credential_id}

  get(user_id, credential_id)

    Get a specific EC2 credential.

    GET/HEAD /users/{user_id}/credentials/OS-EC2/{credential_id}

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserOSEC2CredentialsResourceListCreate

  Bases: `_UserOSEC2CredBaseResource`

  get(user_id)

    List EC2 Credentials for user.

    GET/HEAD /v3/users/{user_id}/credentials/OS-EC2

  methods: t.ClassVar[t.Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(user_id)

    Create EC2 Credential for user.

    POST /v3/users/{user_id}/credentials/OS-EC2

class keystone.api.users.UserProjectsResource

  Bases: `ResourceBase`

  collection_key: str = 'projects'
  get(user_id)
  get_member_from_driver
  member_key: str = 'project'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.users.UserResource

  Bases: `ResourceBase`

  collection_key: str = 'users'
  delete(user_id: str)

    Delete a user.

    DELETE /v3/users/{user_id}

  get(user_id: str)

    Get a user resource.

    GET/HEAD /v3/users/{user_id}

  get_member_from_driver
  member_key: str = 'user'
  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PATCH'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  patch(user_id: str)

    Update a user.

    PATCH /v3/users/{user_id}

class keystone.api.users.UsersResource

  Bases: `ResourceBase`

  collection_key: str = 'users'
  get()

    List users.

    GET/HEAD /v3/users

  get_member_from_driver
  member_key: str = 'user'
  methods: t.ClassVar[t.Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post()

    Create a user.

    POST /v3/users

this page last updated: 2026-04-01 20:09:17

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug