Manage Users

How to list, inspect, enable/disable, update, and delete users in Wiretastix.

Users represent individuals who authenticate through your OIDC Identity Provider.

Users Are Not Created via the CLI

There is no user create command. Users are provisioned automatically the first time someone authenticates through your OIDC Identity Provider – see Signing In and Creating Your First Tunnel and OIDC Integration. The wiretastix-cli user command group only lets you list, inspect, enable/disable, update, and delete users that already exist as a result of that login flow.

List Users

To view all registered users, use the user list command:

wiretastix-cli
> user list

Get User Details

To retrieve detailed information about a specific user (including their groups), use user show with the user’s ID:

> user show jdoe

Enable or Disable a User

Blocking a user’s access (without deleting their data) is done with dedicated enable/disable commands, not a flag on update:

> user disable jdoe
> user enable jdoe

Disabling a user immediately takes down every one of their tunnels – Wiretastix removes all of that user’s peers from the live WireGuard interface right away, not just at their next reconnect attempt. Their peer records and keys aren’t deleted, so re-enabling the user brings the same tunnels back up without needing to recreate anything. This makes disable the fast, reversible way to cut off a user’s access – see Security Best Practices for using it during incident response.

Update a User

The user update command only supports one property: maxdevices, a per-user override for the maximum number of peers they’re allowed.

> user update jdoe maxdevices 5

Delete a User

To remove a user, use the user delete command:

> user delete jdoe

Warning: Deleting a user also deletes every WireGuard peer belonging to that user – the API explicitly removes their peers first, then the user record. Like disabling, this takes every one of their tunnels down immediately, but unlike disabling it’s not reversible: the peer records and keys are gone, not just deactivated, so getting that user connected again means creating new tunnels from scratch. Also note the API refuses to delete a user who is currently disabled; re-enable them first if you need to delete them.

Associating Peers with Users

The wiretastix-cli’s peer create command, and the REST API endpoint behind it, only ever create unmanaged peers with no user association at all – there’s no --user flag, no user_id field, no equivalent of any kind (see Managing Peers). The only way a peer ends up associated with a user is through that user’s own OIDC self-service login flow, which provisions it automatically – it isn’t something you trigger manually for someone else, via the CLI or the API.

Next Steps

To organize users by shared configuration and firewall policy, see Manage Groups.