# Manage users

:::callout{intent="info" title="Added in `v1.30`"}
:::

In Weaviate, Role-based access control (RBAC) allows you to define roles and assign permissions to those roles. Users can then be assigned to roles and inherit the permissions associated with those roles.

Weaviate differentiates multiple types of users. **Database users** are fully managed by the Weaviate instance, while **OIDC** users are managed by an external identity provider. Both types can be used together with RBAC.

On this page, you will find examples of how to programmatically **manage users** and their associated roles with Weaviate client libraries.

:::callout{intent="note" title="User types in Weaviate"}
Under the hood, Weaviate differentiates three types of users:

- `db_user`: Database users that can be fully managed through the API.
- `db_env_user`: Database users that are defined through the `AUTHENTICATION_APIKEY_USERS` environment variable and can only be updated through this variable and by restarting the Weaviate instance.
- `oidc`: Users that can only be created/deleted through the external OIDC service.
:::

## User management

### List all users

This example shows how to get a list of all the users (`db_user`, `db_env_user` and `oidc`) in Weaviate.

:::code-group{sync="languages"}
```python title="Python"
print(client.users.db.list_all())
```

```typescript title="JavaScript/TypeScript"
console.log(await client.users.db.listAll())
```

```go title="Go"
users, err := client.Users().DB().Lister().Do(ctx)
fmt.Println(users)
```

```java title="Java"
var allUsers = client.users.db.list();
System.out.println(allUsers);
```

```csharp title="C#"
var allUsers = await client.Users.Db.List();
Console.WriteLine(string.Join(", ", allUsers.Select(u => u.UserId)));
```
:::

:::accordion{title="Example results"}
```text
[
  UserDB(user_id='custom-user', role_names=['viewer', 'testRole'], user_type=<UserTypes.DB_DYNAMIC: 'db_user'>, active=True),
  UserDB(user_id='root-user', role_names=['root'], user_type=<UserTypes.DB_STATIC: 'db_env_user'>, active=True)
]
```
:::

### Create a database user

This example creates a user called `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
user_api_key = client.users.db.create(user_id="custom-user")
print(user_api_key)
```

```typescript title="JavaScript/TypeScript"
let userApiKey
```

```go title="Go"
userApiKey, err := client.Users().DB().Creator().WithUserID("custom-user").Do(ctx)
fmt.Println(userApiKey)
```

```java title="Java"
String userApiKey = client.users.db.create(testUser);
System.out.println(userApiKey);
```

```csharp title="C#"
string userApiKey = await client.Users.Db.Create(testUser);
Console.WriteLine(userApiKey);
```
:::

:::accordion{title="Example results"}
```text
RXF1dU1VcWM1Q3hvVndYT0F1OTBOTDZLZWx0ME5kbWVJRVdPL25EVW12QT1fMXlDUEhUNjhSMlNtazdHcV92MjAw
```
:::

### Delete a database user

This example deletes a user called `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
client.users.db.delete(user_id="custom-user")
```

```typescript title="JavaScript/TypeScript"
await client.users.db.delete("custom-user")
```

```go title="Go"
deleted, err := client.Users().DB().Deleter().WithUserID("custom-user").Do(ctx)
```

```java title="Java"
client.users.db.delete(testUser);
```

```csharp title="C#"
await client.Users.Db.Delete(testUser);
```
:::

### Rotate database user API key

This example updates (rotates) the API key for `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
new_api_key = client.users.db.rotate_key(user_id="custom-user")
print(new_api_key)
```

```typescript title="JavaScript/TypeScript"
let newApiKey
newApiKey = await client.users.db.rotateKey("custom-user")
console.log(newApiKey)
```

```go title="Go"
newApiKey, err := client.Users().DB().KeyRotator().WithUserID("custom-user").Do(ctx)
fmt.Println(newApiKey)
```

```java title="Java"
String newApiKey = client.users.db.rotateKey(testUser);
System.out.println(newApiKey);
```

```csharp title="C#"
string newApiKey = await client.Users.Db.RotateApiKey(testUser);
Console.WriteLine(newApiKey);
```
:::

:::accordion{title="Example results"}
```text
SSs3WGVFbUxMVFhlOEsxVVMrQVBzM1VhQTJIM2xXWngwY01HaXFYVnM1az1fMXlDUEhUNjhSMlNtazdHcV92MjAw
```
:::

## Database users: Permissions management

### Assign a role to a database user

A custom user can have any number of roles assigned to them (including none). The role can be a predefined role (e.g. `viewer`) or a custom role.

This example assigns the custom `testRole` role and predefined `viewer` role to `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
client.users.db.assign_roles(user_id="custom-user", role_names=["testRole", "viewer"])
```

```typescript title="JavaScript/TypeScript"
await client.users.db.assignRoles(["testRole", "viewer"], "custom-user")
```

```go title="Go"
err = client.Users().DB().RolesAssigner().
  WithUserID("custom-user").
  WithRoles("testRole", "viewer").
  Do(ctx)
```

```java title="Java"
client.users.db.assignRoles(testUser, testRole, "viewer");
```

```csharp title="C#"
await client.Users.Db.AssignRoles(testUser, new[] { testRole, "viewer" });
```
:::

### Remove a role from a database user

You can revoke one or more roles from a specific user.

This example removes the role `testRole` from the user `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
client.users.db.revoke_roles(user_id="custom-user", role_names="testRole")
```

```typescript title="JavaScript/TypeScript"
await client.users.db.revokeRoles("custom-user", "testRole")
```

```go title="Go"
err = client.Users().DB().RolesRevoker().
  WithUserID("custom-user").
  WithRoles("testRole").
  Do(ctx)
```

```java title="Java"
client.users.db.revokeRoles(testUser, testRole);
```

```csharp title="C#"
await client.Users.Db.RevokeRoles(testUser, new[] { testRole });
```
:::

### Get a database user's roles

Retrieve the role information for any user.

:::code-group{sync="languages"}
```python title="Python"
user_roles = client.users.db.get_assigned_roles("custom-user")

for role in user_roles:
    print(role)
```

```typescript title="JavaScript/TypeScript"
let userRoles = await client.users.db.getAssignedRoles("custom-user")

for (const [role, value] of Object.entries(userRoles)) {
    console.log(role)
}
```

```go title="Go"
userRoles, err := client.Users().DB().RolesGetter().
  WithUserID("custom-user").
  WithIncludeFullRoles(true).
  Do(ctx)

for _, role := range userRoles {
  fmt.Println(role)
}
```

```java title="Java"
var userRoles = client.users.db.assignedRoles(testUser);
for (Role role : userRoles) {
  System.out.println(role.name());
}
```

```csharp title="C#"
var userRoles = await client.Users.Db.GetRoles(testUser);
foreach (var role in userRoles)
{
    Console.WriteLine(role.Name);
}
```
:::

:::accordion{title="Example results"}
```text
testRole
viewer
```
:::

## OIDC users: Permissions management

When using [OIDC](deploy-configuration-oidc.md), an identity provider authenticates the user and issues tokens, which are then validated by Weaviate. These users can be assigned roles with custom permissions using RBAC.

### Assign a role to an OIDC user

An OIDC user can have any number of roles assigned to them (including none). The role can be a predefined role (e.g. `viewer`) or a custom role.

This example assigns the custom `testRole` role and predefined `viewer` role to `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
client.users.oidc.assign_roles(user_id="custom-user", role_names=["testRole", "viewer"])
```

```typescript title="JavaScript/TypeScript"
await client.users.oidc.assignRoles(["testRole", "viewer"], "custom-user",)
```

```go title="Go"
err = client.Users().OIDC().RolesAssigner().
  WithUserID("custom-user").
  WithRoles("testRole", "viewer").
  Do(ctx)
```

```java title="Java"
client.users.oidc.assignRoles(testUser, testRole, "viewer");
```

```csharp title="C#"
await client.Users.Oidc.AssignRoles(testUser, new[] { testRole, "viewer" });
```
:::

### Remove a role from an OIDC user

You can revoke one or more roles from a specific OIDC user.

This example removes the role `testRole` from the user `custom-user`.

:::code-group{sync="languages"}
```python title="Python"
client.users.oidc.revoke_roles(user_id="custom-user", role_names="testRole")
```

```typescript title="JavaScript/TypeScript"
await client.users.oidc.revokeRoles("testRole","custom-user")
```

```go title="Go"
err = client.Users().OIDC().RolesRevoker().
  WithUserID("custom-user").
  WithRoles("testRole").
  Do(ctx)
```

```java title="Java"
client.users.oidc.revokeRoles(testUser, testRole);
```

```csharp title="C#"
await client.Users.Oidc.RevokeRoles(testUser, new[] { testRole });
```
:::

### Get an OIDC user's roles

Retrieve the role information for an OIDC user.

:::code-group{sync="languages"}
```python title="Python"
user_roles = client.users.oidc.get_assigned_roles(user_id="custom-user")

for role in user_roles:
    print(role)
```

```typescript title="JavaScript/TypeScript"
const userRoles = await client.users.oidc.getAssignedRoles("custom-user")

for (const [role, value] of Object.entries(userRoles)) {
    console.log(role)
}
```

```go title="Go"
userRoles, err := client.Users().OIDC().RolesGetter().
  WithUserID("custom-user").
  WithIncludeFullRoles(true).
  Do(ctx)

for _, role := range userRoles {
  fmt.Println(role)
}
```

```java title="Java"
var oidcUserRoles = client.users.oidc.assignedRoles(testUser);
for (Role role : oidcUserRoles) {
  System.out.println(role.name());
}
```

```csharp title="C#"
var oidcUserRoles = await client.Users.Oidc.GetRoles(testUser);
foreach (var role in oidcUserRoles)
{
    Console.WriteLine(role.Name);
}
```
:::

:::accordion{title="Example results"}
```text
testRole
viewer
```
:::

## Further resources

- [RBAC: Overview](weaviate-configuration-rbac.md)
- [RBAC: Configuration](deploy-configuration-configuring-rbac.md)
- [RBAC: Manage roles](weaviate-configuration-rbac-manage-roles.md)

## Questions and feedback

Have a question or feedback? Here's how to reach us.

::::card-grid
:::card{title="Community Forum" href="https://forum.weaviate.io/c/support" icon="messages-square"}
Ask questions and connect with other developers on our **Community forum**.
:::

:::card{title="Support" href="/guides/support-overview" icon="life-buoy"}
Weaviate Cloud user or customer? Find the right channel on the **Support page**.
:::
::::

## Related pages

- [Agents](./agents-index.md)
- [AI-assisted Weaviate code generation](./ai-assisted-vibe-coding-index.md)
- [APIs](./apis-index.md)
- [Authorization and authentication](./authorization-and-authentication-index.md)
- [Benchmarks](./benchmarks-index.md)
- [Best practices](./best-practices-index.md)
- [Client libraries](./clients-index.md)
- [Client Libraries / SDKs](./client-libraries-index.md)
- [Cloud](./cloud-index.md)
- [Cloud account management](./cloud-account-management-index.md)

# Agent Instructions

This portal answers questions programmatically. To receive a synthesized,
source-cited answer instead of crawling page by page, append the `?ask=`
query parameter to any page URL on this site:

    /guides/quickstart?ask=how+do+I+authenticate

Optional parameters:

- `&goal=<what-you-are-trying-to-do>` steers the answer toward your
  objective (e.g. `&goal=write+a+python+client`).
- `&version=<label>` scopes the answer to a mounted version when the
  portal publishes more than one.

The response is `text/markdown`: the answer followed by a `# Sources` list
of the portal pages it was grounded in. Status codes are the contract:

- `200` — the answer; `402` — the portal owner’s plan or answer credits are
  exhausted (surface this to your operator; do NOT retry); `429` — you are
  rate-limited; back off for the `Retry-After` seconds; `503` — the answer
  lane is temporarily unavailable; fall back to crawling the `.md` pages.

For the full corpus map read `llms.txt` at the site root; for the tool
surface (search + page fetch as MCP tools) see `/mcp`.