manage-users

Manage Users

Manage users, user groups, and service accounts via MCP.

Instructions

Step 1: List Users

Call MCP tool: harness_list
Parameters:
  resource_type: "user"
  search_term: "<name or email>"

Users are account-scoped. Use search_term to filter by name or email.

Step 2: Get User Details

Call MCP tool: harness_get
Parameters:
  resource_type: "user"
  resource_id: "<user_id>"

Step 3: Manage User Groups

List groups:

Call MCP tool: harness_list
Parameters:
  resource_type: "user_group"
  org_id: "<organization>"
  project_id: "<project>"
  search_term: "<group name>"

Get group details:

Call MCP tool: harness_get
Parameters:
  resource_type: "user_group"
  resource_id: "<group_identifier>"
  org_id: "<organization>"
  project_id: "<project>"

Create a group:

Call MCP tool: harness_create
Parameters:
  resource_type: "user_group"
  org_id: "<organization>"
  project_id: "<project>"
  body:
    identifier: "backend_team"
    name: "Backend Team"
    description: "Backend engineering team"
    users:
      - "<user_id_1>"
      - "<user_id_2>"

Delete a group:

Call MCP tool: harness_delete
Parameters:
  resource_type: "user_group"
  resource_id: "<group_identifier>"
  org_id: "<organization>"
  project_id: "<project>"

Step 4: Manage Service Accounts

List service accounts:

Call MCP tool: harness_list
Parameters:
  resource_type: "service_account"
  org_id: "<organization>"
  project_id: "<project>"

Create a service account:

Call MCP tool: harness_create
Parameters:
  resource_type: "service_account"
  org_id: "<organization>"
  project_id: "<project>"
  body:
    identifier: "ci_bot"
    name: "CI Bot"
    description: "Service account for CI pipeline automation"
    email: "[REDACTED_EMAIL]"

Delete a service account:

Call MCP tool: harness_delete
Parameters:
  resource_type: "service_account"
  resource_id: "<service_account_identifier>"
  org_id: "<organization>"
  project_id: "<project>"

Step 5: List Available Permissions

Call MCP tool: harness_list
Parameters:
  resource_type: "permission"

This returns all platform permissions. Use this to understand what permissions can be assigned via roles.

Resource Types

Resource Type	Scope	Operations	Description
user	Account	list, get	Platform users (read-only)
user_group	Project	list, get, create, delete	User groups for RBAC
service_account	Project	list, get, create, delete	API automation accounts
permission	Account	list	Available permissions (read-only)

Relationship to /manage-roles

This skill manages principals (users, groups, service accounts). Use /manage-roles to assign roles and resource groups to these principals:

1. /manage-users -- Create the user group or service account
2. /manage-roles -- Assign a role + resource group to that principal

Examples

• "List all users in the account" -- List users with no filter
• "Find user john.doe" -- List users with search_term "john.doe"
• "Create a user group for the platform team" -- Create user_group with member user IDs
• "Create a service account for CI automation" -- Create service_account
• "What permissions are available?" -- List permissions
• "Delete the old test-bot service account" -- Delete service_account

Performance Notes

• Verify user email addresses and group identifiers before making changes.
• List existing groups and service accounts before creating to avoid duplicates.
• For service accounts, confirm the token expiry and scope match the intended usage.

Troubleshooting

User Not Found

• Users are account-scoped -- no org/project needed
• Try searching by email address instead of display name
• User must be invited to the account before they appear

Cannot Create User

• Users cannot be created via API -- they must be invited through the Harness UI or SCIM provisioning
• Use user groups and service accounts for programmatic access

Service Account Has No Access

• Creating a service account alone does not grant permissions
• Use /manage-roles to assign a role to the service account
• Generate an API key for the service account via the Harness UI