users

Manage users and invitations in your CARTO organization.

User management commands require admin or superadmin permissions. Regular users may not have access to view all organization users; invitation commands require permission to invite users to the organization.

Identifying a user

Commands that act on a specific user take --user-id for a user ID or --user-email for an email address. SSO user IDs often contain an @, so say which kind you are passing.

carto users get --user-email [e-mail]
carto users get --user-id "samlp|my-sso|[e-mail]"

Quote values containing | so your shell does not read it as a pipe.

carto users list

List every user in the organization. The command returns the full roster in one call; filter the output when you need a subset.

carto users list
carto users list --json | jq '[.[] | select(.role == "Builder")]'
carto users list --json | jq '[.[] | select(.email | contains("john"))]'

--all, --page, --page-size, --role and --search were removed in v0.12.0. The API never applied them, and --all did not finish for organizations of 100 or more users. A plain carto users list returns everyone.

carto users get

Get detailed information for a user. See Identifying a user.

carto users get --user-email [e-mail]
carto users get --user-id "google-oauth2|123456789"
carto users get --user-id "samlp|my-sso|[e-mail]" --json

Options:

Option	Description
--user-id <id>	Look the user up by user ID.
--user-email <email>	Look the user up by email address.

Output includes the user profile, roles, organization, identities, and groups.

carto users invite <email[,email...]> [email...]

Invite one or more users to the organization. Both comma-separated and multi-argument forms are accepted.

# Single user
carto users invite [e-mail] --role Builder

# Default role is Viewer
carto users invite [e-mail]

# Comma-separated
carto users invite [e-mail],[e-mail],[e-mail] --role Builder

# Multiple arguments
carto users invite [e-mail] [e-mail] --role Viewer

Options:

Option	Description
--role <Builder|Viewer|Guest>	Role to assign. Default: Viewer.

Available roles:

• Builder — full access to create and edit maps, workflows, and connections.

• Viewer — read-only access to view maps and data.

• Guest — limited access, typically for external collaborators.

carto users invitations

List pending invitations.

carto users invitations
carto users invitations --json

carto users resendInvitation <invitation-id>

Resend a pending invitation.

carto users cancelInvitation <invitation-id>

Cancel a pending invitation.

carto users delete

Remove a user from the organization and transfer everything they own to another user. Requires Admin permissions. Both users must be identified, the one being removed and the one receiving their content. See Identifying a user.

# Remove a user, hand their content to a colleague
carto users delete --user-email [e-mail] --receiver-email [e-mail]

# An SSO user ID that contains an "@"
carto users delete --user-id "samlp|my-sso|[e-mail]" --receiver-email [e-mail]

# The two can be identified differently
carto users delete --user-email [e-mail] --receiver-id "auth0|68c97d3137451d6dabeb86c4"

Options:

Option	Description
--user-id <id>	User to remove, by user ID.
--user-email <email>	User to remove, by email address.
--receiver-id <id>	User who receives their content, by user ID.
--receiver-email <email>	User who receives their content, by email address.

What transfers. Maps, workflows, connections, API access tokens, assets, named sources, hosted apps, folders, and shortcuts all move to the receiving user, along with any SPA OAuth applications.

What does not. The removed user's machine-to-machine OAuth applications are deleted rather than transferred, so any integration authenticating as that user stops working. Their recent activity, job history, group memberships, and per-user quota settings are also discarded.

Deleting a user cannot be undone. If the user being removed is a Builder or an Admin, the receiving user needs Builder privileges or higher, otherwise the command is rejected. You cannot delete your own account this way.

The content transfer runs asynchronously, so the receiving user's maps and workflows may take a moment to appear after the command returns.