pveum.1-synopsis.adoc

   1 *pveum* `<COMMAND> [ARGS] [OPTIONS]`
   2
   3 *pveum acl delete* `<path> --roles <string>` `[OPTIONS]`
   4
   5 Update Access Control List (add or remove permissions).
   6
   7 `<path>`: `<string>` ::
   8
   9 Access control path
  10
  11 `--groups` `<string>` ::
  12
  13 List of groups.
  14
  15 `--propagate` `<boolean>` ('default =' `1`)::
  16
  17 Allow to propagate (inherit) permissions.
  18
  19 `--roles` `<string>` ::
  20
  21 List of roles.
  22
  23 `--tokens` `<string>` ::
  24
  25 List of API tokens.
  26
  27 `--users` `<string>` ::
  28
  29 List of users.
  30
  31 *pveum acl list* `[FORMAT_OPTIONS]`
  32
  33 Get Access Control List (ACLs).
  34
  35 *pveum acl modify* `<path> --roles <string>` `[OPTIONS]`
  36
  37 Update Access Control List (add or remove permissions).
  38
  39 `<path>`: `<string>` ::
  40
  41 Access control path
  42
  43 `--groups` `<string>` ::
  44
  45 List of groups.
  46
  47 `--propagate` `<boolean>` ('default =' `1`)::
  48
  49 Allow to propagate (inherit) permissions.
  50
  51 `--roles` `<string>` ::
  52
  53 List of roles.
  54
  55 `--tokens` `<string>` ::
  56
  57 List of API tokens.
  58
  59 `--users` `<string>` ::
  60
  61 List of users.
  62
  63 *pveum acldel*
  64
  65 An alias for 'pveum acl delete'.
  66
  67 *pveum aclmod*
  68
  69 An alias for 'pveum acl modify'.
  70
  71 *pveum group add* `<groupid>` `[OPTIONS]`
  72
  73 Create new group.
  74
  75 `<groupid>`: `<string>` ::
  76
  77 no description available
  78
  79 `--comment` `<string>` ::
  80
  81 no description available
  82
  83 *pveum group delete* `<groupid>`
  84
  85 Delete group.
  86
  87 `<groupid>`: `<string>` ::
  88
  89 no description available
  90
  91 *pveum group list* `[FORMAT_OPTIONS]`
  92
  93 Group index.
  94
  95 *pveum group modify* `<groupid>` `[OPTIONS]`
  96
  97 Update group data.
  98
  99 `<groupid>`: `<string>` ::
 100
 101 no description available
 102
 103 `--comment` `<string>` ::
 104
 105 no description available
 106
 107 *pveum groupadd*
 108
 109 An alias for 'pveum group add'.
 110
 111 *pveum groupdel*
 112
 113 An alias for 'pveum group delete'.
 114
 115 *pveum groupmod*
 116
 117 An alias for 'pveum group modify'.
 118
 119 *pveum help* `[OPTIONS]`
 120
 121 Get help about specified command.
 122
 123 `--extra-args` `<array>` ::
 124
 125 Shows help for a specific command
 126
 127 `--verbose` `<boolean>` ::
 128
 129 Verbose output format.
 130
 131 *pveum passwd* `<userid>`
 132
 133 Change user password.
 134
 135 `<userid>`: `<string>` ::
 136
 137 Full User ID, in the `name@realm` format.
 138
 139 *pveum pool add* `<poolid>` `[OPTIONS]`
 140
 141 Create new pool.
 142
 143 `<poolid>`: `<string>` ::
 144
 145 no description available
 146
 147 `--comment` `<string>` ::
 148
 149 no description available
 150
 151 *pveum pool delete* `<poolid>`
 152
 153 Delete pool.
 154
 155 `<poolid>`: `<string>` ::
 156
 157 no description available
 158
 159 *pveum pool list* `[FORMAT_OPTIONS]`
 160
 161 Pool index.
 162
 163 *pveum pool modify* `<poolid>` `[OPTIONS]`
 164
 165 Update pool data.
 166
 167 `<poolid>`: `<string>` ::
 168
 169 no description available
 170
 171 `--allow-move` `<boolean>` ('default =' `0`)::
 172
 173 Allow adding a guest even if already in another pool. The guest will be removed from its current pool and added to this one.
 174
 175 `--comment` `<string>` ::
 176
 177 no description available
 178
 179 `--delete` `<boolean>` ('default =' `0`)::
 180
 181 Remove the passed VMIDs and/or storage IDs instead of adding them.
 182
 183 `--storage` `<string>` ::
 184
 185 List of storage IDs to add or remove from this pool.
 186
 187 `--vms` `<string>` ::
 188
 189 List of guest VMIDs to add or remove from this pool.
 190
 191 *pveum realm add* `<realm> --type <string>` `[OPTIONS]`
 192
 193 Add an authentication server.
 194
 195 `<realm>`: `<string>` ::
 196
 197 Authentication domain ID
 198
 199 `--acr-values` `<string>` ::
 200
 201 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 202
 203 `--autocreate` `<boolean>` ('default =' `0`)::
 204
 205 Automatically create users if they do not exist.
 206
 207 `--base_dn` `<string>` ::
 208
 209 LDAP base domain name
 210
 211 `--bind_dn` `<string>` ::
 212
 213 LDAP bind domain name
 214
 215 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 216
 217 Path to the CA certificate store
 218
 219 `--case-sensitive` `<boolean>` ('default =' `1`)::
 220
 221 username is case-sensitive
 222
 223 `--cert` `<string>` ::
 224
 225 Path to the client certificate
 226
 227 `--certkey` `<string>` ::
 228
 229 Path to the client certificate key
 230
 231 `--check-connection` `<boolean>` ('default =' `0`)::
 232
 233 Check bind connection to the server.
 234
 235 `--client-id` `<string>` ::
 236
 237 OpenID Client ID
 238
 239 `--client-key` `<string>` ::
 240
 241 OpenID Client Key
 242
 243 `--comment` `<string>` ::
 244
 245 Description.
 246
 247 `--default` `<boolean>` ::
 248
 249 Use this as default realm
 250
 251 `--domain` `\S+` ::
 252
 253 AD domain name
 254
 255 `--filter` `<string>` ::
 256
 257 LDAP filter for user sync.
 258
 259 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 260
 261 The objectclasses for groups.
 262
 263 `--group_dn` `<string>` ::
 264
 265 LDAP base domain name for group sync. If not set, the base_dn will be used.
 266
 267 `--group_filter` `<string>` ::
 268
 269 LDAP filter for group sync.
 270
 271 `--group_name_attr` `<string>` ::
 272
 273 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 274
 275 `--issuer-url` `<string>` ::
 276
 277 OpenID Issuer Url
 278
 279 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 280
 281 LDAP protocol mode.
 282
 283 `--password` `<string>` ::
 284
 285 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 286
 287 `--port` `<integer> (1 - 65535)` ::
 288
 289 Server port.
 290
 291 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 292
 293 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 294
 295 `--scopes` `<string>` ('default =' `email profile`)::
 296
 297 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 298
 299 `--secure` `<boolean>` ::
 300
 301 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 302
 303 `--server1` `<string>` ::
 304
 305 Server IP address (or DNS name)
 306
 307 `--server2` `<string>` ::
 308
 309 Fallback Server IP address (or DNS name)
 310
 311 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 312
 313 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 314
 315 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=([acl];[properties];[entry])|none] [,scope=<users|groups|both>]` ::
 316
 317 The default options for behavior of synchronizations.
 318
 319 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 320
 321 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 322
 323 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 324
 325 Use Two-factor authentication.
 326
 327 `--type` `<ad | ldap | openid | pam | pve>` ::
 328
 329 Realm type.
 330
 331 `--user_attr` `\S{2,}` ::
 332
 333 LDAP user attribute name
 334
 335 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 336
 337 The objectclasses for users.
 338
 339 `--username-claim` `<string>` ::
 340
 341 OpenID claim used to generate the unique username.
 342
 343 `--verify` `<boolean>` ('default =' `0`)::
 344
 345 Verify the server's SSL certificate
 346
 347 *pveum realm delete* `<realm>`
 348
 349 Delete an authentication server.
 350
 351 `<realm>`: `<string>` ::
 352
 353 Authentication domain ID
 354
 355 *pveum realm list* `[FORMAT_OPTIONS]`
 356
 357 Authentication domain index.
 358
 359 *pveum realm modify* `<realm>` `[OPTIONS]`
 360
 361 Update authentication server settings.
 362
 363 `<realm>`: `<string>` ::
 364
 365 Authentication domain ID
 366
 367 `--acr-values` `<string>` ::
 368
 369 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 370
 371 `--autocreate` `<boolean>` ('default =' `0`)::
 372
 373 Automatically create users if they do not exist.
 374
 375 `--base_dn` `<string>` ::
 376
 377 LDAP base domain name
 378
 379 `--bind_dn` `<string>` ::
 380
 381 LDAP bind domain name
 382
 383 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 384
 385 Path to the CA certificate store
 386
 387 `--case-sensitive` `<boolean>` ('default =' `1`)::
 388
 389 username is case-sensitive
 390
 391 `--cert` `<string>` ::
 392
 393 Path to the client certificate
 394
 395 `--certkey` `<string>` ::
 396
 397 Path to the client certificate key
 398
 399 `--check-connection` `<boolean>` ('default =' `0`)::
 400
 401 Check bind connection to the server.
 402
 403 `--client-id` `<string>` ::
 404
 405 OpenID Client ID
 406
 407 `--client-key` `<string>` ::
 408
 409 OpenID Client Key
 410
 411 `--comment` `<string>` ::
 412
 413 Description.
 414
 415 `--default` `<boolean>` ::
 416
 417 Use this as default realm
 418
 419 `--delete` `<string>` ::
 420
 421 A list of settings you want to delete.
 422
 423 `--digest` `<string>` ::
 424
 425 Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications.
 426
 427 `--domain` `\S+` ::
 428
 429 AD domain name
 430
 431 `--filter` `<string>` ::
 432
 433 LDAP filter for user sync.
 434
 435 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 436
 437 The objectclasses for groups.
 438
 439 `--group_dn` `<string>` ::
 440
 441 LDAP base domain name for group sync. If not set, the base_dn will be used.
 442
 443 `--group_filter` `<string>` ::
 444
 445 LDAP filter for group sync.
 446
 447 `--group_name_attr` `<string>` ::
 448
 449 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 450
 451 `--issuer-url` `<string>` ::
 452
 453 OpenID Issuer Url
 454
 455 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 456
 457 LDAP protocol mode.
 458
 459 `--password` `<string>` ::
 460
 461 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 462
 463 `--port` `<integer> (1 - 65535)` ::
 464
 465 Server port.
 466
 467 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 468
 469 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 470
 471 `--scopes` `<string>` ('default =' `email profile`)::
 472
 473 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 474
 475 `--secure` `<boolean>` ::
 476
 477 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 478
 479 `--server1` `<string>` ::
 480
 481 Server IP address (or DNS name)
 482
 483 `--server2` `<string>` ::
 484
 485 Fallback Server IP address (or DNS name)
 486
 487 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 488
 489 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 490
 491 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=([acl];[properties];[entry])|none] [,scope=<users|groups|both>]` ::
 492
 493 The default options for behavior of synchronizations.
 494
 495 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 496
 497 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 498
 499 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 500
 501 Use Two-factor authentication.
 502
 503 `--user_attr` `\S{2,}` ::
 504
 505 LDAP user attribute name
 506
 507 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 508
 509 The objectclasses for users.
 510
 511 `--verify` `<boolean>` ('default =' `0`)::
 512
 513 Verify the server's SSL certificate
 514
 515 *pveum realm sync* `<realm>` `[OPTIONS]`
 516
 517 Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
 518 Synced groups will have the name 'name-$realm', so make sure those groups
 519 do not exist to prevent overwriting.
 520
 521 `<realm>`: `<string>` ::
 522
 523 Authentication domain ID
 524
 525 `--dry-run` `<boolean>` ('default =' `0`)::
 526
 527 If set, does not write anything.
 528
 529 `--enable-new` `<boolean>` ('default =' `1`)::
 530
 531 Enable newly synced users immediately.
 532
 533 `--full` `<boolean>` ::
 534
 535 DEPRECATED: use 'remove-vanished' instead. If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync and removing all locally modified properties of synced users. If not set, only syncs information which is present in the synced data, and does not delete or modify anything else.
 536
 537 `--purge` `<boolean>` ::
 538
 539 DEPRECATED: use 'remove-vanished' instead. Remove ACLs for users or groups which were removed from the config during a sync.
 540
 541 `--remove-vanished` `([acl];[properties];[entry])|none` ('default =' `none`)::
 542
 543 A semicolon-seperated list of things to remove when they or the user vanishes during a sync. The following values are possible: 'entry' removes the user/group when not returned from the sync. 'properties' removes the set properties on existing user/group that do not appear in the source (even custom ones). 'acl' removes acls when the user/group is not returned from the sync. Instead of a list it also can be 'none' (the default).
 544
 545 `--scope` `<both | groups | users>` ::
 546
 547 Select what to sync.
 548
 549 *pveum role add* `<roleid>` `[OPTIONS]`
 550
 551 Create new role.
 552
 553 `<roleid>`: `<string>` ::
 554
 555 no description available
 556
 557 `--privs` `<string>` ::
 558
 559 no description available
 560
 561 *pveum role delete* `<roleid>`
 562
 563 Delete role.
 564
 565 `<roleid>`: `<string>` ::
 566
 567 no description available
 568
 569 *pveum role list* `[FORMAT_OPTIONS]`
 570
 571 Role index.
 572
 573 *pveum role modify* `<roleid>` `[OPTIONS]`
 574
 575 Update an existing role.
 576
 577 `<roleid>`: `<string>` ::
 578
 579 no description available
 580
 581 `--append` `<boolean>` ::
 582
 583 no description available
 584 +
 585 NOTE: Requires option(s): `privs`
 586
 587 `--privs` `<string>` ::
 588
 589 no description available
 590
 591 *pveum roleadd*
 592
 593 An alias for 'pveum role add'.
 594
 595 *pveum roledel*
 596
 597 An alias for 'pveum role delete'.
 598
 599 *pveum rolemod*
 600
 601 An alias for 'pveum role modify'.
 602
 603 *pveum ticket* `<username>` `[OPTIONS]`
 604
 605 Create or verify authentication ticket.
 606
 607 `<username>`: `<string>` ::
 608
 609 User name
 610
 611 `--new-format` `<boolean>` ('default =' `1`)::
 612
 613 This parameter is now ignored and assumed to be 1.
 614
 615 `--otp` `<string>` ::
 616
 617 One-time password for Two-factor authentication.
 618
 619 `--path` `<string>` ::
 620
 621 Verify ticket, and check if user have access 'privs' on 'path'
 622 +
 623 NOTE: Requires option(s): `privs`
 624
 625 `--privs` `<string>` ::
 626
 627 Verify ticket, and check if user have access 'privs' on 'path'
 628 +
 629 NOTE: Requires option(s): `path`
 630
 631 `--realm` `<string>` ::
 632
 633 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 634
 635 `--tfa-challenge` `<string>` ::
 636
 637 The signed TFA challenge string the user wants to respond to.
 638
 639 *pveum user add* `<userid>` `[OPTIONS]`
 640
 641 Create new user.
 642
 643 `<userid>`: `<string>` ::
 644
 645 Full User ID, in the `name@realm` format.
 646
 647 `--comment` `<string>` ::
 648
 649 no description available
 650
 651 `--email` `<string>` ::
 652
 653 no description available
 654
 655 `--enable` `<boolean>` ('default =' `1`)::
 656
 657 Enable the account (default). You can set this to '0' to disable the account
 658
 659 `--expire` `<integer> (0 - N)` ::
 660
 661 Account expiration date (seconds since epoch). '0' means no expiration date.
 662
 663 `--firstname` `<string>` ::
 664
 665 no description available
 666
 667 `--groups` `<string>` ::
 668
 669 no description available
 670
 671 `--keys` `<string>` ::
 672
 673 Keys for two factor auth (yubico).
 674
 675 `--lastname` `<string>` ::
 676
 677 no description available
 678
 679 `--password` `<string>` ::
 680
 681 Initial password.
 682
 683 *pveum user delete* `<userid>`
 684
 685 Delete user.
 686
 687 `<userid>`: `<string>` ::
 688
 689 Full User ID, in the `name@realm` format.
 690
 691 *pveum user list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 692
 693 User index.
 694
 695 `--enabled` `<boolean>` ::
 696
 697 Optional filter for enable property.
 698
 699 `--full` `<boolean>` ('default =' `0`)::
 700
 701 Include group and token information.
 702
 703 *pveum user modify* `<userid>` `[OPTIONS]`
 704
 705 Update user configuration.
 706
 707 `<userid>`: `<string>` ::
 708
 709 Full User ID, in the `name@realm` format.
 710
 711 `--append` `<boolean>` ::
 712
 713 no description available
 714 +
 715 NOTE: Requires option(s): `groups`
 716
 717 `--comment` `<string>` ::
 718
 719 no description available
 720
 721 `--email` `<string>` ::
 722
 723 no description available
 724
 725 `--enable` `<boolean>` ('default =' `1`)::
 726
 727 Enable the account (default). You can set this to '0' to disable the account
 728
 729 `--expire` `<integer> (0 - N)` ::
 730
 731 Account expiration date (seconds since epoch). '0' means no expiration date.
 732
 733 `--firstname` `<string>` ::
 734
 735 no description available
 736
 737 `--groups` `<string>` ::
 738
 739 no description available
 740
 741 `--keys` `<string>` ::
 742
 743 Keys for two factor auth (yubico).
 744
 745 `--lastname` `<string>` ::
 746
 747 no description available
 748
 749 *pveum user permissions* `[<userid>]` `[OPTIONS]` `[FORMAT_OPTIONS]`
 750
 751 Retrieve effective permissions of given user/token.
 752
 753 `<userid>`: `(?^:^(?^:[^\s:/]+)\@(?^:[A-Za-z][A-Za-z0-9\.\-_]+)(?:!(?^:[A-Za-z][A-Za-z0-9\.\-_]+))?$)` ::
 754
 755 User ID or full API token ID
 756
 757 `--path` `<string>` ::
 758
 759 Only dump this specific path, not the whole tree.
 760
 761 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 762
 763 Delete TFA entries from a user.
 764
 765 `<userid>`: `<string>` ::
 766
 767 Full User ID, in the `name@realm` format.
 768
 769 `--id` `<string>` ::
 770
 771 The TFA ID, if none provided, all TFA entries will be deleted.
 772
 773 *pveum user tfa list* `[<userid>]`
 774
 775 List TFA entries.
 776
 777 `<userid>`: `<string>` ::
 778
 779 Full User ID, in the `name@realm` format.
 780
 781 *pveum user tfa unlock* `<userid>`
 782
 783 Unlock a user's TFA authentication.
 784
 785 `<userid>`: `<string>` ::
 786
 787 Full User ID, in the `name@realm` format.
 788
 789 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 790
 791 Generate a new API token for a specific user. NOTE: returns API token
 792 value, which needs to be stored as it cannot be retrieved afterwards!
 793
 794 `<userid>`: `<string>` ::
 795
 796 Full User ID, in the `name@realm` format.
 797
 798 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 799
 800 User-specific token identifier.
 801
 802 `--comment` `<string>` ::
 803
 804 no description available
 805
 806 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 807
 808 API token expiration date (seconds since epoch). '0' means no expiration date.
 809
 810 `--privsep` `<boolean>` ('default =' `1`)::
 811
 812 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 813
 814 *pveum user token list* `<userid>` `[FORMAT_OPTIONS]`
 815
 816 Get user API tokens.
 817
 818 `<userid>`: `<string>` ::
 819
 820 Full User ID, in the `name@realm` format.
 821
 822 *pveum user token modify* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 823
 824 Update API token for a specific user.
 825
 826 `<userid>`: `<string>` ::
 827
 828 Full User ID, in the `name@realm` format.
 829
 830 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 831
 832 User-specific token identifier.
 833
 834 `--comment` `<string>` ::
 835
 836 no description available
 837
 838 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 839
 840 API token expiration date (seconds since epoch). '0' means no expiration date.
 841
 842 `--privsep` `<boolean>` ('default =' `1`)::
 843
 844 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 845
 846 *pveum user token permissions* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 847
 848 Retrieve effective permissions of given token.
 849
 850 `<userid>`: `<string>` ::
 851
 852 Full User ID, in the `name@realm` format.
 853
 854 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 855
 856 User-specific token identifier.
 857
 858 `--path` `<string>` ::
 859
 860 Only dump this specific path, not the whole tree.
 861
 862 *pveum user token remove* `<userid> <tokenid>` `[FORMAT_OPTIONS]`
 863
 864 Remove API token for a specific user.
 865
 866 `<userid>`: `<string>` ::
 867
 868 Full User ID, in the `name@realm` format.
 869
 870 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 871
 872 User-specific token identifier.
 873
 874 *pveum useradd*
 875
 876 An alias for 'pveum user add'.
 877
 878 *pveum userdel*
 879
 880 An alias for 'pveum user delete'.
 881
 882 *pveum usermod*
 883
 884 An alias for 'pveum user modify'.
 885
 886