Skip to main content

Setup

Pass adminUserIds when creating your KavachOS instance:
Admin status is determined by the adminUserIds list. There is no role column, keep these IDs in environment variables, not hardcoded.

Listing users

Each user object includes id, email, name, banned, banReason, banExpiresAt, agentCount, and createdAt.

Banning users

Banning immediately revokes all active sessions for that user.

Impersonation

Impersonation creates a real session token. Use it only for debugging and support. All impersonated sessions are tagged with impersonating: true and the originating adminUserId.

Force password reset

This sets a flag on the user. Your app should check user.forcePasswordReset after login and redirect to a reset flow.

Deleting users

Deleting revokes all sessions and marks owned agents as revoked to preserve the audit trail, then removes the user record.

Endpoints

Organizations

Multi-tenant support with org-level roles and membership management.

API keys

Create scoped API keys for machine-to-machine callers.

Audit

Full activity trail for impersonation and admin actions.

SCIM

Automated user provisioning and deprovisioning via directory sync.
Last modified on April 29, 2026