You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/system-administration/manage-users-roles). info

This topic explains how to create and manage organization users. You must be an organization
administrator to perform these tasks.

> [!CAUTION]
> **IMPORTANT:**   
>
> Your ability to add new users may depend on your account type. For more information, see [Apigee Edge Pricing](https://apigee.com/api-management/#/pricing).

## What are organization users?

Organization users are given explicit permission by the organization administrator to create,
read, edit, and/or delete entities in an Apigee Edge organization. Permissions are role-based,
where a role conveys a specific, targeted set of permissions. This permission scheme is also
called **role-based access control**, or RBAC for short.

> [!NOTE]
> **Note:** Organization users are typically members of your API team who develop and test APIs, run reports, and perform other API admin tasks. Do not confuse organization users with app developers, the consumers of your APIs. The process of onboarding app developers and managing their access to your APIs is an entirely separate topic. See [Introduction to publishing](https://docs.apigee.com/api-platform/publish/publishing-overview).
>
> Also, note that topic applies to API management, not API BaaS, which has its own user
> management framework.

## What Edge entities do organization users
work with?

Organization users interact with a number of entities, including:

- API proxies
- API products
- Developer apps
- Developers
- Environments (Trace tool sessions and deployments)
- Custom reports (Analytics)

The degree of interaction permitted depends on the role or roles that are assigned to the user
by the organization administrator. See also [Assigning roles](https://docs.apigee.com/api-platform/system-administration/understanding-roles).

## Exploring the Users page

> [!NOTE]
> **Note:** You must be an Apigee Edge **organization administrator** to create users and assign roles. Only organization administrators can see and use the Admin menu used to manage organization users.

Access the Users page, as described below.

### Edge

To access the Users page using the Edge UI:

1. Sign in to <https://apigee.com/edge> as an **organization administrator**.
2. Select **Admin \> Users** .


   If you are not an organization administrator, this menu is not available.


The User page appears, as shown in the following figure.


![](https://docs.apigee.com/static/api-platform/images/manage-users-edge.png)


As highlighted in the figure, the Users page enables you to:

- View the current users, including their name, primary email, and roles. By default, all users have a user role that gives them full access to all features in Apigee. See also [Assigning roles](https://docs.apigee.com/api-platform/system-administration/understanding-roles).
- [Add a user](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#addingusers)
- [Edit the user profile and assigned roles](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#editingauserprofileandassignedroles)
- [Remove a user](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#delete)

### New Edge UI (Private Cloud)

> [!NOTE]
> **Note:** The New Edge UI is available with Edge for Private Cloud only.

To access the Users page using the New Edge UI:

1. Sign in to the New Edge UI at `http://host:3001/edge` as an **organization administrator** , where <var translate="no">host</var> is the IP address or DNS name of the host running the New Edge UI.
2. Select **Admin \> Users** .


   If you are not an organization administrator, this menu is not available.

The Users page appears, as shown in the following figure.

![Users page in the New Edge UI](https://docs.apigee.com/static/api-platform/images/manage-users-edge.png)

As highlighted in the figure, the Users page enables you to:

- View the current users, including their name, primary email, and roles. By default, all users have a user role that gives them full access to all features in Apigee. See also [Assigning roles](https://docs.apigee.com/api-platform/system-administration/understanding-roles).
- [Add a user](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#addingusers)
- [Edit the user profile and assigned roles](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#editingauserprofileandassignedroles)
- [Remove a user](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#delete)

## Adding users

To add an organization user:

1. [Access the Users page](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#viewingusers).
2. Click **+ User** .

   The New User page displays.
3. Enter the user's email address.
4. Select the roles you want to assign to the user.  
   You can add more than one role to a user.
5. Click **Save**.

If the user already has an Apigee account, they will see the new organization after signing
into Apigee Edge. If the new user doesn't yet have an Apigee account, they are sent email
instructions for account activation, password reset, and logging in.

## Add or Remove ZoneAdmin

Apigee Edge UI does not support adding zone administrators. To grant or revoke ZoneAdmin access using Apigee API, follow these steps:

1. Use the get_token utility to [get token](https://docs.apigee.com/api-platform/system-administration/using-gettoken).
2. Export variables:  

   ```
   export TOKEN=token_from_above_step
   ```

   ```
   export ENDPOINT=https://api.enterprise.apigee.com
   ```

   ```
   export ORG=apigee_organization_name
   ```

   ```
   export EMAIL=apigee_username
   ```
3. Add the user to the ZoneAdmin role:  

   ```
   curl -X POST -i -d '{"role" : [ {"name" : "zoneadmin"} ] }' "$ENDPOINT/v1/o/$ORG/users/$EMAIL/userroles" -H "Content-type:application/json" -H "Authorization: Bearer $TOKEN"
   ```
4. Check the user's role:  

   ```
   curl -i "$ENDPOINT/v1/users/$EMAIL/userroles" -H "Content-type:application/json" -H "accept: application/json;charset=utf-8" -H "authorization: Bearer $TOKEN"
   ```
5. To remove the previously added ZoneAdmin:  

   ```
   curl -X DELETE -i -d '{"role" : [ {"name" : "zoneadmin"} ] }' "$ENDPOINT/v1/o/$ORG/userroles/zoneadmin/users/$EMAIL" -H "Content-type:application/json" -H "Authorization: Bearer $TOKEN"
   ```

<br />

## Verify ZoneAdmin

To verify whether the ZoneAdmin role exists in your organization, a user with the organization administrator role can execute the following API management call:

```
curl -H "Authorization: Bearer $TOKEN" 'https://api.enterprise.apigee.com/v1/o/org-name/userroles/zoneadmin'
```

If the role exists, you will see the following output:

```
    {
      "name" : "zoneadmin"
    }
    
```

If the role does not exist, you will see the following output:

```
      {
        "code" : "usersandroles.UserRoleDoesNotExist",
        "message" : "Userrole zoneadmin does not exist",
        "contexts" : [ ]
      }
      
```

If the ZoneAdmin role does not exist in your organization, you must contact [Apigee Support](https://apigee.com/about/support/portal) to have the role created. Organization administrator users do not have the necessary permissions to create the ZoneAdmin role and, consequently, cannot add users to it if the role is absent.

## Editing a user profile and assigned roles

You can edit a user profile and add one or more roles to a user when you create a new user or
edit an existing user. See also [Assigning roles](https://docs.apigee.com/api-platform/system-administration/understanding-roles).

> [!NOTE]
> **Note:** If a user has multiple roles assigned, the highest-level permission takes precedence. For example, if one role doesn't allow the user to create API proxies, but another role does, then the user can create API proxies. In general, it is not a common use case to assign users multiple roles.

To edit a user profile and assigned roles:

1. [Access the Users page](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#viewingusers).
2. Click the name of an existing user.
3. Click **Edit**.
4. You can modify only your own first and last name, not those of other users.
5. Add or remove roles:
   - To add a role, click in the **Roles** field and select a new role from the drop-down.
   - To remove a role, click the x associated with the role.
6. Repeat the previous step to add additional roles, if desired.
7. Click **Save**.

## Removing users from an
organization

To remove a user from an organization, you must be an organization administrator.

1. [Access the Users page](https://docs.apigee.com/api-platform/system-administration/managing-organization-users#viewingusers).
2. Click **Remove** in the Actions column associated with the user that you want to remove.

> [!NOTE]
> **Note:** This removes the user from the current organization only. If the user is a member of multiple organizations, they remain in the system.

To remove a user from Apigee completely, contact [Apigee Support](https://apigee.com/about/support/portal).