Enterprise users

Enterprise users are the accounts a top-level group owns, typically because their email domain is verified for the group. These actions list and read them, disable a user’s two-factor authentication, and delete one.

Sample questions

• “List the enterprise users of group acme”
• “Disable two-factor authentication for enterprise user 42”
• “Show the enterprise user alice”

How to call it

• Dynamic, the default surface: call gitlab_execute_action with action set to the action’s ID, such as enterprise_user.delete, and its parameters in params. gitlab_find_action finds an ID from a description of the task.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): call gitlab_enterprise_user with action set to the action’s name, such as delete, and its parameters in params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): call the action’s own tool, such as gitlab_delete_enterprise_user, with its parameters as the arguments.

Availability

How many of these actions an instance serves at each tier, out of a total of 4:

• Free: 0
• Premium: 4
• Ultimate: 4

Listed only for a token that carries admin_mode: the server removes the group from every surface for a token whose scopes it knows and that lacks it.

Read-only actions: 2 of 4, the ones a deployment in read-only mode keeps. A token with read_api and not api is served 2 of the 4.

Actions

The description of each action, and of each of its parameters, is the text the server serves for it on the default surface, quoted as served. The token lines say what GitLab 19.4.1 requires of a token for the requests each action sends; on an instance with Admin Mode turned on, an action only an administrator may run also needs admin_mode. A destructive action runs only once confirmed, unless GITLAB_MCP_YOLO_MODE (or AUTOPILOT) skips that step: the dynamic surface needs confirm: true on gitlab_execute_action, and the other two take a confirm parameter or the client’s prompt (Destructive actions).

Action	Individual
enterprise_user.delete	gitlab_delete_enterprise_user
enterprise_user.disable_2fa	gitlab_disable_2fa_enterprise_user
enterprise_user.get	gitlab_get_enterprise_user
enterprise_user.list	gitlab_list_enterprise_users

enterprise_user.delete

Delete an enterprise user, optionally with hard_delete. Returns: a success confirmation naming the user and group. See also: enterprise_user.get, enterprise_user.list, enterprise_user.disable_2fa.

• Meta-tool: gitlab_enterprise_user, action delete
• Individual tool: gitlab_delete_enterprise_user
• Tier: Premium
• Classic or OAuth token: api; this server lists the group only to a token that also carries admin_mode
• Fine-grained token: Enterprise User: Delete at group (permissions page)
• Behavior: writes, destructive (needs confirmation), idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
user_id	integer	yes	User ID
hard_delete	boolean	no	Permanently delete user instead of soft delete

enterprise_user.disable_2fa

Disable two-factor authentication for an enterprise user. Returns: a success confirmation naming the user and group. See also: enterprise_user.get, enterprise_user.list, enterprise_user.delete.

• Meta-tool: gitlab_enterprise_user, action disable_2fa
• Individual tool: gitlab_disable_2fa_enterprise_user
• Tier: Premium
• Classic or OAuth token: api; this server lists the group only to a token that also carries admin_mode
• Fine-grained token: Enterprise User: Disable Two Factor at group (permissions page)
• Behavior: writes, destructive (needs confirmation), idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
user_id	integer	yes	User ID

enterprise_user.get

Get a single enterprise user by group_id and user_id. Returns: the full user profile (identities, SCIM identities, custom attributes, sign-in metadata, admin/auditor flags, license seat usage, and web URL). See also: enterprise_user.list, enterprise_user.disable_2fa, enterprise_user.delete.

• Meta-tool: gitlab_enterprise_user, action get
• Individual tool: gitlab_get_enterprise_user
• Tier: Premium
• Classic or OAuth token: read_api (or api); this server lists the group only to a token that also carries admin_mode
• Fine-grained token: Enterprise User: Read at group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
user_id	integer	yes	User ID

enterprise_user.list

List enterprise users for a top-level group with filtering and pagination. Returns: enterprise users with full profile fields (identities, SCIM identities, custom attributes, sign-in metadata, license seat usage) and pagination metadata. See also: enterprise_user.get, enterprise_user.disable_2fa, enterprise_user.delete.

• Meta-tool: gitlab_enterprise_user, action list
• Individual tool: gitlab_list_enterprise_users
• Tier: Premium
• Classic or OAuth token: read_api (or api); this server lists the group only to a token that also carries admin_mode
• Fine-grained token: Enterprise User: Read at group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
active	boolean	no	Filter for active users only
blocked	boolean	no	Filter for blocked users only
created_after	string	no	Filter users created after this date (ISO 8601)
created_before	string	no	Filter users created before this date (ISO 8601)
order_by	string	no	Column to order keyset-paginated results by (e.g. id)
page	integer	no	Page number to fetch, 1-based. Defaults to 1. Use the next_page field from the previous response to paginate forward.
page_token	string	no	Next page of a keyset listing: the next_page_token of the previous response of this action, passed back unchanged. It carries the position and every filter of the listing as GitLab read them, and those are what the next page is asked with, whatever filters are sent beside it. Leave it empty for the first page.
pagination	string	no	Pagination method: ‘keyset’ for keyset-based pagination on large ordered result sets, or ‘offset’ (the default). Keyset avoids deep-offset cost, and a keyset page names the next one in next_page_token rather than next_page.
per_page	integer	no	Items per page. Defaults to 20, minimum 1, maximum 100. Use 100 to minimize round trips when the result set is large.
search	string	no	Search by name or username or email
sort	string (asc, desc)	no	Sort order for keyset pagination: asc or desc
two_factor	string (enabled, disabled)	no	Filter by 2FA status: enabled or disabled
username	string	no	Filter by exact username