Users
The Users plugin manages accounts, groups and access levels — without ever handling passwords.
These tools cover the Users component (com_users). Each tool requires the permission shown in the “Required permissions” column.
Users
Create, edit and administer accounts.
| Tool | Function | Required permissions (ACL) |
|---|---|---|
search_users | Search accounts | Admin access — core.manage |
get_users_overview | Overview | Admin access — core.manage |
get_user | Read an account (including its field values) | Their own account, otherwise Admin access — core.manage |
list_user_fields | List custom account fields | None (read-only) |
create_user | Create an account | Create — core.create |
update_user | Edit an account | Edit — core.edit |
delete_user | Delete an account | Delete — core.delete |
block_user | Block | Edit state — core.edit.state |
activate_user | Activate | Edit state — core.edit.state |
set_user_groups | Assign groups | Edit + Admin access — core.edit + core.manage |
require_password_reset | Force a reset | Admin access — core.manage |
send_password_reset_email | Send a reset email | Edit — core.edit |
reset_user_mfa | Reset MFA (2FA) | Super User — global core.admin |
check_user_permissions | Check permissions | Admin access — core.manage |
Custom field values for an account (the com_users.user context) are entered using the fields argument of create_user / update_user, after discovering the field names with list_user_fields, and are read from the fields key returned by get_user. Structured values must be written in the format returned when reading them.
Groups
Manage the hierarchy of user groups.
| Tool | Function | Required permissions (ACL) |
|---|---|---|
list_user_groups | List groups | Admin access — core.manage |
get_user_group | Read a group | Admin access — core.manage |
create_user_group | Create a group | Create — core.create |
update_user_group | Edit a group | Edit — core.edit |
delete_user_group | Delete a group | Delete — core.delete |
Access levels
Administer access levels (ACL). The simple list of levels is provided by the Site plugin (list_access_levels).
| Tool | Function | Required permissions (ACL) |
|---|---|---|
get_access_level | Read an access level | Admin access — core.manage |
create_access_level | Create an access level | Create — core.create |
update_access_level | Edit an access level | Edit — core.edit |
delete_access_level | Delete an access level | Delete — core.delete |
Security
By design, no password is read or transmitted. Password resets use Joomla's standard mechanism (an email sent to the account). Actions remain limited by your permissions: a non-Super User account cannot act on a Super User or grant Super User permissions.
Prompt examples
“Create an account for Marie Martin in the Authors group.”
“Block the “spam123” account and send it a password reset.”