---
title: "Users"
url: "https://www.sensomcp.com/en/doc/tools/user-tools"
lang: "en-GB"
description: "Senso MCP’s User plugin tools: manage accounts, groups and access levels without ever handling passwords."
category: "Tool Reference"
author: "Fred Oliver"
published: "2026-09-07T14:59:20+00:00"
modified: "2026-10-05T14:42:02+00:00"
---

# Users

- Abstract: This page documents the Senso MCP Users plugin tools for creating, editing, blocking or activating accounts, managing groups and access levels, and triggering a password reset, without ever handling passwords. Each tool specifies the required permission on com\_users.
- Safely manage accounts, groups and access levels.
-
- Intermediate
- Premium
- users, Users
- groups, Groups
- access-levels, Access levels
- security, Security
- prompt-examples, Prompt examples

These tools operate on the **Users** component (`com_users`). Each tool requires the permission indicated in the “Required permissions” column.

## Users

Create, edit and administer accounts.

| Tool | Function | Required permissions (ACL) |
|---|---|---|
| `search_users` | Search accounts | Admin access — `core.manage` |
| `get_users_overview` | Overview | Admin access — `core.manage` |
| `get_user` | Read an account (including its field values) | Their own account; otherwise admin access — `core.manage` |
| `list_user_fields` | List custom account fields | None (read-only) |
| `create_user` | Create an account | Create — `core.create` |
| `update_user` | Edit an account | Edit — `core.edit` |
| `delete_user` | Delete an account | Delete — `core.delete` |
| `block_user` | Block an account | Edit state — `core.edit.state` |
| `activate_user` | Activate an account | Edit state — `core.edit.state` |
| `set_user_groups` | Assign groups | Edit + admin access — `core.edit` + `core.manage` |
| `require_password_reset` | Force a password reset | Admin access — `core.manage` |
| `send_password_reset_email` | Send a password reset email | Edit — `core.edit` |
| `reset_user_mfa` | Reset MFA (2FA) | Super User — global `core.admin` |
| `check_user_permissions` | Check permissions | Admin access — `core.manage` |

The custom field values for an account (the `com_users.user` context) are provided through the `fields` argument of `create_user` / `update_user`, after discovering the field names with `list_user_fields`, and are read from the `fields` key of `get_user`. Structured values must be written in the format returned when reading them.

## Groups

Manage the user group hierarchy.

| Tool | Function | Required permissions (ACL) |
|---|---|---|
| `list_user_groups` | List groups | Admin access — `core.manage` |
| `get_user_group` | Read a group | Admin access — `core.manage` |
| `create_user_group` | Create a group | Create — `core.create` |
| `update_user_group` | Edit a group | Edit — `core.edit` |
| `delete_user_group` | Delete a group | Delete — `core.delete` |

## Access levels

Administer access levels (ACL). The Site plugin provides the basic list of levels (`list_access_levels`).

| Tool | Function | Required permissions (ACL) |
|---|---|---|
| `get_access_level` | Read an access level | Admin access — `core.manage` |
| `create_access_level` | Create an access level | Create — `core.create` |
| `update_access_level` | Edit an access level | Edit — `core.edit` |
| `delete_access_level` | Delete an access level | Delete — `core.delete` |

## Security

By design, no passwords are read or transmitted. Password resets use Joomla’s standard mechanism (an email sent to the account). Actions remain restricted by your permissions: a non-Super User cannot act on a Super User or grant Super User permissions.

## Prompt examples

> “Create an account for Marie Martin in the Authors group.”
>
> “Block the account ‘spam123’ and send it a password reset email.”