---
title: Overview
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/user-management-overview
---

## User Management Overview

The User Management API covers the core user identity layer: creating and managing users (`KalturaUser`), assigning roles for RBAC (`KalturaUserRole`), and managing group membership (`groupUser`). Every Kaltura service that references a userId — User Profile, Messaging, Events Platform, Webhooks — depends on a KalturaUser existing first.

**Base URL:** `https://www.kaltura.com/api_v3` (may differ by region/deployment)  
**Auth:** KS passed as `ks` parameter in POST form data (see [Session Guide](/docs/getting-started/authentication/ks-overview))  
**Format:** Form-encoded POST, `format=1` for JSON responses  
**Services:** `user` (22 actions), `userRole` (6 actions), `group_group` (CRUD), `groupUser` (5 actions)

### When to Use


- **IT and identity teams** provisioning Kaltura user accounts as part of employee onboarding or offboarding automation  
- **SSO integration projects** syncing user records from SAML/OIDC identity providers into Kaltura  
- **Platform administrators** assigning role-based access control (RBAC) to enforce least-privilege policies  
- **LMS and HR systems** bulk-importing users and managing group memberships for course or department scoping  
- **Application developers** looking up user profiles, managing login credentials, or integrating user lifecycle events




### Prerequisites


- **KS type:** ADMIN KS (type=2) with `ADMIN_BASE`, `ADMIN_USER_ADD`, `ADMIN_USER_UPDATE`, and `ADMIN_USER_DELETE` permissions  
- **Plugins:** No additional plugins required (core API v3 service)  
- **Session guide:** Generate a KS using `session.start` or `appToken.startSession` (see [Session Guide](/docs/getting-started/authentication/ks-overview))




### Authentication


All endpoints require an ADMIN KS (type=2) with appropriate permissions:

- **User CRUD:** `ADMIN_BASE` + `ADMIN_USER_ADD/UPDATE/DELETE` permissions
- **User Role CRUD:** `ADMIN_BASE` + `ADMIN_ROLE_ADD/UPDATE/DELETE` permissions
- **Group membership:** `CONTENT_MANAGE_ASSIGN_USER_GROUP` permission

Generate an ADMIN KS via `session.start` (see [Session Guide](/docs/getting-started/authentication/ks-overview)) or `appToken.startSession` (see [AppTokens Guide](/docs/getting-started/authentication/app-tokens-overview)).


```bash
# Set up environment
export KALTURA_SERVICE_URL="https://www.kaltura.com/api_v3"
```