# list all users
b2c am users list

# create a user
b2c am users create --mail user@example.com --first-name Jane --last-name Doe --org MyOrg

# get a user by login
b2c am users get user@example.com

# update a user
b2c am users update user@example.com --first-name Janet

# delete (disable) a user
b2c am users delete user@example.com

# reset a user to INITIAL state
b2c am users reset user@example.com

# list all AM roles
b2c am roles list

# list roles filtered by target type
b2c am roles list --target-type User

# get role details
b2c am roles get bm-admin

# grant a role to a user
b2c am roles grant user@example.com --role bm-admin

# grant a role with tenant scope
b2c am roles grant user@example.com --role bm-admin --scope tenant1,tenant2

# revoke a role
b2c am roles revoke user@example.com --role bm-admin

# revoke only specific scope
b2c am roles revoke user@example.com --role bm-admin --scope tenant1

# list organizations
b2c am orgs list

# list API clients
b2c am clients list

# create an API client
b2c am clients create --display-name "My Client" --org MyOrg

# reset API client password
b2c am clients password my-client-id

# list BM roles on an instance
b2c bm roles list --server my-sandbox.demandware.net

# get role details (with user list)
b2c bm roles get Administrator --expand users

# create a custom role
b2c bm roles create MyCustomRole --description "Custom role for content editors"

# delete a custom role (system roles cannot be deleted)
b2c bm roles delete MyCustomRole

# grant a BM role to a user on the instance
b2c bm roles grant user@example.com --role Administrator

# revoke a BM role from a user
b2c bm roles revoke user@example.com --role Administrator

# all commands support --json for machine-readable output
b2c bm roles list --json

# view permission summary
b2c bm roles permissions get Administrator

# export permissions to a JSON file for editing
b2c bm roles permissions get Administrator --output admin-perms.json

# edit the file, then apply
b2c bm roles permissions set Administrator --file admin-perms.json