Create User

Creates a new user in the caller’s org.

The registration flow this user will go through depends on the registration kind specified:

• If Direct, we orchestrate the user’s registration: he will receive an email from us directly. Then be redirected to our dashboard to finish registration and onboard there. This is only available for CustomerEmployee. This is for users meant to use our dashboard directly (in addition to custom apps you may build).
• if Delegated, you orchestrate the user’s registration: he won’t receive an email from us. It’s your responsibility to verify your user’s identity & email, before you programmatically kick-off their registration (cf Delegated Registration doc). This is available for either CustomerEmployee or EndUser. This is for users meant to only use your own apps (not our dashboard), who should not interact with us directly.

If registration is unspecified, the default behaviour depends on the user kind:

• CustomerEmployee: defaults to Direct registration: sends a registration email from us.
• EndUser: defaults to Delegated registration (only option for those): does not send a registration email.

Permission-wise, when the new user gets created:

• CustomerEmployee hold no permissions upon creation. Use permission endpoints to grant some.
• EndUser hold the default ManagedDefaultEndUserAccess which is granted by default to all EndUsers. Use permission endpoints to update this default end-user permission. (cf Managed Permissions)

POST /auth/users

Create User

cURL

curl --request POST \
  --url https://api.dfns.io/auth/users \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "email": "<string>",
  "externalId": "<string>",
  "isSSORequired": false,
  "registration": "Direct"
}
'

200

{
  "username": "<string>",
  "name": "<string>",
  "userId": "us-6b58p-r53sr-rlrd3l5cj3uc4ome",
  "kind": "TenantUser",
  "credentialUuid": "<string>",
  "isActive": true,
  "isServiceAccount": true,
  "isRegistered": true,
  "isSSORequired": true,
  "permissionAssignments": [
    {
      "permissionName": "<string>",
      "permissionId": "pm-37vj4-jkr4l-lc9945spfftkne57",
      "assignmentId": "as-1vcmc-qrek0-6b4vii9pln60907e",
      "operations": [
        "<string>"
      ]
    }
  ],
  "credentialId": "<string>",
  "orgId": "or-30tnh-itmjs-s235s5ontr3r23h2",
  "tenantId": "acct-24hka-dhili-9hgvdlvr1ohpibp4",
  "permissions": [
    "<string>"
  ]
}

Authentication

✅ Tenant User (TenantUser)
✅ Organization User (CustomerEmployee)
❌ End User (EndUser)
❌ Personal Access Token not allowed
✅ Service Account

Required Permissions

Auth:Users:Create: Always required.

Authorizations

Authorization · string · header · required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

X-DFNS-USERACTION · string · header · required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Body

application/json

email · string · required

For CustomerEmployee kind, it needs to be the email address of the new user. For EndUser kind, it can be a username/identifier (any unique string accepted, e.g. your internal user ID or email).

Minimum string length: 2

kind · enum<string> · required

The kind of user being created. It can be "CustomerEmployee" or "EndUser".

Available options: CustomerEmployee, EndUser

externalId · string

Value that can be used to correlate the entity with an external system.

isSSORequired · boolean · default: false

Defaults to false. If set to true, the user will have to authenticate via SSO. Can only be set to true for kind: CustomerEmployee.

registration · enum<string> · default: Direct

Controls the kind of registration flow this user will go through. Can be "Direct" or "Delegated". More details in endpoint description.

Available options: Direct, Delegated

Response

200 - application/json

Success

username · string · required

Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email).

name · string · required

Display name of the user.

userId · string · required

User id.

Required string length: 1 - 64

Pattern: ^us-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"us-6b58p-r53sr-rlrd3l5cj3uc4ome"

kind · enum<string> · required

User kind.

Available options: TenantUser, CustomerEmployee, EndUser

credentialUuid · string · required

UUID of the user's primary credential.

isActive · boolean · required

Whether the user is active.

isServiceAccount · boolean · required

Whether the user is a service account.

isRegistered · boolean · required

Whether the user has completed registration.

isSSORequired · boolean · required

Whether the user must authenticate via SSO.

permissionAssignments · object[] · required

Permissions (roles) assigned to the user.

Show child attributes

credentialId · string

The credential id used for user-action signing, derived as base64url(sha256(publicKey)).

orgId · string

Organization id.

Required string length: 1 - 64

Pattern: ^or-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"or-30tnh-itmjs-s235s5ontr3r23h2"

tenantId · string

Tenant id.

Required string length: 1 - 64

Pattern: ^acct-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"acct-24hka-dhili-9hgvdlvr1ohpibp4"

permissions · string[]

@deprecated - Flat list of API operations the user has access to.