Create a new user
POST/users-srv/user/create/byadmin
Creates a new user account with admin-set password. The user account is immediately active and searchable.
Required Roles: admin, secondary_admin, or user_create
Key Features:
- User account is created immediately (unlike invitations)
- Admin sets the initial password
- User receives a notification when
notify_useristrue(email or SMS perprimaryType) {{login_link}}inUSER_CREATEDusesinitiate_login_urifrom the request when provided, otherwise a built/authz-srv/authzURL- User can change password after first login
Important
When
notify_user=true, cidaas generates a login link for the new user. In this scenario, additional OAuth parameters such asclient_idandresponse_typeare required for successful notification delivery.
Parameter dependency
| notify_user | client_id | response_type |
|---|---|---|
| false | Optional | Optional |
| true | Required | Required |
Conditional Required Fields
-
notify_user: false: Creates the user only. No notification email is sent. OAuth-related parameters are not required. -
notify_user: true(default): Creates the user, generates a notification email, and generates a login link. OAuth context (client_id,response_type) is required. -
client_id: Required whennotify_user=true. Identifies the application and is used when constructing the login URL in the notification email. It is not part of creating the user record itself. -
response_type: Required whennotify_user=true. Used only while generating the login link (authorization request). Recommended value:code. It is not required for creating the user record itself.
Common validation failures
| Error | Cause |
|---|---|
| AUTH10002 | response_type missing (or OAuth context incomplete) while generating the notification login link when notify_user=true |
| HTTP 400 | Required OAuth information missing for notification delivery |
initiate_login_uri: Recommended — configure on the app in app settings when notify_user is true. Details: Create User.
Request
Responses
- 200
- 400
- 401
- 409
- 417
OK
Bad Request
Unauthorized
Conflict
Expectation Failed