Skip to main content
POST
Create User

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Team keys must allow every team checked by the request. OAuth access depends on the user’s roles and resource access.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
email
string
required
firstName
string
lastName
string
role
enum<string>
Available options:
USER_ROLE_UNSPECIFIED,
USER_ROLE_ORG_MEMBER,
USER_ROLE_ORG_ADMIN,
USER_ROLE_ORG_GUEST
authMethod
enum<string> | null

Specifies the authentication method for a user. If unset, the org default applies. Set to MAGIC_LINK to allow the user to bypass SSO (e.g. guest or break-glass accounts).

Available options:
USER_AUTH_METHOD_UNSPECIFIED,
USER_AUTH_METHOD_MAGIC_LINK
pinFields
enum<string>[]

Profile fields to pin at creation. A pinned field is protected from automation (user ingestion) overwrites until it is released or replaced by a later deliberate edit. Only fields set by this request can be pinned: first_name, last_name. Without pins, creation seeds stay open for ingestion to enrich.

The governed user profile fields, which carry per-field provenance and edit protection.

Available options:
USER_PROFILE_FIELD_UNSPECIFIED,
USER_PROFILE_FIELD_FIRST_NAME,
USER_PROFILE_FIELD_LAST_NAME,
USER_PROFILE_FIELD_AVATAR_URL,
USER_PROFILE_FIELD_TIMEZONE,
USER_PROFILE_FIELD_LOCALE,
USER_PROFILE_FIELD_MANAGER,
USER_PROFILE_FIELD_DEPARTMENT,
USER_PROFILE_FIELD_JOB_TITLE,
USER_PROFILE_FIELD_PRIMARY_PHONE,
USER_PROFILE_FIELD_LIVE_AGENT_AVAILABILITY

Response

200 - application/json

Success

data
data · object