v1/mgmt/user/createAuthorization
Descope Project ID and Management Key Project ID:Management Key as bearer token.
In: header
Request Body
application/json
1 <= lengthlength <= 254falseCustom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.
{
"attribute-key": "attribute-value"
}length <= 254length <= 254length <= 2541 <= lengthlength <= 254each AssociatedFamily carries its own roleNames and familyScopedAttributes
When true, setting custom attributes the project does not declare for users returns error E111843 listing them: the request fails and nothing is saved. When false (default), those keys are ignored. An attribute declared in the last few seconds may still be ignored.
Create a new user, using a valid management key.
This API endpoint will create a new user utilizing a valid management key.
This API endpoint allows you to configure all aspects of a user:
- loginId
- phone
- verified settings (phone, email) - one must be set to true
- displayName
- roleNames
- Tenant configurations - which tenantIds, which roleNames. The userTenants can include multiple items Ex:
"userTenants": [
{
"tenantId": "T2IMjmRfYTQHlbaastz3im59ERS3",
"roleNames": [
"Test"
]
},
{
"tenantId": "T2Igau6dX1R6SkomtFCdBLrc3r67",
"roleNames": [
"Test"
]
}Additionally, you can create a user with multiple login IDs by passing an array of loginIds in string format within the additionalIdentifiers key.
Next Steps
Once the user is created, the user can then login utilizing any sign-in api supported. This will then switch the user from invited to active.
See also
- See Manage User for further details on managing users.
- See The User Object for further details on the user object.
curl -X POST "https://api.descope.com/v1/mgmt/user/create" \ -H "Content-Type: application/json" \ -d '{}'{ "user": { "loginIds": [ "string" ], "userId": "string", "name": "string", "email": "string", "phone": "string", "verifiedEmail": true, "verifiedPhone": true, "roleNames": [ "string" ], "userTenants": [ { "tenantId": "string", "roleNames": [ "string" ], "tenantName": "string", "permissions": [ "string" ], "roleIds": [ "string" ] } ], "status": "string", "externalIds": [ "string" ], "picture": "string", "test": false, "customAttributes": { "attribute-key": "attribute-value" }, "createdTime": 0, "TOTP": false, "SAML": false, "OAuth": { "property1": false, "property2": false }, "webauthn": true, "password": true, "ssoAppIds": [ "string" ], "givenName": "string", "middleName": "string", "familyName": "string", "editable": true, "SCIM": true, "push": true, "permissions": [ "string" ], "OIDC": true, "consentExpiration": 0, "recoveryEmail": "string", "verifiedRecoveryEmail": true, "recoveryPhone": "string", "verifiedRecoveryPhone": true, "modifiedTime": 0, "roleIds": [ "string" ], "recoveryCodes": true, "dependent": true, "userFamilies": [ { "familyId": "string", "roleNames": [ "string" ], "permissions": [ "string" ], "familyScopedAttributes": {} } ], "lockReason": "string", "tempLockExpiration": 0, "scimTenantId": "string", "samlTenantId": "string", "oidcTenantId": "string", "consentTenantId": "string", "lastLoginTime": 0 }, "created": true}export interface Response {user?: {loginIds?: string[]userId?: stringname?: stringemail?: stringphone?: stringverifiedEmail?: booleanverifiedPhone?: booleanroleNames?: string[]userTenants?: UserTenants[]status?: stringexternalIds?: string[]picture?: stringtest?: boolean/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}createdTime?: numberTOTP?: booleanSAML?: booleanOAuth?: {[k: string]: boolean}webauthn?: booleanpassword?: booleanssoAppIds?: string[]givenName?: stringmiddleName?: stringfamilyName?: stringeditable?: booleanSCIM?: booleanpush?: booleanpermissions?: string[]OIDC?: booleanconsentExpiration?: numberrecoveryEmail?: stringverifiedRecoveryEmail?: booleanrecoveryPhone?: stringverifiedRecoveryPhone?: booleanmodifiedTime?: number/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match * roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]/** * whether the user has set up recovery codes */recoveryCodes?: booleandependent?: booleanuserFamilies?: UserFamilies[]lockReason?: stringtempLockExpiration?: number/** * scimTenantId is the tenant whose SCIM connection provisioned the user, empty when none or ambiguous. */scimTenantId?: string/** * samlTenantId is the tenant whose SAML SSO created the user or merged the user's login into it, empty when none or ambiguous. */samlTenantId?: string/** * oidcTenantId is the tenant whose OIDC SSO created the user or merged the user's login into it, empty when none or ambiguous. */oidcTenantId?: stringconsentTenantId?: string/** * lastLoginTime is the epoch time (in seconds) of the last time this user authenticated, 0 when the user has never logged in. * On a response that completes a sign-in - a flow, an OTP or password verification, an SSO exchange - this is the sign-in BEFORE * the current one, and it is 0 for a user signing in for the first time: the sign-in in progress is recorded after the response is * produced. Read the user again through Load User or My Details to get the sign-in that just completed. */lastLoginTime?: number}created?: boolean}export interface UserTenants {tenantId?: stringroleNames?: string[]tenantName?: stringpermissions?: string[]/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match * roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]}export interface UserFamilies {familyId?: stringroleNames?: string[]permissions?: string[]familyScopedAttributes?: {}}Search Users POST
Search users, using a valid management key.
Batch Create Users POST
### Batch Create Users, using a valid management key. This API endpoint will batch create new users utilizing a valid management key. This API endpoint allows you to configure all aspects of a user: - loginId - email - phone - verified settings (phone, email) - one must be set to true - displayName - roleNames - Tenant configurations - which tenantIds, which roleNames. The userTenants can include multiple items Ex: ``` "userTenants": [ { "tenantId": "T2IMjmRfYTQHlbaastz3im59ERS3", "roleNames": [ "Test" ] }, { "tenantId": "T2Igau6dX1R6SkomtFCdBLrc3r67", "roleNames": [ "Test" ] } ``` Additionally, you can create a user with multiple login IDs by passing an array of loginIds in string format within the `additionalIdentifiers` key. You can also decide whether to invite the users, configure the inviteUrl, and whether to send invites via email or SMS. When importing with hashed passwords, see [this guide](/migrate/custom#importing-passwords) for further detailed configuration of password hash formats. ### Next Steps Once the user is created, the user can then login utilizing any sign-in api supported. This will then switch the user from invited to active. ### See also - See [Manage User](/manage/users) for further details on managing users. - See [The User Object](/api/overview#the-user-object) for further details on the user object.