---
title: "Create a new user"
method: POST
path: "/v2/users"
tags: ["Users"]
---

# Create a new user

`POST /v2/users`

## Request

- Base URL: `https://api.byndid.com`
- URL: `https://api.byndid.com/v2/users`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/docs/v2/users/post.ts> (a function with typed inputs; its response is checked against the schema)

To create a user, send a POST request to `/v2/users`. Values in the request body for read-only fields get ignored.
If the request conflicts with an existing resource, you'll receive a 409 error.
When the user gets created, they'll receive a Beyond Identity enrollment email sent to the email address in the request.

## Request body

- object: Request for CreateUser.
  - `user` User, required: A user is a member of an organization that uses Beyond Identity.
    - `id` string: A unique identifier for the user within a tenant that is automatically generated on creation. This field is immutable and read-only.
    - `create_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets created. This field is immutable and read-only.
    - `update_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets updated. This field is immutable and read-only.
    - `last_auth_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user last authenticated. This field is immutable and read-only.
    - `tenant_id` string: A unique identifier for the user's tenant that is set automatically on creation. This field is immutable and read-only.
    - `external_id` string: A required unique identifier for the user within the tenant.
    - `email_address` string: A required email address serving as primary contact for user.
    - `username` string: A required username for the user.
    - `display_name` string: A required human-readable name for the user that is used for display purposes.
    - `state` 'ACTIVE' | 'SUSPENDED' | 'DELETED': State of the user that gets updated automatically when the user is updated. This field is read-only.
    - `source` string: The source that created the user. This field is immutable and read-only.
    - `has_active_passkey` boolean: A flag representing if the user has at least one device credential in an ACTIVE state. It's updated automatically when the user creates or revokes any passkeys. This field is read-only.

## Response `200`

The response is a JSON object containing standard user attributes.

- User: A user is a member of an organization that uses Beyond Identity.
  - `id` string: A unique identifier for the user within a tenant that is automatically generated on creation. This field is immutable and read-only.
  - `create_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets created. This field is immutable and read-only.
  - `update_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets updated. This field is immutable and read-only.
  - `last_auth_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user last authenticated. This field is immutable and read-only.
  - `tenant_id` string: A unique identifier for the user's tenant that is set automatically on creation. This field is immutable and read-only.
  - `external_id` string: A required unique identifier for the user within the tenant.
  - `email_address` string: A required email address serving as primary contact for user.
  - `username` string: A required username for the user.
  - `display_name` string: A required human-readable name for the user that is used for display purposes.
  - `state` 'ACTIVE' | 'SUSPENDED' | 'DELETED': State of the user that gets updated automatically when the user is updated. This field is read-only.
  - `source` string: The source that created the user. This field is immutable and read-only.
  - `has_active_passkey` boolean: A flag representing if the user has at least one device credential in an ACTIVE state. It's updated automatically when the user creates or revokes any passkeys. This field is read-only.

## Other responses

- `400`: Bad request.
- `401`: Unauthorized.
- `403`: Forbidden.
- `409`: Conflict.
- `429`: Rate limit exceeded.
- `500`: Server error.

---

[API](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api.md) - [All operations](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/llms.txt) - [OpenAPI document](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/revisions/562e14b2e4ba?raw)