---
title: "POST /v2/users"
method: POST
path: "/v2/users"
---

# POST /v2/users

`POST /v2/users`

Create a new user.

## Request body

- CreateUserRequest — RPC requests and responses /////////////////////////// Required authorization: ``HasRight(ParticipantAdmin) OR IsAuthenticatedIdentityProviderAdmin(user.identity_provider_id)``
  - `user` User, required — Users and rights ///////////////// Users are used to dynamically manage the rights given to Daml applications. They are stored and managed per participant node.
    - `id` string, required — The user identifier, which must be a non-empty string of at most 128 characters that are either alphanumeric ASCII characters or one of the symbols "@^$.!`-#+'~_|:()". Required
    - `primaryParty` string — The primary party as which this user reads and acts by default on the ledger *provided* it has the corresponding ``CanReadAs(primary_party)`` or ``CanActAs(primary_party)`` rights. Ledger API clients SHOULD set this field to a non-empty value for all users to enable the users to act on the ledger using their own Daml party. Users for participant administrators MAY have an associated primary party. Modifiable Optional
    - `isDeactivated` boolean — When set, then the user is denied all access to the Ledger API. Otherwise, the user has access to the Ledger API as per the user's rights. Modifiable Optional
    - `metadata` ObjectMeta — Represents metadata corresponding to a participant resource (e.g. a participant user or participant local information about a party). Based on ``ObjectMeta`` meta used in Kubernetes API. See https://github.com/kubernetes/apimachinery/blob/master/pkg/apis/meta/v1/generated.proto#L640
      - `resourceVersion` string — An opaque, non-empty value, populated by a participant server which represents the internal version of the resource this ``ObjectMeta`` message is attached to. The participant server will change it to a unique value each time the corresponding resource is updated. You must not rely on the format of resource version. The participant server might change it without notice. You can obtain the newest resource version value by issuing a read request. You may use it for concurrent change detection by passing it back unmodified in an update request. The participant server will then compare the passed value with the value maintained by the system to determine if any other updates took place since you had read the resource version. Upon a successful update you are guaranteed that no other update took place during your read-modify-write sequence. However, if another update took place during your read-modify-write sequence then your update will fail with an appropriate error. Concurrent change control is optional. It will be applied only if you include a resource version in an update request. When creating a new instance of a resource you must leave the resource version empty. Its value will be populated by the participant server upon successful resource creation. Optional
      - `annotations` MapString
    - `identityProviderId` string — The ID of the identity provider configured by ``Identity Provider Config`` If not set, assume the user is managed by the default identity provider. Optional
    - `primaryPartyAuthentication` boolean — If set to true, the user may authenticate against the Ledger API by signing a Party JWT using the primary party's signing key. Modifiable Optional
  - `rights` Right[] — The rights to be assigned to the user upon creation, which SHOULD include appropriate rights for the ``user.primary_party``. Optional: can be empty
    - `kind` union — Required
      - object
        - `CanActAs` CanActAs, required
          - `value` CanActAs1, required
            - `party` string, required — The right to authorize commands for this party. Required
      - object
        - `CanExecuteAs` CanExecuteAs, required
          - `value` CanExecuteAs1, required
            - `party` string, required — The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
      - object
        - `CanExecuteAsAnyParty` CanExecuteAsAnyParty, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
          - `value` CanExecuteAsAnyParty1, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
      - object
        - `CanReadAs` CanReadAs, required
          - `value` CanReadAs1, required
            - `party` string, required — The right to read ledger data visible to this party. Required
      - object
        - `CanReadAsAnyParty` CanReadAsAnyParty, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
          - `value` CanReadAsAnyParty1, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
      - object
        - `Empty` Empty8, required
      - object
        - `IdentityProviderAdmin` IdentityProviderAdmin, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
          - `value` IdentityProviderAdmin1, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
      - object
        - `ParticipantAdmin` ParticipantAdmin, required — The right to administer the participant node.
          - `value` ParticipantAdmin1, required — The right to administer the participant node.

## Response `200`

- CreateUserResponse
  - `user` User, required — Users and rights ///////////////// Users are used to dynamically manage the rights given to Daml applications. They are stored and managed per participant node.
    - `id` string, required — The user identifier, which must be a non-empty string of at most 128 characters that are either alphanumeric ASCII characters or one of the symbols "@^$.!`-#+'~_|:()". Required
    - `primaryParty` string — The primary party as which this user reads and acts by default on the ledger *provided* it has the corresponding ``CanReadAs(primary_party)`` or ``CanActAs(primary_party)`` rights. Ledger API clients SHOULD set this field to a non-empty value for all users to enable the users to act on the ledger using their own Daml party. Users for participant administrators MAY have an associated primary party. Modifiable Optional
    - `isDeactivated` boolean — When set, then the user is denied all access to the Ledger API. Otherwise, the user has access to the Ledger API as per the user's rights. Modifiable Optional
    - `metadata` ObjectMeta — Represents metadata corresponding to a participant resource (e.g. a participant user or participant local information about a party). Based on ``ObjectMeta`` meta used in Kubernetes API. See https://github.com/kubernetes/apimachinery/blob/master/pkg/apis/meta/v1/generated.proto#L640
      - `resourceVersion` string — An opaque, non-empty value, populated by a participant server which represents the internal version of the resource this ``ObjectMeta`` message is attached to. The participant server will change it to a unique value each time the corresponding resource is updated. You must not rely on the format of resource version. The participant server might change it without notice. You can obtain the newest resource version value by issuing a read request. You may use it for concurrent change detection by passing it back unmodified in an update request. The participant server will then compare the passed value with the value maintained by the system to determine if any other updates took place since you had read the resource version. Upon a successful update you are guaranteed that no other update took place during your read-modify-write sequence. However, if another update took place during your read-modify-write sequence then your update will fail with an appropriate error. Concurrent change control is optional. It will be applied only if you include a resource version in an update request. When creating a new instance of a resource you must leave the resource version empty. Its value will be populated by the participant server upon successful resource creation. Optional
      - `annotations` MapString
    - `identityProviderId` string — The ID of the identity provider configured by ``Identity Provider Config`` If not set, assume the user is managed by the default identity provider. Optional
    - `primaryPartyAuthentication` boolean — If set to true, the user may authenticate against the Ledger API by signing a Party JWT using the primary party's signing key. Modifiable Optional

## Other responses

- `400` — Invalid value, Invalid value for: body
- `default`

---

[API](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints.md) · [All operations](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/canton/json-ledger-api-http-endpoints/revisions/296292e8b8f1/schema)