---
title: "Create a sub-user"
method: POST
path: "/sub-users"
tags: ["Sub-User Management"]
---

# Create a sub-user

`POST /sub-users`

## Request

- Base URL: `https://api.chat-data.com/api/v2`
- URL: `https://api.chat-data.com/api/v2/sub-users`
- Auth: HTTP bearer

Create a new sub-user for your company. Sub-users can log in to a branded portal on your custom domain and access their assigned chatbots.

Requires the SSO Login add-on (see [plans](/pricing)) and a workspace API key; without the add-on, or with a chatbot-scoped key, the request gets a 403.

Your workspace's SSO company must exist and have a login domain before you can create sub-users. The sub-user's email must be unique within the company. Creating a sub-user sends no email.

## Request body

- object
  - `email` string, email, required: The sub-user's email address, stored in lowercase. It must be unique within the company, and for a sub-user without a password (who signs in by magic link) the mailbox must accept mail.
  - `name` string: The sub-user's display name. HTML tags are stripped.
  - `password` string: Optional password for email/password login. It must satisfy at least three of the following - at least 8 characters, an uppercase letter, a lowercase letter, a number, a special character. Without a password the sub-user signs in by magic link (or Google, when enabled).
  - `chatbotIds` string[], required: Array of chatbot IDs to assign to this sub-user. All IDs must belong to chatbots in your workspace. Duplicates are automatically removed.
  - `permissions` string[]: Permissions granted to the sub-user. Defaults to the company's default permission if not provided. Invalid values are silently removed; if none of the provided values is valid, the request fails.
  - `analyticsDashboardSections` string[]: Analytics dashboard sections visible to the sub-user. Defaults to the company's configured sections if not provided. Unknown section names are ignored.
  - `googleEnabled` boolean: Whether to enable Google sign-in for this sub-user. It is enabled automatically if the company has Google sign-in configured.

## Response `201`

Sub-user created successfully.

- SubUserObject
  - `_id` string, required: The unique identifier of the sub-user.
  - `company` string, required: The ID of the company this sub-user belongs to.
  - `email` string, email, required: The sub-user's email address.
  - `name` string: The sub-user's display name.
  - `avatar` string: URL of the sub-user's avatar image, or an empty string if none is set.
  - `chatbotIds` object[], required: The assigned chatbots, each with its `_id` and `name`.
    - `_id` string: The chatbot ID.
    - `name` string: The chatbot name.
  - `permissions` string[], required: Permissions granted to this sub-user.
  - `analyticsDashboardSections` string[]: Analytics dashboard sections visible to this sub-user.
  - `hasPassword` boolean, required: Whether the sub-user has a password configured (the actual password is never returned).
  - `hasGoogle` boolean, required: Whether the sub-user has signed in with a linked Google account (the Google ID is never returned). It stays `false` when Google sign-in is only enabled.
  - `createdAt` string, date-time: Timestamp when the sub-user was created.
  - `lastLoginAt` string, date-time: Timestamp of the sub-user's last sign-in. Absent until they first sign in.

## Other responses

- `400`: The sub-user could not be created. For example: `email` is missing, invalid or (for a sub-user without a password) not deliverable, `chatbotIds` is empty or contains an ID that is not a chatbot in your workspace, the workspace has no SSO company or the company has no login domain, `name` is not a string or is longer than 100 characters, none of the given `permissions` is valid, the password is too weak, or a sub-user with this email already exists.
- `401`: Authentication failed: the `Authorization` header is missing or not in the `Bearer <key>` format, the API key does not exist, its workspace is unavailable or has no owner, or the workspace's plan does not include API access. `message` says which.
- `403`: The request used a chatbot-scoped API key (`This operation requires a user-level API key, not a chatbot-specific key`, with `status: error`), or the workspace does not have the SSO Login add-on (`SSO Login is unavailable with your current plan`, with no `status` field).
- `429`: The workspace sent more than 600 API requests in the last minute. Wait the number of seconds given in the `Retry-After` header (and in `message`) before retrying.
- `500`: An unexpected error occurred while processing the request; `message` contains the error.

---

[API](https://skmtc.dev/chat-data/apis/chat-data-api-schema-guide.md) · [All operations](https://skmtc.dev/chat-data/apis/chat-data-api-schema-guide/llms.txt) · [OpenAPI document](https://skmtc.dev/chat-data/apis/chat-data-api-schema-guide/revisions/72871007f7f0?raw)