---
title: "Create a user with the provided short name as the owning organization (accessible to Secretariat or target organization Admin)"
method: POST
path: "/registry/org/{shortname}/user"
tags: ["Registry User"]
---

# Create a user with the provided short name as the owning organization (accessible to Secretariat or target organization Admin)

`POST /registry/org/{shortname}/user`

<h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the target organization</p>  <h2>Expected Behavior</h2>  <p><b>Admin User:</b> Creates a user for the Admin's organization</p>  <p><b>Secretariat:</b> Creates a user for any organization</p>

## Path parameters

- `shortname` string, required

## Headers

- `CVE-API-ORG` string, required
- `CVE-API-USER` string, required
- `CVE-API-KEY` string, required

## Request body

- CreateRegistryUserRequestJson — unresolved $ref

## Response `200`

Returns the new user information (with the secret)

- CreateRegistryUserResponseJson — unresolved $ref

## Other responses

- `400` — Bad Request
- `401` — Not Authenticated
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-05-19** `6dee7b4332bd` — 2 info
  - added the media type `example` to the request body
  - added the media type `example` for the response with the status `200`
- **2025-11-04** `26ede34bbf48` — 1 info
  - endpoint added
- **2025-10-14** `2c44a137d9b0` — 1 breaking
  - api path removed without deprecation
- **2025-09-22** `63c3d9620e8a` — 4 breaking, 8 info
  - added the new required `header` request parameter `CVE-API-KEY`
  - added the new required `header` request parameter `CVE-API-ORG`
  - added the new required `header` request parameter `CVE-API-USER`
  - added required request body
  - …8 more
- **2025-09-19** `efebaec5edf0` — 2 breaking
  - removed the media type `example` from the request body
  - removed the media type `example` for the response with the status `200`

[Full history](https://skmtc.dev/cveproject/apis/cve-services-api/changes/registry/org/:shortname/user/post.md)

---

[API](https://skmtc.dev/cveproject/apis/cve-services-api.md) · [All operations](https://skmtc.dev/cveproject/apis/cve-services-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cveproject/cve-services-api/revisions/a0323331d921/schema)