OPopal
service-users

Create service user

Changed on

Creates a new service user (a non-human identity owned by a team). Mirrors the GraphQL createServiceUser mutation; admin-only.

The returned User object is the newly created service user and is a regular User row — read it later via GET /users/{user_id}, delete it with DELETE /users/{user_id}, and manage its tags via the usual /users/{user_id}/tags endpoints.

Role grants are a separate concern. To grant a service user access to resources or groups, use POST /role-assignments (or the per-pair endpoints such as /resources/{id}/users/{id}). Keeping role assignments out of this request body means each grant stays independently addressable — the shape Terraform and other declarative clients prefer, with no field here that would silently drift when a grant is added or revoked through a different code path.

Automations are not configurable here either. The GraphQL mutation accepts a wide typed-union of automation configuration; that surface is intentionally omitted from this REST endpoint for the same reason. Service users created through this endpoint start with no automations.

post/service-users

Request

  • Base URL
    https://api.opal.dev/v1
  • Auth
    HTTP bearer

Request body

namestring required

The display name of the service user.

owner_idstring uuid required

The ID of the owner (team of record) that owns the service user. Must reference an existing owner in the caller's organization.

Example request

{
  "name": "paladin-prod",
  "owner_id": "7c86c85d-0651-43e2-a748-d69d658418e8"
}

Response

The created service user.

user_idstring uuid required

The ID of the user.

emailstring required

The email of the user.

full_namestring required

The full name of the user.

first_namestring required

The first name of the user.

last_namestring required

The last name of the user.

positionstring required

The user's position.

manager_idstring uuid nullable

The ID of the user's manager. Null if the user has no manager.

hr_idp_status'ACTIVE' | 'SUSPENDED' | 'DEPROVISIONED' | 'DELETED' | 'NOT_FOUND'

User status pulled from an HR/IDP provider.

Example response

{
  "user_id": "29827fb8-f2dd-4e80-9576-28e31e9934ac",
  "email": "john.doe@company.dev",
  "full_name": "John Doe",
  "first_name": "John",
  "last_name": "Doe",
  "position": "Engineer"
}

Changes