---
title: "Create a user."
method: POST
path: "/users.json"
tags: ["Users"]
---

# Create a user.

`POST /users.json`

## Request

- Base URL: `https://passbolt.local`
- URL: `https://passbolt.local/users.json`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/passbolt/apis/passbolt-api/docs/users.json/post.ts> (a function with typed inputs; its response is checked against the schema)

Only users with `admin` role can create other users.

## Request body

- UserAdd
  - `username` string, email, required
  - `role_id` string, uuid
  - `profile` object, required
    - `first_name` string, required
    - `last_name` string, required

## Response `200`

Operation is successful

- object
  - `header` Header, required
    - `id` string, uuid, required
    - `status` 'success' | 'error', required
    - `servertime` integer, required
    - `action` string, uuid, required
    - `message` string, required
    - `url` string, uri, required
    - `code` integer, required
  - `body` UserIndexAndView[], required
    - `is_mfa_enabled` boolean
    - `id` string, uuid, required
    - `role_id` string, uuid, required
    - `username` string, required
    - `active` boolean, required
    - `deleted` boolean, required
    - `created` string, date-time, required
    - `modified` string, date-time, required
    - `disabled` string, date-time, required
    - `profile` object
      - `id` string, uuid, required
      - `user_id` string, uuid, required
      - `first_name` string, required
      - `last_name` string, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
      - `avatar` object, required
        - `id` string, uuid
        - `profile_id` string, uuid
        - `created` string, date-time
        - `modified` string, date-time
        - `url` object, required
          - `medium` string, url, required
          - `small` string, url, required
    - `groups_users` GroupsUsersIndexAndView
      - `id` string, uuid, required
      - `group_id` string, uuid, required
      - `user_id` string, uuid, required
      - `is_admin` boolean, required
      - `created` string, date-time, required
      - `user` UserIndexAndView (recursive)
    - `gpgkey` Gpgkey
      - `id` string, uuid, required
      - `user_id` string, uuid, required
      - `armored_key` string, required
      - `bits` integer, required
      - `uid` string, required
      - `key_id` string, required
      - `fingerprint` string, required
      - `type` 'RSA' | 'ECC', required
      - `expires` string, date-time, required
      - `deleted` boolean, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
    - `role` Role
      - `id` string, uuid, required
      - `name` 'admin' | 'guest' | 'user', required
      - `description` string, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
    - `missing_metadata_key_ids` string[]
    - `last_logged_in` string, date-time

## Other responses

- `400`: Bad request
- `401`: Authentication required.

## Changes

- **2025-06-25** `829cf48ab700`: 1 info
  - added the optional property `body/items/missing_metadata_key_ids` to the response with the `200` status

[Operation history](https://skmtc.dev/passbolt/apis/passbolt-api/changes/users.json/post.md)

---

[API](https://skmtc.dev/passbolt/apis/passbolt-api.md) - [All operations](https://skmtc.dev/passbolt/apis/passbolt-api/llms.txt) - [OpenAPI document](https://skmtc.dev/passbolt/apis/passbolt-api/revisions/8d72215e2274?raw)