---
title: "Create a member"
method: POST
path: "/v0.1/merchants/{merchant_code}/members"
tags: ["Members"]
---

# Create a member

`POST /v0.1/merchants/{merchant_code}/members`

Create a merchant member.

## Path parameters

- `merchant_code` string, required

## Request body

- object
  - `is_managed_user` boolean — True if the user is managed by the merchant. In this case, we'll created a virtual user with the provided password and nickname.
  - `email` string, email, required — Email address of the member to add.
  - `password` string, password — Password of the member to add. Only used if `is_managed_user` is true. In the case of service accounts, the password is not used and can not be defined by the caller.
  - `nickname` string — Nickname of the member to add. Only used if `is_managed_user` is true. Used for display purposes only.
  - `roles` string[], required — List of roles to assign to the new member.
  - `metadata` Metadata — Set of user-defined key-value pairs attached to the object. Partial updates are not supported. When updating, always submit whole metadata.
  - `attributes` Attributes — Object attributes that are modifiable only by SumUp applications.

## Response `201`

Returns the Member object if the creation succeeded.

- Member — A member is user within specific resource identified by resource id, resource type, and associated roles.
  - `id` string, required — ID of the member.
  - `roles` string[], required — User's roles.
  - `permissions` string[], required — User's permissions.
  - `created_at` string, date-time, required — The timestamp of when the member was created.
  - `updated_at` string, date-time, required — The timestamp of when the member was last updated.
  - `user` MembershipUser — Information about the user associated with the membership.
    - `id` string, required — Identifier for the End-User (also called Subject).
    - `email` string, required — End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon this value being unique, for unique identification use ID instead.
    - `mfa_on_login_enabled` boolean, required — True if the user has enabled MFA on login.
    - `virtual_user` boolean, required — True if the user is a virtual user (operator).
    - `service_account_user` boolean, required — True if the user is a service account.
    - `disabled_at` string, date-time — Time when the user has been disabled. Applies only to virtual users (`virtual_user: true`).
    - `nickname` string — User's preferred name. Used for display purposes only.
    - `picture` string, uri — URL of the End-User's profile picture. This URL refers to an image file (for example, a PNG, JPEG, or GIF image file), rather than to a Web page containing an image.
    - `classic` MembershipUserClassic — Classic identifiers of the user.
      - `user_id` integer, required
  - `invite` Invite — Pending invitation for membership.
    - `email` string, email, required — Email address of the invited user.
    - `expires_at` string, date-time, required
  - `status` 'accepted' | 'pending' | 'expired' | 'disabled' | 'unknown', required — The status of the membership.
  - `metadata` Metadata — Set of user-defined key-value pairs attached to the object. Partial updates are not supported. When updating, always submit whole metadata.
  - `attributes` Attributes — Object attributes that are modifiable only by SumUp applications.

## Other responses

- `400` — Invalid request.
- `404` — Merchant not found.
- `429` — Too many invitations sent to that user. The limit is 10 requests per 5 minutes and the Retry-After header is set to the number of minutes until the reset of the limit.

## Changes

- **2025-10-29** `4dc4b073a6a9` — 1 warning, 1 info
  - removed the request property `is_service_account`
  - response property `permissions` deprecated
- **2025-03-26** `80a17713e7a8` — 2 info
  - added the new optional request property `is_service_account`
  - added the required property `user/service_account_user` to the response with the `201` status
- **2025-02-25** `cdadac3315a1` — 2 info
  - the endpoint scheme security `apiKey` was added to the API
  - the endpoint scheme security `oauth2` was added to the API
- **2025-01-10** `e521b5d95af5` — 1 info
  - api operation id `AddMerchantMember` removed and replaced with `CreateMerchantMember`

[Change history](https://skmtc.dev/sumup/apis/sumup-rest-api/changes/v0.1/merchants/:merchant_code/members/post.md)

---

[API](https://skmtc.dev/sumup/apis/sumup-rest-api.md) · [All operations](https://skmtc.dev/sumup/apis/sumup-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sumup/sumup-rest-api/revisions/d32eef8a3bd2/schema)