--- title: "Creates a new User and sends them an invitation to join the specified organization, unless `skip_invitation` is true." method: POST path: "/v1alpha2/organizations/{organization}/users" tags: ["ClientService"] --- # Creates a new User and sends them an invitation to join the specified organization, unless \`skip_invitation\` is true. `POST /v1alpha2/organizations/{organization}/users` ## Request - Base URL: `https://api.thirdfort.dev/client/api` - URL: `https://api.thirdfort.dev/client/api/v1alpha2/organizations/{organization}/users` - Auth: HTTP bearer ## Path parameters - `organization` string, required ## Query parameters - `skipInvitation` boolean ## Request body - User: A [User](#/schemas/User) represents a member of an [Organization](#/schemas/Organization) who can interact with the Thirdfort platform. Users are created in the INVITED state. They become ACTIVE when they first interact with the API. Integrations can supply a User resource name in 'on_behalf_of' fields to attribute actions to individual users. - `name` string: The unique identifier for the [User](#/schemas/User). - `email` string, required: Required. The email address of the [User](#/schemas/User). Must not already be in use by another user on the platform, including users in other organizations; creation fails if it is. This field is immutable after creation: `UpdateUser` rejects `email` in its update mask. - `displayName` string: Optional. The human readable name of the [User](#/schemas/User). For a human user, this would be their full name. For other entities, this will be a descriptive name that can be used to identify them, such as "ACME Integrations Service Account". - `state` 'STATE_UNSPECIFIED' | 'ACTIVE' | 'INACTIVE' | 'INVITED' | 'DELETED': The state of the [User](#/schemas/User). - ACTIVE: The [User](#/schemas/User) is active and can interact with the API - INACTIVE: The [User](#/schemas/User) has been deactivated and cannot interact with the API - INVITED: The user has been invited but has not yet interacted with the API. They become ACTIVE when they first interact with the API. - DELETED: The [User](#/schemas/User) has been deleted and cannot interact with the API - `roleBindings` RoleBinding[]: List of [RoleBindings](#/schemas/RoleBinding) for this [User](#/schemas/User) if requested. - `principal` string, required: The name of the principal this role binding applies to, in the canonical form for its type e.g. organizations/foo/users/bar. Valid types are: [User](#/schemas/User), [Group](#/schemas/Group) (both assignable via CreateRoleBinding), and integrations (e.g. partners/foo/integrations/1), whose bindings are managed by the system when an integration is set up. - `role` 'ROLE_UNSPECIFIED' | 'role_global_admin' | 'role_organization_admin' | 'role_team_admin' | 'role_team_creator' | 'role_team_viewer' | 'role_team_approver' | 'role_team_manual_task_analyst' | 'role_ai_chat_usage' | 'role_partner_integration' | 'role_organization_integration' | 'role_complyadvantagesetting_admin' | 'role_screening_configuration_admin' | 'role_support' | 'role_tech' | 'role_global_viewer' | 'role_global_role_admin' | 'role_global_monitoring_admin' | 'role_organization_monitoring_viewer' | 'role_team_review_admin' | 'role_team_review_initiator' | 'role_team_reviewer' | 'role_team_manual_task_admin' | 'role_organization_compliance_admin' | 'role_advanced_aml_user' | 'role_secure_share_viewer' | 'role_team_integration' | 'role_organization_creator', required: Role defines the permissions that can be assigned via a RoleBinding. - `resource` string, required - `lastSeen` string, date-time: The last time the [User](#/schemas/User) interacted with the API. - `authenticationProviderType` 'TYPE_UNSPECIFIED' | 'AUTH0' | 'WORKOS' - `newNotificationRecipient` string: The [User](#/schemas/User) who inherited check notifications when this user was deleted. - `deleteTime` string, date-time: The time at which the [User](#/schemas/User) was soft-deleted. - `groupMemberships` string[]: List of [Groups](#/schemas/Group) this [User](#/schemas/User) is a member of. Populated only for the current user, empty when viewing other users. ## Response `200` A successful response. - User: A [User](#/schemas/User) represents a member of an [Organization](#/schemas/Organization) who can interact with the Thirdfort platform. Users are created in the INVITED state. They become ACTIVE when they first interact with the API. Integrations can supply a User resource name in 'on_behalf_of' fields to attribute actions to individual users. - `name` string: The unique identifier for the [User](#/schemas/User). - `email` string, required: Required. The email address of the [User](#/schemas/User). Must not already be in use by another user on the platform, including users in other organizations; creation fails if it is. This field is immutable after creation: `UpdateUser` rejects `email` in its update mask. - `displayName` string: Optional. The human readable name of the [User](#/schemas/User). For a human user, this would be their full name. For other entities, this will be a descriptive name that can be used to identify them, such as "ACME Integrations Service Account". - `state` 'STATE_UNSPECIFIED' | 'ACTIVE' | 'INACTIVE' | 'INVITED' | 'DELETED': The state of the [User](#/schemas/User). - ACTIVE: The [User](#/schemas/User) is active and can interact with the API - INACTIVE: The [User](#/schemas/User) has been deactivated and cannot interact with the API - INVITED: The user has been invited but has not yet interacted with the API. They become ACTIVE when they first interact with the API. - DELETED: The [User](#/schemas/User) has been deleted and cannot interact with the API - `roleBindings` RoleBinding[]: List of [RoleBindings](#/schemas/RoleBinding) for this [User](#/schemas/User) if requested. - `principal` string, required: The name of the principal this role binding applies to, in the canonical form for its type e.g. organizations/foo/users/bar. Valid types are: [User](#/schemas/User), [Group](#/schemas/Group) (both assignable via CreateRoleBinding), and integrations (e.g. partners/foo/integrations/1), whose bindings are managed by the system when an integration is set up. - `role` 'ROLE_UNSPECIFIED' | 'role_global_admin' | 'role_organization_admin' | 'role_team_admin' | 'role_team_creator' | 'role_team_viewer' | 'role_team_approver' | 'role_team_manual_task_analyst' | 'role_ai_chat_usage' | 'role_partner_integration' | 'role_organization_integration' | 'role_complyadvantagesetting_admin' | 'role_screening_configuration_admin' | 'role_support' | 'role_tech' | 'role_global_viewer' | 'role_global_role_admin' | 'role_global_monitoring_admin' | 'role_organization_monitoring_viewer' | 'role_team_review_admin' | 'role_team_review_initiator' | 'role_team_reviewer' | 'role_team_manual_task_admin' | 'role_organization_compliance_admin' | 'role_advanced_aml_user' | 'role_secure_share_viewer' | 'role_team_integration' | 'role_organization_creator', required: Role defines the permissions that can be assigned via a RoleBinding. - `resource` string, required - `lastSeen` string, date-time: The last time the [User](#/schemas/User) interacted with the API. - `authenticationProviderType` 'TYPE_UNSPECIFIED' | 'AUTH0' | 'WORKOS' - `newNotificationRecipient` string: The [User](#/schemas/User) who inherited check notifications when this user was deleted. - `deleteTime` string, date-time: The time at which the [User](#/schemas/User) was soft-deleted. - `groupMemberships` string[]: List of [Groups](#/schemas/Group) this [User](#/schemas/User) is a member of. Populated only for the current user, empty when viewing other users. ## Other responses - `default`: An unexpected error response. --- [API](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview.md) - [All operations](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview/llms.txt) - [OpenAPI document](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview/revisions/3446b9aefa90?raw)