---
title: "Create User"
method: POST
path: "/v1/organizations/{organization}/users"
tags: ["ClientService"]
---

# Create User

`POST /v1/organizations/{organization}/users`

## Request

- Base URL: `https://api.thirdfort.dev/client/api`
- URL: `https://api.thirdfort.dev/client/api/v1/organizations/{organization}/users`
- Auth: HTTP bearer

Creates a new User and sends them an invitation to join the specified organization. The user is created in the INVITED state and becomes ACTIVE once they accept the invitation.

## Path parameters

- `organization` string, required

## Query parameters

- `skipInvitation` boolean

## Request body

- User: A [User](#/schemas/User) represents a member of an Organization who can interact with the Thirdfort platform. Users are created in the INVITED state. They become ACTIVE when they first interact with the API. Integrations can supply a User resource name in 'on_behalf_of' fields to attribute actions to individual users.
  - `name` string: The unique resource name of the user. Format: `organizations/{organization}/users/{user}`. This field is system-generated and immutable.
  - `email` string, required: Required. The email address of the user. The invitation to join the organization is sent to this address. Must be a valid RFC 5322 compliant email address. Must not already be in use by another user on the platform, including users in other organizations; creation fails if it is. This field is immutable after creation.
  - `displayName` string: Optional. The human readable name of the user. For a human user, this would be their full name. For other entities, this is a descriptive name that can be used to identify them, such as "ACME Integrations Service Account".
  - `state` 'STATE_UNSPECIFIED' | 'ACTIVE' | 'INACTIVE' | 'INVITED' | 'DELETED': The lifecycle state of the user. - STATE_UNSPECIFIED: Default value. This value is unused. - ACTIVE: The user is active and can interact with the API. - INACTIVE: The user has been deactivated and cannot interact with the API. - INVITED: The user has been invited but has not yet interacted with the API. They become ACTIVE when they first interact with the API. - DELETED: The user has been deleted and cannot interact with the API.
  - `lastSeen` string, date-time: The last time the user interacted with the API.
  - `deleteTime` string, date-time: The time at which the user was soft-deleted. Only set for soft-deleted users.

## Response `200`

A successful response.

- User: A [User](#/schemas/User) represents a member of an Organization who can interact with the Thirdfort platform. Users are created in the INVITED state. They become ACTIVE when they first interact with the API. Integrations can supply a User resource name in 'on_behalf_of' fields to attribute actions to individual users.
  - `name` string: The unique resource name of the user. Format: `organizations/{organization}/users/{user}`. This field is system-generated and immutable.
  - `email` string, required: Required. The email address of the user. The invitation to join the organization is sent to this address. Must be a valid RFC 5322 compliant email address. Must not already be in use by another user on the platform, including users in other organizations; creation fails if it is. This field is immutable after creation.
  - `displayName` string: Optional. The human readable name of the user. For a human user, this would be their full name. For other entities, this is a descriptive name that can be used to identify them, such as "ACME Integrations Service Account".
  - `state` 'STATE_UNSPECIFIED' | 'ACTIVE' | 'INACTIVE' | 'INVITED' | 'DELETED': The lifecycle state of the user. - STATE_UNSPECIFIED: Default value. This value is unused. - ACTIVE: The user is active and can interact with the API. - INACTIVE: The user has been deactivated and cannot interact with the API. - INVITED: The user has been invited but has not yet interacted with the API. They become ACTIVE when they first interact with the API. - DELETED: The user has been deleted and cannot interact with the API.
  - `lastSeen` string, date-time: The last time the user interacted with the API.
  - `deleteTime` string, date-time: The time at which the user was soft-deleted. Only set for soft-deleted users.

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/thirdfort/apis/thirdfort-client-api.md) - [All operations](https://skmtc.dev/thirdfort/apis/thirdfort-client-api/llms.txt) - [OpenAPI document](https://skmtc.dev/thirdfort/apis/thirdfort-client-api/revisions/26eb85e05917?raw)