UNunqork
Users

Create User

Changed on

Creates a new user. If userId is not specified, it is auto-generated and returned.

Authorization Required:

  • Designer Administrator
post/users

Request

Query parameters

shouldNotifyboolean

Whether to notify the user via email of their temporary password.

skipTemporaryPasswordboolean

Whether to set the user's password as permanent immediately. A password must be provided in the body if this flag is set. This flag cannot be used if "shouldNotify" is also set.

Request body

userIdstring

The userId can only include letters, numbers, and the following characters @,+-_. plus letters from non-Latin scripts. Forward slashes are rejected with 400 Forward slashes are not allowed in user ID. Stored lowercased and trimmed, so the value returned may differ from the value sent.

namestring required

The name can only include letters, numbers, and the following characters @,+-_.'

emailstring email required

Quotes and special characters "(),:;<>@[]\ are not allowed. The local portion of the email (e.g. local@domain.com) must be > 0 characters and < 64 charaters. There cannot be consecutive dots (e.g. ..) in the email

phonestring

Must be a valid US phone number unless the country code is specified, in which case it is validated with libphonenumber-js

rolestring

One of the roles configured in Unqork

expressRolesstring[]

Express roles configured in Unqork. Every name is validated against the environment's roles - an unknown name is rejected with 400 Role not found. When omitted or empty, the deprecated role value is used to populate it.

groupsstring[]

List of groups configured in Unqork OR comma-separated list of groups configured in Unqork (e.g. "group1,group2"). Every group must already exist or the request is rejected. An empty string or null is equivalent to an empty array.

applicationRolesobject

Map of applications to roles OR comma-separated list of application-role mappings (e.g. "application1:role1,application2:role2")

passwordstring password

Complexity is enforced from the environment's password requirements, so the effective bounds are per-environment rather than fixed. Read that configuration for the values that apply; the platform defaults are a minimum length of 12, a maximum of 64, and at least one lowercase letter, one uppercase letter, one number, and one symbol. Service users (isServiceUser: true) are the exception - their minimum length is forced to 32 and their maximum to 64, overriding whatever the environment configures, and all four character classes are always required.

isServiceUserboolean
...customAttributesstring

Custom attributes can be included as additional keys in the request body. Only string values of custom attributes are supported - an object value is rejected with 400 Invalid attribute "<key>": Object not allowed. Reserved keys are silently dropped rather than rejected, so a custom attribute must not reuse one of: userId, email, phone, name, role, password, created, modified, passwordHash, passwordHistory, passwordStatus, passwordExpiry, credentialExpired, groups, applicationRoles, lastLogin, isServiceUser, designerRoles, expressRoles, isUserLocked, description, clientSecret.

Response

User created

userIdstring required
namestring required
emailstring required
phonestring
rolestring

One of the roles configured in Unqork

expressRolesstring[]

Express roles configured in Unqork

groupsstring[]

List of groups configured in Unqork

applicationRolesobject

Map of applications to roles

createdstring date-time required
modifiedstring date-time required
isServiceUserboolean
lastLoginstring date-time
...customAttributesstring

Custom attributes will be included as additional keys in the response body.

Changes