---
title: "Create a user"
method: POST
path: "/admin/users"
tags: ["Admin"]
---

# Create a user

`POST /admin/users`

## Request

- Base URL: `https://cloud.kaneo.app/api`
- URL: `https://cloud.kaneo.app/api/admin/users`
- Auth: HTTP bearer

Create an account with an instance role. No password is set or returned. When password sign-in is available, the user is emailed a single-use link, valid for 2 days, to choose their own password. When password registration or the login form is disabled, the account is created with a verified email so the user can sign in with single sign-on, and no email is sent. Registration restrictions do not apply to administrators. Requires the `users:create` instance permission; API keys are rejected.

## Request body

- object
  - `name` string, required
  - `email` string, email, required: The new user's email address. They sign in with it and receive their password link there.
  - `role` string: Instance role, as for updates. Defaults to the instance's default role for new users.

## Response `201`

The new user

- CreatedAdminUser
  - `user` AdminUser, required
    - `id` string, required
    - `name` string, required
    - `email` string, required
    - `emailVerified` boolean, required
    - `isAnonymous` boolean, required
    - `image` string, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `role` string, nullable, required
    - `banned` boolean, required
    - `banReason` string, nullable, required
    - `banExpires` string, date-time, nullable, required
    - `lastActiveAt` string, date-time, nullable, required: When one of the user's current sessions was last refreshed; null without a session.
    - `signInMethods` string[], required: Linked sign-in methods: `credential` (password), `github`, `google`, `discord`, or `custom` (OIDC).
  - `passwordSetupEmail` 'sent' | 'failed' | 'not_configured' | 'not_needed', required: Whether the link to choose a password was emailed: `not_configured` without SMTP, `not_needed` when the account is for single sign-on. The link itself is never returned.

## Other responses

- `400`: Invalid name, email, or role, or a disposable address
- `401`: Missing or invalid credentials
- `403`: The caller lacks the instance permission or is authenticated with an API key
- `409`: A user with this email already exists
- `429`: The API key exceeded its rate limit or usage quota. Wait the number of seconds in Retry-After before retrying. The X-RateLimit headers are sent only when the rate limit was hit.

## Changes

- **2026-10-27** `0f9a0a057a49`: 1 info
  - the `role` request property default value `user` was removed
- **2026-10-27** `8f3ec578c70a`: 3 breaking, 1 warning
  - removed the enum value `admin` of the request property `role`
  - removed the enum value `user` of the request property `role`
  - the `role` request property's minLength was increased from `0` to `1`
  - the `role` request property's maxLength was set to `64`
- **2026-10-27** `bbaae0ea62c6`: 1 info
  - endpoint added
- **2026-10-27** `93f78789100c`: 1 breaking
  - api removed without deprecation
- **2026-10-27** `720626ed550f`: 1 info
  - added the required property `user/isAnonymous` to the response with the `201` status

[Operation history](https://skmtc.dev/usekaneo/apis/kaneo-api/changes/admin/users/post.md)

---

[API](https://skmtc.dev/usekaneo/apis/kaneo-api.md) - [All operations](https://skmtc.dev/usekaneo/apis/kaneo-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usekaneo/apis/kaneo-api/revisions/741a49dfb347?raw)