---
type: api
title: Creates a new user
description: Creates a new user.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/cloud-enterprise/v4/operation/operation-create-user
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/cloud-enterprise/v4/operation/operation-create-user
products:
  - Elastic Cloud Enterprise
---

# Creates a new user

## Paths

- `POST` `/users`

## Description

Creates a new user.

## Authentication

- Basic: `Authorization: Basic <credentials>`
- Api key: `Authorization: <value>`

## Request body

The user to create

`application/json`

- `user_name` (string) — required
  The user's identifier
- `security` (object) — required
  A user's security information
  - `roles` (string[]) — optional
    The set of roles assigned to a user
  - `permissions` (string[]) — optional
    The distinct set of permissions allowed by the user's roles. These correspond to operationId values in the OpenAPI definition.
  - `elevated_permissions` (object) — optional
    A user's elevated permissions status
    - `enabled` (boolean) — required
      True if the user has elevated permissions
    - `expires_at` (string · format: date-time) — optional
      The time at which the user's elevated permissions expire
  - `password` (string) — optional
    The user's password. Only used when modifying a user.
  - `enabled` (boolean) — optional
    True if the user is enabled
  - `security_realm` (object) — optional
    The security realm the user belongs to
    - `type` (enum) — required
      The type of the security realm
      Values: `native`, `ldap`, `saml`, `active_directory`
    - `id` (string) — required
      The identifier for the security realm
- `metadata` (object) — optional
  Metadata for a user
  - `created_by` (string) — optional
    The Id of the user that created this user
  - `created_at` (string · format: date-time) — optional
    The date and time when the user was created
  - `updated_by` (string) — optional
    The Id of the user that last updated this user
  - `updated_at` (string · format: date-time) — optional
    The date and time when the user was last updated
  - `first_login_at` (string · format: date-time) — optional
    The date and time when the user first logged in
  - `last_login_at` (string · format: date-time) — optional
    The date and time when the user last logged in
- `full_name` (string) — optional
  The user's optional full name
- `email` (string) — optional
  The user's optional email address
- `builtin` (boolean) — optional
  True if the user is a built-in read-only user

## Responses

#### `200`

User successfully created

`application/json`

- `user_name` (string)
  The user's identifier
- `security` (object)
  A user's security information
  Same fields as `security`
- `metadata` (object)
  Metadata for a user
  - `created_by` (string)
    The Id of the user that created this user
  - `created_at` (string · format: date-time)
    The date and time when the user was created
  - `updated_by` (string)
    The Id of the user that last updated this user
  - `updated_at` (string · format: date-time)
    The date and time when the user was last updated
  - `first_login_at` (string · format: date-time)
    The date and time when the user first logged in
  - `last_login_at` (string · format: date-time)
    The date and time when the user last logged in
- `full_name` (string)
  The user's optional full name
- `email` (string)
  The user's optional email address
- `builtin` (boolean)
  True if the user is a built-in read-only user
#### `400`

* The provided user name is invalid. Check that it is not empty and it does not contain special characters. (code: `user.user_name.invalid`)
* Some of the provided roles are invalid. (code: `user.roles.invalid`)
* Some of the provided roles are forbidden. (code: `user.roles.forbidden`)
* Trying to set a restricted field. (code: `user.restricted_field`)

`application/json`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `409`

The username is already in use. (code: `user.user_name.conflict`)

`application/json`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code examples

#### curl

```curl
curl -X POST "${API_URL}/users" \
  -u "${USERNAME}:${PASSWORD}" \
  -H "Content-Type: application/json" \
  -d '{
    "user_name": "string",
    "security": {}
  }'
```