---
type: api
title: Creates a new user
description: Creates a new user.
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/cloud-enterprise/v4/operation/operation-create-user
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/cloud-enterprise/v4/operation/operation-create-user
products:
  - Elastic Cloud Enterprise
---

# Creates a new user

Authentication: required

## Paths

- `POST` `/users`

## Description

Creates a new user.

## Request body

The user to create

`application/json`

- `user_name` (string) — required
  The user's identifier
- `security` (object) — required
  A user's security information
  - `roles` (string[]) — optional
    The set of roles assigned to a user
  - `permissions` (string[]) — optional
    The distinct set of permissions allowed by the user's roles. These correspond to operationId values in the OpenAPI definition.
  - `elevated_permissions` (object) — optional
    A user's elevated permissions status
    - `enabled` (boolean) — required
      True if the user has elevated permissions
    - `expires_at` (string · format: date-time) — optional
      The time at which the user's elevated permissions expire
  - `password` (string) — optional
    The user's password. Only used when modifying a user.
  - `enabled` (boolean) — optional
    True if the user is enabled
  - `security_realm` (object) — optional
    The security realm the user belongs to
    - `type` (enum) — required
      The type of the security realm
      Values: `native`, `ldap`, `saml`, `active_directory`
    - `id` (string) — required
      The identifier for the security realm
- `metadata` (object) — optional
  Metadata for a user
  - `created_by` (string) — optional
    The Id of the user that created this user
  - `created_at` (string · format: date-time) — optional
    The date and time when the user was created
  - `updated_by` (string) — optional
    The Id of the user that last updated this user
  - `updated_at` (string · format: date-time) — optional
    The date and time when the user was last updated
  - `first_login_at` (string · format: date-time) — optional
    The date and time when the user first logged in
  - `last_login_at` (string · format: date-time) — optional
    The date and time when the user last logged in
- `full_name` (string) — optional
  The user's optional full name
- `email` (string) — optional
  The user's optional email address
- `builtin` (boolean) — optional
  True if the user is a built-in read-only user

## Responses

#### `200`

User successfully created

`application/json`

- `user_name` (string)
  The user's identifier
- `security` (object)
  A user's security information
  Same fields as `security`
- `metadata` (object)
  Metadata for a user
  - `created_by` (string)
    The Id of the user that created this user
  - `created_at` (string · format: date-time)
    The date and time when the user was created
  - `updated_by` (string)
    The Id of the user that last updated this user
  - `updated_at` (string · format: date-time)
    The date and time when the user was last updated
  - `first_login_at` (string · format: date-time)
    The date and time when the user first logged in
  - `last_login_at` (string · format: date-time)
    The date and time when the user last logged in
- `full_name` (string)
  The user's optional full name
- `email` (string)
  The user's optional email address
- `builtin` (boolean)
  True if the user is a built-in read-only user
#### `400`

* The provided user name is invalid. Check that it is not empty and it does not contain special characters. (code: `user.user_name.invalid`)
* Some of the provided roles are invalid. (code: `user.roles.invalid`)
* Some of the provided roles are forbidden. (code: `user.roles.forbidden`)
* Trying to set a restricted field. (code: `user.restricted_field`)

`application/json`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `409`

The username is already in use. (code: `user.user_name.conflict`)

`application/json`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code examples

#### curl

```curl
curl -X POST "${API_URL}/users" \
  -u "${USERNAME}:${PASSWORD}" \
  -H "Content-Type: application/json" \
  -d '{
    "user_name": "string",
    "security": {}
  }'
```

## Response examples

#### 200

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "user_name": "string",
  "security": {
    "roles": [
      "string"
    ],
    "permissions": [
      "string"
    ],
    "elevated_permissions": {
      "enabled": false,
      "expires_at": "string"
    },
    "password": "string",
    "enabled": false,
    "security_realm": {
      "type": "native",
      "id": "string"
    }
  },
  "metadata": {
    "created_by": "string",
    "created_at": "string",
    "updated_by": "string",
    "updated_at": "string",
    "first_login_at": "string",
    "last_login_at": "string"
  },
  "full_name": "string",
  "email": "string",
  "builtin": false
}
```

#### 400

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "errors": [
    {
      "code": "string",
      "message": "string",
      "fields": [
        "string"
      ]
    }
  ]
}
```

#### 409

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "errors": [
    {
      "code": "string",
      "message": "string",
      "fields": [
        "string"
      ]
    }
  ]
}
```