CreateUser

Create a user and assign existing roles.

Requires access_control.create permission. No input or output blobs are used.

Parameters

Parameter	Type / required	Default and behavior
username	string / required	No default. At least 4 characters, no whitespace, and must not begin with an underscore.
password	string / required	No default. At least 10 characters, including a letter, a digit, and punctuation; whitespace is rejected.
roles	array of strings / required	No default. Every named role must exist. An empty array is accepted and grants no role permissions.
email	string / optional	Defaults to an empty string; no email-format validation is performed.

Details

Create roles first with CreateRole. Duplicate role names in the array are stored once. These password rules apply to this command and password updates; deployment bootstrap credentials have their own configuration rules.

Response and recovery

Successful creation returns status: 0. The response contains neither the password nor a session token. Use Authenticate to start a session.

Failure or empty result	Cause and recovery
Cannot create user: User already exists!	Choose a new username or update the existing account.
Role does not exist	Create the role or correct its name before retrying.
Username or password validation error	Apply the restrictions in the parameter table.

See Responses for validation, authentication, and permission error envelopes. Command errors use a negative status and an info message.

This operation changes access metadata during response processing. See Error phases and retrying writes before retrying a mixed query after a response or connection failure.

Examples

Add a User using CreateUser command:

[{
    "CreateUser": {
        "username": "john",
        "password": "love4Aperture!",
        "roles": ["admin", "user", "architect"],
        "email": "jfk@aperturedata.io"
    }
}]

Result from successfully adding a user:

[{
    "CreateUser": {
        "status": 0
    }
}]