1. Docs
  2. API Reference
  3. Create an Account identity

Create an Account identity

POST/portal/v1/accounts/{accountSlug}/identities

Creates an identity at the Account tier. When environment_id is supplied, a same-transaction EnvironmentMembership is created so the identity can sign into that Environment immediately; when omitted, the identity is created as an orphan in the directory and access is granted later via the membership endpoints. The Environment must belong to this Account (404). Returns 409 on a duplicate email and 400 when the supplied password is found in the breach list.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability identities.manageIdentities

Manage end-user identities across the account. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Request body

application/json

emailstring Required
first_namestring Required
last_namestring Required
passwordstring Optional

Initial password (8-64 chars). NIST SP 800-63B aligned — no composition rules. HaveIBeenPwned breach check runs server-side. Omit to create a passwordless identity (sign-in via SSO/social or forgot-password reset).

external_idstring Optional
metadataobject Optional
environment_idstring Optional

Optional Environment ID. When present, a same-transaction EnvironmentMembership row is created so the identity can sign into the named Environment immediately. Omit to create an orphan identity in the directory — the admin can grant access to one or more Environments later.

Responses

application/json

  • dataAccountIdentityDetailResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on.

403account.capability_requiredForbidden
When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

Returned object

AccountIdentityDetailResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/identities" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string",
    "first_name": "string",
    "last_name": "string",
    "password": "string",
    "external_id": "string",
    "metadata": {},
    "environment_id": "string"
  }'
Response
{
  "data": {
    "id": "string",
    "email": "string",
    "first_name": "string",
    "last_name": "string",
    "avatar_url": "string",
    "external_id": "string",
    "metadata": {},
    "is_active": false,
    "erased_at": "2026-04-20T12:00:00.000Z",
    "email_verified": false,
    "email_verified_at": "2026-04-20T12:00:00.000Z",
    "locked_until": "2026-04-20T12:00:00.000Z",
    "password_changed_at": "2026-04-20T12:00:00.000Z",
    "environment_membership_count": 0,
    "total_assignments": 0,
    "created_at": "2026-04-20T12:00:00.000Z",
    "environment_memberships": [
      {
        "id": "string",
        "environment_id": "string",
        "environment_slug": "string",
        "environment_name": "string",
        "application_slug": "string",
        "application_name": "string",
        "status": "active",
        "created_at": "2026-04-20T12:00:00.000Z",
        "assignment_count": 0
      }
    ]
  }
}
 Related endpoints
GETList identities in Account
POSTBulk-create Account identities
GETGet directory counts for the Account
GETGet an Account identity
PATCHUpdate an Account identity profile
PATCHSet Account-wide is_active flag
POSTErase an identity (GDPR/CCPA right to be forgotten)
POSTAdmin-trigger a password reset email
POSTRe-send email verification
POSTRevoke all active sessions for an identity
GETList audit events for an Account identity
POSTAdd an identity to an Environment (create EnvironmentMembership)
POSTBulk-attach EnvironmentMemberships for the Add-from-directory picker
DELETERemove an identity from an Environment (revoke EnvironmentMembership)
 Was this page helpful?

Tell us how we can improve this guide.

Canopy