1. Docs
  2. API Reference
  3. Create an identity

Create an identity

POST/portal/v1/accounts/{accountSlug}/applications/{appSlug}/identities

Authentication

  • Bearer Token Authorization

    JWT access token

Request body

  • emailstring*
  • first_namestring*
  • last_namestring*
  • passwordstring

    Initial password (8-64 chars). NIST SP 800-63B aligned — no composition rules. HaveIBeenPwned breach check runs server-side. Omit to create a passwordless identity (sign-in via SSO/social or forgot-password reset).

  • external_idstring
  • metadataany object
  • role_idstring
  • node_idstring

Code samples

cURLJavaScriptPythonGo
curl -X POST "https://api.canopy.dev/portal/v1/accounts/{accountSlug}/applications/{appSlug}/identities" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string",
    "first_name": "string",
    "last_name": "string",
    "password": "string",
    "external_id": "string",
    "metadata": {},
    "role_id": "string",
    "node_id": "string"
  }'

Responses

201 Identity created (optionally with initial role assignment)
{
  "id": "string",
  "email": "string",
  "first_name": "string",
  "last_name": "string",
  "avatar_url": "string",
  "external_id": "string",
  "is_active": false,
  "created_at": "2026-04-20T12:00:00.000Z"
}

application/json

  • idstring*
  • emailstring*
  • first_namestring*
  • last_namestring*
  • avatar_urlstring
  • external_idstring
  • is_activeboolean*
  • created_atstring (date-time)*
400 Password rejected — appeared in a known data breach (HaveIBeenPwned check)
401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)
409 Email already exists in this Application

Returned object

On this page

Related endpoints

GETList identities in Application
GETList identities with their role assignments
GETGet Application identities summary
POSTBulk-create identities
POSTRecord a bulk-import wizard completion
GETGet an identity
PATCHUpdate an identity
DELETERemove an identity
GETGet identity detail with role assignments
POSTActivate an identity
POSTDeactivate an identity
GETGet identity's role assignments
GETGet identity's effective permissions