1. Docs
  2. Identities
  3. Console Create

Console Create

Admin-driven direct creation from the Console: the identity row is written immediately, with an optional starting password and no email ceremony.

Creating without an invite

Creating without an invite

Creating an identity writes it immediately, with no email and no accept step.

Create Identity (Console, Identities → Overview): writes the identity, its access to the active Environment and, when you pick a role, a role assignment, all in one transaction. This is the flow covered in detail on this page.Account administrators can also create people from the Admin Workspace; see Add and Manage Identities.
 See the three-layer model on the Identities overview →

Using the Console

In the Developer Console, Identities → Overview (under Access Control) holds a card for each way to add people to the active Environment. Invite sends an email-only invite. Invite & Assign bundles an invite with a role assignment. Create Identity, covered on this page, skips the email entirely and writes the identity row right away. Use it when you want the identity to exist now (with or without a starting password) rather than wait for the recipient to click an email link.

Application
Developer Console
Path
Access ControlIdentitiesOverview
Opens with
  • env_identities.manage Invite, create, import, edit, and remove identities in the Environment, and assign their roles.
Context
Select an Application and an Environment in the switcher first; the page belongs to that Environment.
Create an identity
Open Identities → Overview from the left nav under Access Control. It's scoped to whichever Environment is active in the Application and Environment switcher.Click the Create Identity card. The Create Identity dialog opens.Enter the email address, first name, and last name. These are the only required fields.Optionally set an Initial password (8–64 characters). When set, the identity signs in with it once its email address is verified: Hosted Login mails a verification link at the first sign-in. When left blank, the identity is passwordless until it sets one through password reset or signs in through SSO.Optionally pick a Role to bundle a first role assignment in the same step. In a flat Environment the node is fixed to the root and shown as Applies at; in a hierarchy-enabled Environment, pick the Node too. A role can't be submitted without a node.Click Create Identity. The identity, its access to the Environment and the assignment (if any) are written in one transaction, and the identities list refreshes.
When to use Create Identity vs the alternatives
Invite: pick when you want the user to set their own password through an email link and you don't already know what it should be.Invite & Assign: same email-link ceremony, but the role assignment is wired in up front so the user lands with permissions ready when they accept.Create Identity: pick when the user already exists in your records (migration, pre-provisioning, federated SSO mapping), when you have a temp password to set out-of-band, or when the user will only ever authenticate via SSO and you want the row to exist now.
First time setting up?

On a fresh Environment (every new Application is seeded with an empty Development and Production Environment), Access Control → Overview shows a banner that begins You haven't invited any users or assigned them roles yet. Click Complete Invite & Assign Users Setup to open the Setup guide, a floating checklist that opens on its first unfinished invite or assignment step. Each step links directly to the right page and offers help alongside, so you don't have to bounce between docs and the Console to figure out where to click next.

What the guide walks you through:

Invite IdentitiesAssign Role to Identity
 Onboarding many at once? Use the Console's CSV import wizard →

Using the API

You can also create identities through the API instead of using the Console. Use this when you're provisioning users from a backend job, syncing from an HR system, or scripting a migration. Each API key is scoped to one Environment: POST /api/v1/identities creates the identity in the Account, its access to that Environment, and any bundled role assignment there.

Endpoint 
POST /api/v1/identities

Authenticate with your API key in the X-API-Key header. The principal needs identity.manage in the target Environment.

Example

Send the email and names, with an optional password and an optional role + node pair, in the request body. role_id and node_id go together: sending only one is refused with 400:

{
  "email": "regional.manager@example.com",
  "first_name": "Pat",
  "last_name": "Lee",
  "password": "q7Lm-2vRt-9xWp",
  "role_id": "5e1f2a3b-4c5d-4e6f-7a8b-9c0d1e2f3a4b",
  "node_id": "0aa1b2c3-d4e5-4f6a-7b8c-9d0e1f2a3b4c"
}

The response returns the new identity with its id and is committed by the time the 201 lands, with no async write or eventual-consistency window. For batch provisioning, the same surface exposes POST /api/v1/identities/bulk-create for up to 200 rows per call, reporting each row's success or failure.

 View full API reference →
Environment
API version
v1.0
 On this page Was this page helpful?

Tell us how we can improve this guide.

Canopy