1. Docs
  2. Identities
  3. Console CSV Import

Console CSV Import

A 6-step wizard that takes a CSV of identities and either invites them by email or creates them directly in the active Environment: the same outcomes as the per-row Console flows, sent in batches of 200 rows with each row's success or failure reported.

When to use the CSV wizard

Reach for the wizard when you have a list (exported from an HR system, a spreadsheet of new hires, a previous tenant's user dump) and you want to provision the whole batch in one pass with a human-reviewable preview before anything is written.

The two modes

Step 1 of the wizard locks the mode for the rest of the run. Pick the mode that matches how the identities should arrive in the active Environment. Account administrators can also import people into the Account-wide directory from the Admin Workspace; see Add and Manage Identities.

Bulk invite

Environment-scoped. Sends each row an email with a link to accept. The identity, its access to the Environment, and any optional role + node assignment are created when the recipient accepts. Best when the recipient should choose their credentials, typical for new hires and external collaborators.

Bulk create

Environment-scoped. Writes the identities directly. No email is sent. Optionally accepts a password column for a starting password (8–64 characters), plus an optional role_id + node_id pair per row to bundle an assignment. Best for migrations, pre-provisioning ahead of go-live, or federated/SSO identities where authentication won't be a Canopy password.

Walking through the wizard

In the Developer Console, open Identities → Overview (under Access Control) and click the Import CSV card. The wizard opens at step 1.

Application
Developer Console
Path
Access ControlIdentitiesOverview
Opens with
  • env_identities.manage Invite, create, import, edit, and remove identities in the Environment, and assign their roles.
Context
Select an Application and an Environment in the switcher first; the page belongs to that Environment.
Six steps
Mode: pick Create or Invite. Each card lists the mode's required and optional CSV columns and offers a Download sample CSV link with the full column set plus comment-line documentation.Upload: drop a CSV file or paste raw CSV text. The parser reads it as UTF-8, auto-detects the delimiter (comma, semicolon, tab or pipe), strips comment lines starting with #, and shows a summary of rows, columns, delimiter and encoding on success. Up to 10 MB and 10,000 rows per file.Mapping: the wizard auto-maps CSV headers to Canopy fields using a built-in alias table (e.g. E-Mail → email, Surname → last_name). Each column carries a badge: Exact match, Fuzzy match (matched through an alias), or Unmapped. Override any column from the dropdown, or leave columns the wizard didn't recognise on Ignore this column. Required-field-missing alerts appear at the top until every required field is mapped.Preview: every parsed row is checked against the Environment's real roles, nodes and OAuth clients (loaded when the wizard opens, for each of those you can view) plus per-field checks (email format, UUID format, password length, send_email truthiness). The stats panel summarises valid / warning / error counts. Rows with errors are tinted, list what's wrong in the Issues column, and are deselected: their checkbox stays disabled until the source CSV is fixed and re-uploaded.Submit: selected rows are sent in batches of 200 to the Environment's identities/bulk-create endpoint, or identity-invites/bulk-create in invite mode, each batch with its own idempotency key. A live progress bar tracks the run, and Cancel sending stops it before the next batch. A batch that fails on a network error or a 408, 429, 500, 502, 503 or 504 is retried up to 2 times, waiting 1s → 2s between tries.Results: a per-row outcome table. Success rows show the new identity ID; error rows show the server's message and HTTP status (e.g. Email already exists in this Account (HTTP 409)); skipped rows show why (deselected before sending, or skipped after a cancel). Two downloads: Download failed rows (CSV) for fix-and-re-upload loops, and Download full results (CSV) for your audit trail.

Common pitfalls

Optional columns with placeholder values fail validation. Bogus UUIDs in role_id / node_id or strings like your-oauth-client-id in client_id are flagged at the preview step. Fix the source CSV: leave optional cells empty unless you have real Environment IDs to fill in.Role and node must be paired. If a row has role_id, it must also have node_id (and vice versa). The validator flags rows that have one without the other as a row-level error.Header aliases are flexible but not infinite. The wizard auto-maps common variants (E-Mail, Given Name, Surname) but anything outside the alias table lands on Ignore this column and the user has to manually map it from the dropdown. Required-field-missing alerts make this hard to overlook.Files larger than 10 MB or 10,000 rows are rejected at upload. Split client-side (split the CSV into multiple files), or call POST /api/v1/identities/bulk-create directly from a backend script in chunks of 200.
First time setting up?

On a fresh Environment (every new Application is seeded with an empty Development and Production Environment), Access Control → Overview shows a banner that begins You haven't invited any users or assigned them roles yet. Click Complete Invite & Assign Users Setup to open the Setup guide, a floating checklist that opens on its first unfinished invite or assignment step. Each step links directly to the right page and offers help alongside, so you don't have to bounce between docs and the Console to figure out where to click next.

What the guide walks you through:

Invite IdentitiesAssign Role to Identity
Environment
API version
v1.0
On this page Was this page helpful?

Tell us how we can improve this guide.