Skip to content
Tilecast Docs

createUser

POST
/api/v1/users
curl --request POST \
  --url https://example.com/api/v1/users \
  --header 'Content-Type: application/json' \
  --header 'X-CSRF-Token: example' \
  --data '{ "name": "example", "username": "example", "password": "example", "role": "owner", "active": true, "contentAccess": { "libraryMode": "all", "tagMode": "all", "folderIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "tagIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ] }, "screenAccess": { "mode": "all", "scopes": [ { "type": "location", "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "name": "example" } ] } }'

Create a dashboard user account. Requires the users.manage capability and the admin scope. Only an Owner may assign the Owner or Administrator role, or a role that grants a capability the caller does not hold. Cookie-authenticated unsafe requests require X-CSRF-Token.

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters”
X-CSRF-Token
required
string

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
name
required
string
username
required
string
password
required
string
role
required

Role key. The built-in roles are owner, administrator, editor, contributor, and viewer. Custom role keys start with “custom.”. Decide authorization from the capabilities the server reports, not from the role key.

string
/^[a-z][a-z0-9.-]{1,63}$/
active
boolean
contentAccess

Media library access for the new account. When omitted, the account receives the creator’s own library and tag modes with no grants.

object
libraryMode
required
string
Allowed values: all restricted
tagMode
required
string
Allowed values: all restricted
folderIds

Granted folders; each covers its descendants.

Array<string>
<= 200 items
tagIds

Tags the account may apply and remove.

Array<string>
<= 200 items
screenAccess

Screen access for the new account, written in the same transaction as the account. When omitted, the account is restricted with no grants and reaches no screen. An Owner always reaches every screen. A caller with restricted screen access may grant only locations and Display Groups granted to it directly (screen_scope_delegation).

object
mode
required

All reaches every screen. restricted reaches the union of the granted locations and Display Groups, and nothing without grants.

string
Allowed values: all restricted
scopes

Grants for restricted access. Must be empty for all.

Array<object>
object
type
required
string
Allowed values: location group
id
required
string format: uuid
name
string

Responses

Section titled “ Responses ”

201

Section titled “201”

User account created

Media typeapplication/json
object
data
required
object
id
required
string format: uuid
name
required
string
username
required
string
role
required

Role key. The built-in roles are owner, administrator, editor, contributor, and viewer. Custom role keys start with “custom.”. Decide authorization from the capabilities the server reports, not from the role key.

string
/^[a-z][a-z0-9.-]{1,63}$/
active
required
boolean
createdAt
required
string format: date-time
lastLoginAt
string format: date-time
Example
{
  "data": {
    "role": "owner"
  }
}

400

Section titled “400”

Invalid request body

401

Section titled “401”

Dashboard authentication required

403

Section titled “403”

Insufficient role, or screen access the caller may not delegate

409

Section titled “409”

Username already in use

422

Section titled “422”

Name, username, password, role, or screen access invalid