---
title: "Create a new (sub) user for service"
method: POST
path: "/project/{project}/service/{service_name}/user"
tags: ["Service"]
---

# Create a new (sub) user for service

`POST /project/{project}/service/{service_name}/user`

## Path parameters

- `project` string, required
- `service_name` string, required

## Request body

- ServiceUserCreateRequestBody — ServiceUserCreateRequestBody
  - `access_control` object — Service type specific access control rules for user. Currently only used for configuring user ACLs for Redis version 6 and above.
    - `dragonfly_acl_categories` string[] — Command category rules
    - `dragonfly_acl_commands` string[] — Rules for individual commands
    - `dragonfly_acl_keys` string[] — Key access rules
    - `pg_allow_replication` boolean — Enable REPLICATION role option
    - `redis_acl_categories` string[] — Command category rules
    - `redis_acl_channels` string[] — Glob-style patterns defining which pub/sub channels can be accessed. If array is not defined, the default policy is used (allchannels).
    - `redis_acl_commands` string[] — Rules for individual commands
    - `redis_acl_keys` string[] — Key access rules
    - `valkey_acl_categories` string[] — Command category rules
    - `valkey_acl_channels` string[] — Glob-style patterns defining which pub/sub channels can be accessed. If array is not defined, the default policy is used (allchannels).
    - `valkey_acl_commands` string[] — Rules for individual commands
    - `valkey_acl_keys` string[] — Key access rules
  - `authentication` 'null' | 'caching_sha2_password' | 'mysql_native_password' — Service specific authentication details. Currently only used for MySQL where accepted options are 'mysql_native_password' and 'caching_sha2_password', latter being default when this is not explicitly set.
  - `username` string, required — Service username

## Response `200`

Response

- ServiceUserCreateResponse — ServiceUserCreateResponse
  - `errors` object[] — List of errors occurred during request processing
    - `message` string, required — Printable error message
    - `more_info` string — URL to the documentation of the error
    - `status` integer, required — HTTP error status code
  - `message` string — Printable result of the request
  - `user` object, required — Service user account
    - `access_cert` string — Access certificate for TLS client authentication
    - `access_cert_not_valid_after_time` string — Validity end time (ISO8601) for the current access certificate
    - `access_control` object — Service type specific access control rules for user. Currently only used for configuring user ACLs for Redis version 6 and above.
      - `dragonfly_acl_categories` string[] — Command category rules
      - `dragonfly_acl_commands` string[] — Rules for individual commands
      - `dragonfly_acl_keys` string[] — Key access rules
      - `pg_allow_replication` boolean — Enable REPLICATION role option
      - `redis_acl_categories` string[] — Command category rules
      - `redis_acl_channels` string[] — Glob-style patterns defining which pub/sub channels can be accessed. If array is not defined, the default policy is used (allchannels).
      - `redis_acl_commands` string[] — Rules for individual commands
      - `redis_acl_keys` string[] — Key access rules
      - `valkey_acl_categories` string[] — Command category rules
      - `valkey_acl_channels` string[] — Glob-style patterns defining which pub/sub channels can be accessed. If array is not defined, the default policy is used (allchannels).
      - `valkey_acl_commands` string[] — Rules for individual commands
      - `valkey_acl_keys` string[] — Key access rules
    - `access_key` string — Access key for TLS client authentication
    - `authentication` 'null' | 'caching_sha2_password' | 'mysql_native_password' — Service specific authentication details. Currently only used for MySQL where accepted options are 'mysql_native_password' and 'caching_sha2_password', latter being default when this is not explicitly set.
    - `expiring_cert_not_valid_after_time` string — When the existing certificate is nearing expiration and a new certificate has been generated, the validity end time (ISO8601) for the expiring certificate
    - `password` string, required — Account password. A null value indicates a user overridden password.
    - `password_updated_time` string — Timestamp (ISO8601) of the last time this password was set.
    - `type` string, required — Account type
    - `username` string, required — Account username

---

[API](https://skmtc.net/aiven/apis/aiven-api-documentation.md) · [All operations](https://skmtc.net/aiven/apis/aiven-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aiven/aiven-api-documentation/versions/ecaeabf1da31/schema)