---
title: "Create a global admin user"
method: POST
path: "/eclipse-conductor/rest/v1/global/admin-users"
tags: ["z) Global Functionality"]
---

# Create a global admin user

`POST /eclipse-conductor/rest/v1/global/admin-users`

Creates a user that can operate across all tenants. For PKI authentication, generate an RSA key pair with openssl and supply the base64-encoded public key.

## Request body

- NewEclipseGlobalAdminUser — A user with credentials to do administration globally. E.g. for internal staff, API access etc.
  - `base64EncodedPublicKey` string — An optional PKI RSA public key for added security. If a public key is provided then the PKI login-challenges endpoint should be used to get a challenge to respond to as part of the login
  - `email` string — Users email address
  - `firstName` string — Customers middle name
  - `identity` string, required — Identity/username for authentication
  - `institution` string — Optional. The accountable institution that the admin user falls under - making them INSTITUTION admin users
  - `lastName` string, required — Customers last/family name
  - `password` string — Can be pre-hashed with BCRYPT or passed as clear text in which case Eclipse will hash it
  - `phone1` string, required — Tenants primary phone number
  - `role` 'GLOBAL_ADMIN' | 'GLOBAL_CICD' | 'GLOBAL_COMPLIANCE_L_1' | 'GLOBAL_FINANCE_L_1' | 'GLOBAL_FINANCE_L_2' | 'GLOBAL_FINANCE_L_3' | 'GLOBAL_INTEGRATOR' | 'GLOBAL_SUPPORT_L_1' | 'GLOBAL_SUPPORT_L_2' | 'GLOBAL_SUPPORT_L_3' | 'GLOBAL_TECH_SUPPORT' | 'INSTITUTION_ADMIN' | 'INSTITUTION_FINANCE_L_1' | 'INSTITUTION_FINANCE_L_2' | 'INSTITUTION_FINANCE_L_3' | 'INSTITUTION_INTEGRATOR' | 'INSTITUTION_SUPPORT_L_1' | 'INSTITUTION_SUPPORT_L_2' | 'INSTITUTION_SUPPORT_L_3' | 'INSTITUTION_TECH_SUPPORT'
  - `ssoEnabled` boolean — Indicates that this identity is purely for single sign on (e.g. SAML/OIDC) and cannot be used for authentication. If SSO is enabled then TOTP must be disabled and base64EncodedPublicKey and password should not be provided
  - `totpEnabled` boolean — Whether this identity will require a time base one time password when authenticating
  - `userTypeId` integer

## Response `200`

OK

- EclipseGlobalAdminUser — A user with credentials to do administration globally. E.g. for staff, API access etc.
  - `adminUserId` integer — Unique system generated identifier for an admin user
  - `base64EncodedPublicKey` string — An optional PKI RSA public key for added security. If a public key is provided then the PKI login-challenges endpoint should be used to get a challenge to respond to as part of the login
  - `email` string — Users email address
  - `firstName` string — Customers middle name
  - `identity` string, required — Identity/username for authentication
  - `institution` string — Optional. The accountable institution that the admin user falls under - making them INSTITUTION admin users
  - `lastName` string, required — Customers last/family name
  - `phone1` string, required — Users primary phone number
  - `role` 'GLOBAL_ADMIN' | 'GLOBAL_CICD' | 'GLOBAL_COMPLIANCE_L_1' | 'GLOBAL_FINANCE_L_1' | 'GLOBAL_FINANCE_L_2' | 'GLOBAL_FINANCE_L_3' | 'GLOBAL_INTEGRATOR' | 'GLOBAL_SUPPORT_L_1' | 'GLOBAL_SUPPORT_L_2' | 'GLOBAL_SUPPORT_L_3' | 'GLOBAL_TECH_SUPPORT' | 'INSTITUTION_ADMIN' | 'INSTITUTION_FINANCE_L_1' | 'INSTITUTION_FINANCE_L_2' | 'INSTITUTION_FINANCE_L_3' | 'INSTITUTION_INTEGRATOR' | 'INSTITUTION_SUPPORT_L_1' | 'INSTITUTION_SUPPORT_L_2' | 'INSTITUTION_SUPPORT_L_3' | 'INSTITUTION_TECH_SUPPORT'
  - `ssoEnabled` boolean — Indicates that this identity is purely for single sign on (e.g. SAML/OIDC) and cannot be used for authentication. If SSO is enabled then TOTP must be disabled and base64EncodedPublicKey and password should not be provided
  - `totpEnabled` boolean — Whether this identity will require a time base one time password when authenticating
  - `totpQrCode` string — The QRCode which can be scanned with any RFC 6238 compliant App (E.g. Google Authenticator). Only provided in response to the enabling or resetting of TOTP
  - `userTypeId` integer

## Other responses

- `400` — Bad Request
- `500` — Internal Server Error

---

[API](https://skmtc.net/eftcorp/apis/eclipse-rest-api.md) · [All operations](https://skmtc.net/eftcorp/apis/eclipse-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/eftcorp/eclipse-rest-api/versions/9213d52d49a3/schema)