---
title: "Create API User"
method: POST
path: "/api-users/"
tags: ["API Users"]
---

# Create API User

`POST /api-users/`

## Request body

- APIUserRequest — Remove field user_roles if the request users doesn't have user_management high level permission
  - `name` string, required — Name of the user.
  - `title` 'ceo' | 'cto' | 'cso' | 'seceng' | 'dev' | 'devop' | 'manager' | 'other' | '' — Job title: * `ceo` - Chief Executive Officer * `cto` - Chief Technology Officer * `cso` - Chief Security Officer * `seceng` - Security engineer * `dev` - Developer * `devop` - Developer Operations * `manager` - Manager * `other` - Other
  - `active` boolean — If true, the user can authenticate to Snyk API & Web to interact with apps and the API. If false, the user's access to Snyk API & Web's apps and API is blocked. Defaults to true.
  - `labels` UserLabel[] — Labels of the user.
    - `id` string, required — A unique Base58 value identifying this object.
    - `name` string, required — Name of the label. The maximum length is 255 characters.
    - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green.
    - `changed_by` SimpleUser, required
      - `id` string, required — A unique Base58 value identifying this object.
      - `email` string, email — Email of the user.
      - `name` string, required — Name of the user.
    - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `user_roles` SimpleUserRole[] — Roles of the user.
    - `id` string, required — A unique Base58 value identifying this object.
    - `role` SimpleRole, required — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation.
      - `id` string — A unique Base58 value identifying this object.
      - `name` string, required — Role's name.
    - `scope` DPOScopeSchema, required
      - `tier` string, required
      - `target` DPOTargetSchema
        - `id` string, required — A unique Base58 value identifying this object.
        - `name` string, required
        - `url` string, uri, required — Target URL.
      - `team` DPOTeamSchema
        - `id` string, required — A unique Base58 value identifying this object.
        - `name` string, required
  - `days_valid_for` integer

## Response `200`

- APIUser — Remove field user_roles if the request users doesn't have user_management high level permission
  - `id` string, required — A unique Base58 value identifying this object.
  - `name` string, required — Name of the user.
  - `changed_by` SimpleUser, required
    - `id` string, required — A unique Base58 value identifying this object.
    - `email` string, email — Email of the user.
    - `name` string, required — Name of the user.
  - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `active` boolean — If true, the user can authenticate to Snyk API & Web to interact with apps and the API. If false, the user's access to Snyk API & Web's apps and API is blocked. Defaults to true.
  - `labels` UserLabel[], required
    - `id` string, required — A unique Base58 value identifying this object.
    - `name` string, required — Name of the label. The maximum length is 255 characters.
    - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green.
    - `changed_by` SimpleUser, required
      - `id` string, required — A unique Base58 value identifying this object.
      - `email` string, email — Email of the user.
      - `name` string, required — Name of the user.
    - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `user_roles` SimpleUserRole[] — Roles of the user.
    - `id` string, required — A unique Base58 value identifying this object.
    - `role` SimpleRole, required — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation.
      - `id` string — A unique Base58 value identifying this object.
      - `name` string, required — Role's name.
    - `scope` DPOScopeSchema, required
      - `tier` string, required
      - `target` DPOTargetSchema
        - `id` string, required — A unique Base58 value identifying this object.
        - `name` string, required
        - `url` string, uri, required — Target URL.
      - `team` DPOTeamSchema
        - `id` string, required — A unique Base58 value identifying this object.
        - `name` string, required
  - `is_apiuser` boolean, required — If true, it is an app that interacts with Snyk API & Web through the API. If false, it is a human who interacts with Snyk API & Web through our web interface. Defaults to false."
  - `key` string, required
  - `expiration_date` string, date-time, nullable, required
  - `days_valid_for` integer

## Other responses

- `400`
- `401`
- `500`

---

[API](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation.md) · [All operations](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/probely/snyk-api-web-s-api-reference-documentation/versions/e29879bff01b/schema)