---
title: "Create a Credential for an ACS User"
method: POST
path: "/acs/credentials/create"
tags: ["/acs"]
---

# Create a Credential for an ACS User

`POST /acs/credentials/create`

Creates a new [credential](/low-level-apis/access-systems/managing-credentials) for a specified [ACS user](/low-level-apis/access-systems/user-management). For granting access, we recommend [Access Grants](/use-cases/granting-access) instead: they create and manage the underlying credentials for you, across access systems and standalone smart locks alike. Use this low-level endpoint only when you need direct control over an individual ACS credential.

## Request body

- object
  - `access_method` 'code' | 'card' | 'mobile_key' | 'cloud_key', required — Access method for the new credential. Supported values: `code`, `card`, `mobile_key`, `cloud_key`.
  - `acs_system_id` string, uuid — ID of the access system to which the new credential belongs. You must provide either `acs_user_id` or the combination of `user_identity_id` and `acs_system_id`.
  - `acs_user_id` string, uuid — ID of the access system user to whom the new credential belongs. You must provide either `acs_user_id` or the combination of `user_identity_id` and `acs_system_id`.
  - `allowed_acs_entrance_ids` string[] — Set of IDs of the [entrances](/low-level-apis/access-systems/retrieving-entrance-details) for which the new credential grants access.
  - `assa_abloy_vostio_metadata` object — Vostio-specific metadata for the new credential.
    - `auto_join` boolean
    - `join_all_guest_acs_entrances` boolean
    - `override_all_guest_acs_entrances` boolean
    - `override_guest_acs_entrance_ids` string[]
  - `code` string — Access (PIN) code for the new credential. There may be manufacturer-specific code restrictions. For details, see the applicable [device or system integration guide](/device-and-system-integration-guides).
  - `credential_manager_acs_system_id` string, uuid — ACS system ID of the credential manager for the new credential.
  - `ends_at` string, date-time — Date and time at which the validity of the new credential ends, in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. Must be a time in the future and after `starts_at`.
  - `is_multi_phone_sync_credential` boolean — Indicates whether the new credential is a [multi-phone sync credential](/capability-guides/mobile-access/issuing-mobile-credentials-from-an-access-control-system#what-are-multi-phone-sync-credentials).
  - `salto_space_metadata` object — Salto Space-specific metadata for the new credential.
    - `assign_new_key` boolean — Indicates whether to assign a first, new card to a user. See also [Programming Salto Space Card-based Credentials](/device-and-system-integration-guides/salto-proaccess-space-access-system/programming-salto-space-card-based-credentials).
  - `starts_at` string, date-time — Date and time at which the validity of the new credential starts, in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format.
  - `user_identity_id` string, uuid — ID of the user identity to whom the new credential belongs. You must provide either `acs_user_id` or the combination of `user_identity_id` and `acs_system_id`. If the access system contains a user with the same `email_address` or `phone_number` as the user identity that you specify, they are linked, and the credential belongs to the access system user. If the access system does not have a corresponding user, one is created.
  - `visionline_metadata` object — Visionline-specific metadata for the new credential.
    - `auto_join` boolean
    - `card_format` 'TLCode' | 'rfid48'
    - `card_function_type` 'guest' | 'staff'
    - `joiner_acs_credential_ids` string[]
    - `override` boolean

## Response `200`

OK

- object
  - `acs_credential` AcsCredential, required — Means by which an [access control system user](/low-level-apis/access-systems/user-management) gains access at an [entrance](/low-level-apis/access-systems/retrieving-entrance-details). The `acs_credential` object represents a [credential](/low-level-apis/access-systems/managing-credentials) that provides an ACS user access within an [access control system](/low-level-apis/access-systems). See the [acs_credential object](/api/acs/credentials/object).
    - `access_method` 'code' | 'card' | 'mobile_key' | 'cloud_key', required — Access method for the [credential](/low-level-apis/access-systems/managing-credentials). Supported values: `code`, `card`, `mobile_key`, `cloud_key`.
    - `acs_credential_id` string, uuid, required — ID of the [credential](/low-level-apis/access-systems/managing-credentials).
    - `acs_credential_pool_id` string, uuid — ID of the credential pool to which the credential belongs.
    - `acs_system_id` string, uuid, required — ID of the [access control system](/low-level-apis/access-systems) that contains the [credential](/low-level-apis/access-systems/managing-credentials).
    - `acs_user_id` string, uuid — ID of the [ACS user](/low-level-apis/access-systems/user-management) to whom the [credential](/low-level-apis/access-systems/managing-credentials) belongs.
    - `assa_abloy_vostio_metadata` object — Vostio-specific metadata for the [credential](/low-level-apis/access-systems/managing-credentials).
      - `auto_join` boolean — Indicates whether the credential should auto-join. For an auto-join credential, Seam automatically issues an override card if there are no other cards and a joiner card if there are existing cards on the doors.
      - `door_names` string[] — Names of the doors to which to grant access in the Vostio access system.
      - `endpoint_id` string — Endpoint ID in the Vostio access system.
      - `key_id` string — Key ID in the Vostio access system.
      - `key_issuing_request_id` string — Key issuing request ID in the Vostio access system.
      - `override_guest_acs_entrance_ids` string[] — IDs of the guest entrances to override in the Vostio access system.
    - `card_number` string, nullable — Number of the card associated with the [credential](/low-level-apis/access-systems/managing-credentials).
    - `code` string, nullable — Access (PIN) code for the [credential](/low-level-apis/access-systems/managing-credentials).
    - `connected_account_id` string, uuid, required — ID of the [connected account](/core-concepts/connected-accounts) to which the [credential](/low-level-apis/access-systems/managing-credentials) belongs.
    - `created_at` string, date-time, required — Date and time at which the [credential](/low-level-apis/access-systems/managing-credentials) was created.
    - `display_name` string, required — Display name that corresponds to the [credential](/low-level-apis/access-systems/managing-credentials) type.
    - `ends_at` string — Date and time at which the [credential](/low-level-apis/access-systems/managing-credentials) validity ends, in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. Must be a time in the future and after `starts_at`.
    - `errors` object[], required — Errors associated with the [credential](/low-level-apis/access-systems/managing-credentials).
      - `error_code` string, required
      - `message` string, required
    - `external_type` 'pti_card' | 'brivo_credential' | 'hid_credential' | 'visionline_card' | 'salto_ks_credential' | 'assa_abloy_vostio_key' | 'salto_space_key' | 'latch_access' | 'dormakaba_ambiance_credential' | 'hotek_card' | 'salto_ks_tag' | 'avigilon_alta_credential' | 'kisi_credential' — Brand-specific terminology for the [credential](/low-level-apis/access-systems/managing-credentials) type. Supported values: `pti_card`, `brivo_credential`, `hid_credential`, `visionline_card`.
    - `external_type_display_name` string — Display name that corresponds to the brand-specific terminology for the [credential](/low-level-apis/access-systems/managing-credentials) type.
    - `is_issued` boolean — Indicates whether the [credential](/low-level-apis/access-systems/managing-credentials) has been encoded onto a card.
    - `is_latest_desired_state_synced_with_provider` boolean, nullable — Indicates whether the latest state of the [credential](/low-level-apis/access-systems/managing-credentials) has been synced from Seam to the provider.
    - `is_managed` true, required — Indicates whether Seam manages the credential.
    - `is_multi_phone_sync_credential` boolean — Indicates whether the [credential](/low-level-apis/access-systems/managing-credentials) is a [multi-phone sync credential](/capability-guides/mobile-access/issuing-mobile-credentials-from-an-access-control-system#what-are-multi-phone-sync-credentials).
    - `is_one_time_use` boolean — Indicates whether the [credential](/low-level-apis/access-systems/managing-credentials) can only be used once. If `true`, the code becomes invalid after the first use.
    - `issued_at` string, date-time, nullable — Date and time at which the [credential](/low-level-apis/access-systems/managing-credentials) was encoded onto a card.
    - `latest_desired_state_synced_with_provider_at` string, date-time, nullable — Date and time at which the state of the [credential](/low-level-apis/access-systems/managing-credentials) was most recently synced from Seam to the provider.
    - `parent_acs_credential_id` string, uuid — ID of the parent [credential](/low-level-apis/access-systems/managing-credentials).
    - `starts_at` string — Date and time at which the [credential](/low-level-apis/access-systems/managing-credentials) validity starts, in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format.
    - `user_identity_id` string, uuid — ID of the [user identity](/api/user_identities/object) to whom the [credential](/low-level-apis/access-systems/managing-credentials) belongs.
    - `visionline_metadata` object — Visionline-specific metadata for the [credential](/low-level-apis/access-systems/managing-credentials).
      - `auto_join` boolean — Indicates whether the credential should auto-join. For an auto-join credential, Seam automatically issues an override card if there are no other cards and a joiner card if there are existing cards on the doors.
      - `card_function_type` 'guest' | 'staff' — Card function type in the Visionline access system.
      - `card_id` string — ID of the card in the Visionline access system.
      - `common_acs_entrance_ids` string[] — Common entrance IDs in the Visionline access system.
      - `credential_id` string — ID of the credential in the Visionline access system.
      - `guest_acs_entrance_ids` string[] — Guest entrance IDs in the Visionline access system.
      - `is_valid` boolean — Indicates whether the credential is valid.
      - `joiner_acs_credential_ids` string[] — IDs of the credentials to which you want to join.
    - `warnings` object[], required — Warnings associated with the [credential](/low-level-apis/access-systems/managing-credentials).
      - `error_code` string — Error or warning code.
      - `message` string — Human-readable description.
      - `created_at` string, date-time — When this error or warning was generated.
    - `workspace_id` string, uuid, required — ID of the workspace that contains the [credential](/low-level-apis/access-systems/managing-credentials).

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/seam/apis/seam-connect.md) · [All operations](https://skmtc.net/seam/apis/seam-connect/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/seam/seam-connect/versions/00c35395ce12/schema)