> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Create an User > Create an user access along with its permission group. ## OpenAPI ````yaml /es/openapi/v3-current/AM-identity.yaml post /v1/users openapi: 3.0.1 info: contact: {} description: This is a swagger documentation for the Identity API termsOfService: http://swagger.io/terms/ title: Identity API version: 1.0.0 servers: - url: //localhost:4001/ security: [] paths: /v1/users: post: tags: - Users summary: Create an User description: Create an user access along with its permission group. requestBody: content: application/json: schema: $ref: '#/components/schemas/UserInput' description: User Input required: true responses: '201': content: application/json: schema: items: $ref: '#/components/schemas/UserResponse' type: array description: Created '400': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Bad Request '404': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Not Found '409': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: User already exists (IDE-0017) '500': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Internal Server Error security: - BearerAuth: [] components: schemas: UserInput: description: UserInput payload example: firstName: John lastName: Doe password: password phone: 5511998888777 countryCode: BR groups: - admin-group - midaz-viewer-group - midaz-contributor-group email: john@example.com username: johndoe properties: countryCode: description: >- User's ISO 3166-1 alpha-2 country code. Required whenever a phone is supplied. len=2,alpha is the closest shape this repo's validator (go-playground v9) can express — it has no iso3166_1_alpha2 rule, and no uppercase rule. The authoritative check is Casdoor's, which rejects a country code that does not resolve against the phone number. example: BR type: string email: description: User's email address. example: john@example.com type: string firstName: description: User's first name. example: John type: string groups: description: >- Array of user role groups IDs. Role groups IDs can be retrieved through the List Groups endpoint. example: - admin-group - midaz-viewer-group - midaz-contributor-group items: type: string type: array lastName: description: User's last name. example: Doe type: string password: description: User's password for authentication. example: password type: string phone: description: >- User's phone number in E.164 format (optional). Casdoor validates the number against CountryCode and rejects an unresolvable pair with an opaque upstream error, so the two must travel together — the pairing is enforced by validation.ValidatePhoneCountryPairing in the service, which also covers non-HTTP callers. example: 5511998888777 type: string username: description: User's username. example: johndoe type: string required: - email - firstName - lastName - password - username type: object UserResponse: description: UserResponse payload example: firstName: John lastName: Doe phone: 5511998888777 countryCode: BR groups: - groups - groups mfa: '{}' id: 123e4567-e89b-12d3-a456-426614174000 email: john@example.com username: johndoe properties: countryCode: example: BR type: string email: example: john@example.com type: string firstName: example: John type: string groups: items: type: string type: array id: example: 123e4567-e89b-12d3-a456-426614174000 type: string lastName: example: Doe type: string mfa: allOf: - $ref: '#/components/schemas/MFAStatusResponse' description: "The member's MFA status. NULLABLE, and the null is meaningful — this field\nis tri-state and a consumer MUST handle all three:\n\n\t{\"mfa\": {\"enabled\": false, \"methods\": [], ...}} known: this member has no MFA\n\t{\"mfa\": {\"enabled\": true, \"methods\": [\"app\"]}} known: this member has MFA\n\t{\"mfa\": null} UNKNOWN: not resolved\n\nnull is NOT \"no MFA\". It means the authoritative per-member read did not\ncomplete — Casdoor was unavailable, the row was skipped, or the listing's\nenrichment budget expired. Reporting those as enabled=false would tell an\nadministrator that a possibly-protected member is unprotected, so they are\nreported honestly as unknown instead. Render null as \"unknown\", never as\n\"off\", and never dereference without a null check: `user.mfa.enabled` throws\nexactly when Casdoor is degraded, which is the worst moment to throw.\n\nSingle-user reads (GET /v1/users/{id}) always populate it — the read that\nwould have failed is the request itself. Only the member LISTING can return\nnull; see enrichUsersWithMFAStatus in internal/services/user_mfa_enrichment.go.\n\nCarries no secrets — only enablement flags, methods and the preferred type." nullable: true type: object phone: example: 5511998888777 type: string username: example: johndoe type: string type: object pkg.HTTPError: properties: code: type: string entityType: type: string err: type: object message: type: string title: type: string type: object MFAStatusResponse: description: MFAStatusResponse payload example: preferredType: app methods: - app - email emailEnabled: false totpEnabled: true enabled: true properties: emailEnabled: description: Whether email MFA is enabled example: false type: boolean enabled: description: Whether MFA is enabled for the user example: true type: boolean methods: description: List of configured MFA methods example: - app - email items: type: string type: array preferredType: description: Preferred MFA type (if enabled) example: app type: string totpEnabled: description: Whether TOTP (app) is enabled example: true type: boolean type: object securitySchemes: BearerAuth: description: 'Bearer authentication. Send Authorization: Bearer .' in: header name: Authorization type: apiKey ````