Skip to content
Omniglass Omniglass Omniglass

Create a human principal

POST
/principals
 
curl --request POST \
  --url https://example.com/api/v1/principals \
  --header 'Content-Type: application/json' \
  --data '{ "display_name": "example", "email": "[email protected]", "password": "example", "username": "example" }'

Creates a human principal with an optional initial password. Gated by principal:create (all-scope). The new principal holds no grants; assign roles separately.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
$schema

A URL to the JSON Schema for this object.

string format: uri
display_name
string
<= 200 characters
email
string format: email
<= 320 characters
password

Optional initial password (at least 12 characters, not a common password, not containing the username); the user changes it after signing in

string
>= 12 characters <= 256 characters
username
required

Unique sign-in name (lowercase letters, digits, and . _ -)

string
>= 1 characters <= 200 characters /^[a-z0-9][a-z0-9._-]*$/

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Created

Media type application/json
object
$schema

A URL to the JSON Schema for this object.

string format: uri
active
required
boolean
archived_at

Set when the principal is archived (soft-deleted); absent means live

string format: date-time
grants
required
Array<object> | null
object
$schema

A URL to the JSON Schema for this object.

string format: uri
group_id

Set when this grant is inherited from a group the principal belongs to (the group’s id); absent for a direct grant, which is the only kind revocable from the principal.

string
group_name

The source group’s label, present when the grant is inherited.

string
id
string
role
required
string
scope_id
string
scope_kind
required
string
scope_op

How the scope root matches the tree: subtree (root + descendants), subtree_excl_root (descendants only for update/delete, root kept for read/create), or self (the root row only). Empty means subtree. Moot for the all scope.

string
Allowed values: subtree subtree_excl_root self
groups
required
Array<object> | null
object
id
required
string
name
required
string
human
object
$schema

A URL to the JSON Schema for this object.

string format: uri
display_name
string
email
string
has_avatar

True when the principal has a profile picture; fetch it from the avatar endpoint.

boolean
must_change_password

True when an admin reset the password and the user must change it before doing anything else; the console gates every route to the change-password form until it clears.

boolean
username
required
string
id
required
string
kind
required
string
service
object
label
required
string
Example 
{
  "$schema": "/api/v1/schemas/PrincipalBody.json",
  "grants": [
    {
      "$schema": "/api/v1/schemas/GrantBody.json",
      "scope_op": "subtree"
    }
  ],
  "human": {
    "$schema": "/api/v1/schemas/HumanBody.json"
  }
}

default

Section titled “default ”

Error

Media type application/problem+json
object
$schema

A URL to the JSON Schema for this object.

string format: uri
detail

A human-readable explanation specific to this occurrence of the problem.

string
errors

Optional list of individual error details

Array<object> | null
object
location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string
message

Error message text

string
value

The value at the given location

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri
status

HTTP status code

integer format: int64
title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string
type

A URI reference to human-readable documentation for the error.

string format: uri
default: about:blank
Example 
{
  "$schema": "/api/v1/schemas/ErrorModel.json",
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}