← User API

POST/v2/usersCreate user

Create a user for an organization
headerAuthorizationAuthentication token (bearer token or API key).
{
"organizationId" : Number,
"firstName" : String,
"lastName" : String,
"phoneNumber" : Phone number (E.164, e.g. "+31850607337"),
"phoneNumberVerify" : Boolean,
"emailAddress" : String,
"emailAddressVerify" : Boolean,
"description" : String,
"remarks" : String,
"superUser" : Boolean,
"externalId" : String,
"source" : String,
"invitation" : {
"language" : Language code (ISO 639-1, e.g. "ar", "de", "en", "es", "fr", "it", "nl", "pl", "cs"),
"expiration" : Date/time with a timezone (ISO 8601, e.g. "2022-06-23T13:53:02+02:00"),
"sendEmail" : Boolean,
"sendSms" : Boolean
},
"autoRemoveAfter" : "WEEK" / "MONTH" / "YEAR",
"autoEmailMatch" : Boolean,
"requireEmailMatch" : Boolean,
"authOrganizationId" : String,
"emailMatchCredentialFilter" : Boolean,
"userGroups" : [{
"userGroupId" : Number,
"groupAdmin" : Boolean
}]
}

Response

status201All ok, returned Id of created user, and invitation token where applicable
status400Invalid input
status401Invalid authentication token
status403Insufficient rights
status409User or user-invite already exists. Existing user.id will be returned
{
"userId" : Number,
"invitation" : {
"url" : String,
"expiration" : Date/time with a timezone (ISO 8601, e.g. "2022-06-23T13:53:02+02:00"),
"emailMatched" : Boolean
},
"token" : String, UUID 4 formatted (e.g. "a426e157-8a5c-456a-8865-bec6394867ab")
}

Example: Create a user

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Averlyn",
"lastName": "Tromley",
"invitation": {
"expiration": "2026-08-28T15:06:42.291226907Z",
"sendEmail": false,
"sendSms": false
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 10,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/6da23684-1278-48b0-b1de-77d93294b4b4",
"expiration": "2026-08-28T15:06:42.291226907Z",
"emailMatched": false
},
"token": "6da23684-1278-48b0-b1de-77d93294b4b4"
}

Example: Default the external-id source to the api default when none is given

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Ext",
"lastName": "Sourceless",
"externalId": "EXT-DEFAULT-1",
"invitation": {
"expiration": "2026-08-28T15:06:42.314171124Z",
"sendEmail": false,
"sendSms": false
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 11,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/55c366e2-1ab0-4020-b16d-6050dcd774b7",
"expiration": "2026-08-28T15:06:42.314171124Z",
"emailMatched": false
},
"token": "55c366e2-1ab0-4020-b16d-6050dcd774b7"
}

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Ext",
"lastName": "Sourced",
"externalId": "EXT-EXPLICIT-1",
"source": "acme",
"invitation": {
"expiration": "2026-08-28T15:06:42.34183654Z",
"sendEmail": false,
"sendSms": false
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 12,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/3fa943e0-5939-4876-864b-0fe5139ebac8",
"expiration": "2026-08-28T15:06:42.34183654Z",
"emailMatched": false
},
"token": "3fa943e0-5939-4876-864b-0fe5139ebac8"
}

Example: Allow a source without an external id (a source-only row)

Example: Reject a create that duplicates an existing external id with 409

Example: Create a user for a personal organization

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 1,
"firstName": "Averlyn",
"lastName": "Tromley",
"invitation": {
"expiration": "2026-08-28T15:06:42.459577743Z",
"sendEmail": false,
"sendSms": false
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 16,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/48e77a83-3bbc-486e-8b2d-f45e5098d47c",
"expiration": "2026-08-28T15:06:42.459577743Z",
"emailMatched": false
},
"token": "48e77a83-3bbc-486e-8b2d-f45e5098d47c"
}

Example: Invite user and add to a user group

POST/v2/users

headerAuthorizationBearer 31057c72-b481-4d1a-95b1-6ecb846b613a
{
"organizationId": 2,
"firstName": "Test",
"lastName": "User",
"phoneNumber": "+40711111303",
"phoneNumberVerify": true,
"invitation": {
"expiration": "2026-08-28T15:06:42.48303091Z",
"sendEmail": false,
"sendSms": true
},
"userGroups": [{
"userGroupId": 1,
"groupAdmin": false
}]
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 17,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/1ebf0b03-75e1-48f8-b932-a0b054ef9e29",
"expiration": "2026-08-28T15:06:42.48303091Z",
"emailMatched": false
},
"token": "1ebf0b03-75e1-48f8-b932-a0b054ef9e29"
}

Example: Invite a user for a professional organization

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "John",
"lastName": "Stuart",
"phoneNumber": "+40711111304",
"phoneNumberVerify": true,
"invitation": {
"expiration": "2026-08-28T15:06:42.542157472Z",
"sendEmail": false,
"sendSms": true
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 18,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/4e1f4a9a-599a-4c0d-bcc3-207e0fa97f64",
"expiration": "2026-08-28T15:06:42.542157472Z",
"emailMatched": false
},
"token": "4e1f4a9a-599a-4c0d-bcc3-207e0fa97f64"
}

Example: Create a user when input is invalid

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": -1
}

Response

status403
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"message": "The request was a legal request, but the server is refusing to respond to it.",
"errorMessage": "The request was a legal request, but the server is refusing to respond to it."
}

Example: Invite a duplicate user for a professional organization

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Norton",
"lastName": "McAfee",
"phoneNumber": "+40711111305",
"phoneNumberVerify": true,
"invitation": {
"expiration": "2026-08-28T15:06:42.575328687Z",
"sendEmail": false,
"sendSms": true
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 19,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/5ee4e610-8976-487c-aec3-076e277c1f00",
"expiration": "2026-08-28T15:06:42.575328687Z",
"emailMatched": false
},
"token": "5ee4e610-8976-487c-aec3-076e277c1f00"
}

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Norton",
"lastName": "McAfee",
"phoneNumber": "+40711111305",
"phoneNumberVerify": true,
"invitation": {
"expiration": "2026-08-28T15:06:42.602250743Z",
"sendEmail": false,
"sendSms": true
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 20,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/de81dcd4-726b-467e-8404-7d23006e3b07",
"expiration": "2026-08-28T15:06:42.602250743Z",
"emailMatched": false
},
"token": "de81dcd4-726b-467e-8404-7d23006e3b07"
}

Example: Invite two invites professional organization where numbers match

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Norton",
"lastName": "McAfee",
"phoneNumber": "+40711111306",
"phoneNumberVerify": true,
"invitation": {
"expiration": "2026-08-28T15:06:42.6264885Z",
"sendEmail": false,
"sendSms": true
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 21,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/fc9aedfe-29df-41f5-a651-ec9281385f8e",
"expiration": "2026-08-28T15:06:42.6264885Z",
"emailMatched": false
},
"token": "fc9aedfe-29df-41f5-a651-ec9281385f8e"
}

POST/v2/users

headerAuthorizationBearer 49ae0a1c-0fbb-477a-a604-996524562238
{
"organizationId": 2,
"firstName": "Norton",
"lastName": "McAfee",
"phoneNumber": "+40711111306",
"phoneNumberVerify": true,
"invitation": {
"expiration": "2026-08-28T15:06:42.650007797Z",
"sendEmail": false,
"sendSms": true
}
}

Response

status200
headerAccess-Control-Expose-Headersauthorization, content-type
headerAccess-Control-Allow-Headersauthorization, content-type
headerAccess-Control-Allow-MethodsGET, POST, DELETE, OPTIONS, PUT
headerAccess-Control-Allow-Origin*
headerStrict-Transport-Securitymax-age=31536000; includeSubDomains
headerX-Frame-OptionsSAMEORIGIN
headerX-Content-Type-Optionsnosniff
headerX-XSS-Protection1; mode=block
headerContent-Security-Policydefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
headerReferrer-Policyno-referrer
headerFeature-Policyself
headerPermissions-policyinterest-cohort=()
{
"userId": 22,
"invitation": {
"url": "https://invite-staging.boldsmartlock.com/1bf2900c-f74e-43a9-8a1f-4330abb9597c",
"expiration": "2026-08-28T15:06:42.650007797Z",
"emailMatched": false
},
"token": "1bf2900c-f74e-43a9-8a1f-4330abb9597c"
}