> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Domain User

> Syteca ACB REST API endpoint to link an existing Active Directory user to Syteca — for AD-integrated provisioning workflows.

Links an existing Active Directory user to Syteca. The user account itself stays in AD — Syteca just creates a reference to it for permission assignment, monitoring scope, and access control. AD remains the source of truth for the user's credentials and identity attributes.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The Access Token must be issued to a user with the [administrative User Management permission](/docs/administration/users/administrative-permissions).

### Prerequisites

* The AD user must already exist in a domain reachable by the Syteca Application Server.
* The domain must be configured in Syteca — see [LDAP/AD integration](/docs/administration/integrations/ldap-targets).

### Common use cases

* **AD-driven onboarding** — Group membership changes in AD (e.g. user added to a "PrivilegedAdmins" group) trigger this endpoint to register the user in Syteca.
* **AD group sync** — Syncing Syteca user groups against AD group memberships nightly.
* **Compliance audit prep** — Bulk-link all AD users in a privileged role group to Syteca before an audit window.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — invalid user identifier or missing required fields.
* **403 Forbidden** — user lacks administrative User Management permission.
* **409 Conflict** — AD user is already linked to Syteca.
* **422 Unprocessable Entity** — the AD domain referenced isn't configured in Syteca.

## Related

<CardGroup cols={2}>
  <Card title="Create internal user" icon="user-plus" href="/docs/api/acb/endpoints/create-internal-user">Create a Syteca-managed user instead.</Card>
  <Card title="Get user details" icon="user-search" href="/docs/api/acb/endpoints/get-user-details">Verify the link.</Card>
  <Card title="Update admin permissions" icon="shield-check" href="/docs/api/acb/endpoints/update-admin-permissions">Grant admin permissions after creation.</Card>
  <Card title="Update client access" icon="laptop" href="/docs/api/acb/endpoints/update-client-access">Set which Clients the user can see.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/user-management/users/domain
openapi: 3.0.1
info:
  title: Application Credentials Broker API
  description: API for managing users in the Application Credentials Broker system
  version: 1.0.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/user-management/users/domain:
    post:
      tags:
        - UserManagement
      summary: Add a domain user
      description: Add a new domain user (link AD account to Syteca user)
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateDomainUserRequestDto'
      responses:
        '201':
          description: Domain user added successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateDomainUserResponseDto'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CreateDomainUserRequestDto:
      type: object
      properties:
        account_name:
          type: string
          nullable: true
          description: AD user name
        auth_token_lifetime_sec:
          type: integer
          format: int32
          nullable: true
          description: The lifetime of an access token in seconds for this user
        domain:
          type: string
          nullable: true
          description: AD domain name
        external_app_enabled:
          type: boolean
          description: Allow this user account to be used by external applications
        ip_restrictions:
          type: array
          items:
            type: string
            description: IP address
          nullable: true
          description: Allowed IP address for this user's API access
        two_factor_required:
          type: boolean
          description: Enable two-factor authentication on login
        user_group_ids:
          type: array
          items:
            type: integer
            format: int32
            description: Syteca user group ID
          nullable: true
          description: IDs of Syteca user groups, the domain user should be added
      additionalProperties: false
    CreateDomainUserResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique Syteca user ID
        user_type:
          type: string
          nullable: true
          description: User type
        account_name:
          type: string
          nullable: true
          description: Domain account name
        domain:
          type: string
          nullable: true
          description: AD domain name
        two_factor_required:
          type: boolean
          description: Two-factor authentication on login
        external_app_enabled:
          type: boolean
          description: Allow this user account to be used by external applications
        auth_token_lifetime_sec:
          type: integer
          format: int32
          nullable: true
          description: The lifetime of an access token in seconds for this user
        ip_restrictions:
          type: array
          items:
            type: string
            description: IP address
          nullable: true
          description: Allowed IP address for this user's API access
        user_group_ids:
          type: array
          items:
            type: integer
            format: int32
            description: Syteca user group ID
          nullable: true
          description: List of Syteca user group IDs this user belongs to
        has_user_groups:
          type: boolean
          description: The user is a member of any user groups
      additionalProperties: false
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````