> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Internal User

> Syteca ACB REST API endpoint to create a new Syteca Internal user (managed entirely within Syteca, not linked to Active Directory) — for IdP-driven user provisioning workflows.

Creates a new Syteca **Internal** user — managed entirely within Syteca, with credentials and password lifecycle stored in the Syteca database. Use this when you want full programmatic control over the user (vs linking an Active Directory account via [Create domain user](/docs/api/acb/endpoints/create-domain-user)).

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The Access Token must be issued to a user with the [administrative User Management permission](/docs/administration/users/administrative-permissions).

### Common use cases

* **IdP-driven provisioning** — Okta / Azure AD / Workday triggers user creation in Syteca via webhook + this endpoint.
* **Service desk automation** — ticket-driven user onboarding writes directly to Syteca rather than going through manual admin steps.
* **Contractor onboarding** — short-lived accounts created programmatically with auto-cleanup via [Delete user](/docs/api/acb/endpoints/delete-user) after engagement end.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — invalid field values (login format, password policy violation).
* **403 Forbidden** — user lacks administrative User Management permission.
* **409 Conflict** — login already exists.

## Related

<CardGroup cols={2}>
  <Card title="Create domain user" icon="user-cog" href="/docs/api/acb/endpoints/create-domain-user">Link an Active Directory user instead.</Card>
  <Card title="Get user details" icon="user-search" href="/docs/api/acb/endpoints/get-user-details">Verify creation succeeded.</Card>
  <Card title="Update admin permissions" icon="shield-check" href="/docs/api/acb/endpoints/update-admin-permissions">Grant admin permissions after creation.</Card>
  <Card title="Add to user group" icon="users" href="/docs/api/acb/endpoints/add-user-to-group">Assign group membership.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/user-management/users/internal
openapi: 3.0.1
info:
  title: Application Credentials Broker API
  description: API for managing users in the Application Credentials Broker system
  version: 1.0.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/user-management/users/internal:
    post:
      tags:
        - UserManagement
      summary: Create an internal user
      description: Create a new internal Syteca user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateInternalUserRequestDto'
      responses:
        '201':
          description: User created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateInternalUserResponseDto'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CreateInternalUserRequestDto:
      type: object
      properties:
        admin_permissions:
          $ref: '#/components/schemas/AdminPermissionsDto'
          description: List of administrative permissions to assign directly to the user
        auth_token_lifetime_sec:
          type: integer
          format: int32
          nullable: true
          description: The lifetime of an access token in seconds for this user
        client_access_rules:
          type: array
          items:
            $ref: '#/components/schemas/ClientAccessRuleDto'
          nullable: true
          description: List of direct Client Access rules for this user
        description:
          type: string
          nullable: true
          description: Free-form comment/description for the user
        email:
          type: string
          nullable: true
          description: User’s email address
        external_app_enabled:
          type: boolean
          description: Allow this user account to be used by external applications
        first_name:
          type: string
          nullable: true
          description: User’s first name (display only)
        ip_restrictions:
          type: array
          items:
            type: string
            description: IP address
          nullable: true
          description: Allowed IP address for this user’s API access
        last_name:
          type: string
          nullable: true
          description: User’s last name (display only)
        password:
          type: string
          nullable: true
          description: User password that satisfies the current password policy
        two_factor_required:
          type: boolean
          description: Enable two-factor authentication on login
        user_access_rules:
          type: array
          items:
            $ref: '#/components/schemas/UserAccessRuleDto'
          nullable: true
          description: Direct User Access rules for the user
        user_group_ids:
          type: array
          items:
            type: integer
            format: int32
            description: Syteca user group ID
          nullable: true
          description: IDs of Syteca user groups, the internal user should be added
        username:
          type: string
          nullable: true
          description: Login name of the internal user
      additionalProperties: false
    CreateInternalUserResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique Syteca user ID
        user_type:
          type: string
          nullable: true
          description: User type
        username:
          type: string
          nullable: true
          description: Login name
        first_name:
          type: string
          nullable: true
          description: First name
        last_name:
          type: string
          nullable: true
          description: Last name
        email:
          type: string
          nullable: true
          description: Email address
        description:
          type: string
          nullable: true
          description: Optional description/comment
        two_factor_required:
          type: boolean
          description: Two-factor authentication on login
        external_app_enabled:
          type: boolean
          description: Allow this user account to be used by external applications
        auth_token_lifetime_sec:
          type: integer
          format: int32
          nullable: true
          description: The lifetime of an access token in seconds for this user
        ip_restrictions:
          type: array
          items:
            type: string
            description: IP address
          nullable: true
          description: Allowed IP address for this user's API access
        user_group_ids:
          type: array
          items:
            type: integer
            format: int32
            description: Syteca user group ID
          nullable: true
          description: List of Syteca user group IDs this user belongs to
        has_user_groups:
          type: boolean
          description: The user is a member of any user groups
      additionalProperties: false
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    AdminPermissionsDto:
      type: object
      properties:
        direct_permission_keys:
          type: array
          description: >-
            Array of permission identifiers that match the UI list on the
            Administrative Permissions tab
          items:
            type: string
            description: Administrative permission identifier
          nullable: true
      additionalProperties: false
    ClientAccessRuleDto:
      type: object
      properties:
        client_group_id:
          type: integer
          format: int32
          nullable: true
          description: ID of a Client group the rule applies to
        client_id:
          type: integer
          format: int32
          nullable: true
          description: ID of a specific Client endpoint the rule applies to
        permission_keys:
          type: array
          items:
            type: string
            description: Client permission identifier
          nullable: true
          description: >-
            Set of Client permissions to grant directly for this user on the
            selected group/client
      additionalProperties: false
    UserAccessRuleDto:
      type: object
      properties:
        account_name:
          type: string
          nullable: true
          description: AD or local account name
        domain_or_computer:
          type: string
          nullable: true
          description: AD domain name or computer hostname
      additionalProperties: false
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````