> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Create service user > Creates a new service user (a non-human identity owned by a team). Mirrors the GraphQL `createServiceUser` mutation; admin-only. The returned `User` object is the newly created service user and is a regular `User` row — read it later via `GET /users/{user_id}`, delete it with `DELETE /users/{user_id}`, and manage its tags via the usual `/users/{user_id}/tags` endpoints. **Role grants are a separate concern.** To grant a service user access to resources or groups, use `POST /role-assignments` (or the per-pair endpoints such as `/resources/{id}/users/{id}`). Keeping role assignments out of this request body means each grant stays independently addressable — the shape Terraform and other declarative clients prefer, with no field here that would silently drift when a grant is added or revoked through a different code path. **Automations are not configurable here either.** The GraphQL mutation accepts a wide typed-union of automation configuration; that surface is intentionally omitted from this REST endpoint for the same reason. Service users created through this endpoint start with no automations. ## OpenAPI ````yaml https://app.opal.dev/openapi.yaml post /service-users openapi: 3.1.0 info: contact: email: hello@opal.dev name: Opal Team url: https://www.opal.dev/ description: >- The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically. title: Opal API version: '1.0' servers: - description: Production url: https://api.opal.dev/v1 security: [] tags: - name: access-rules description: Operations related to access rules - name: agent-activity description: Operations related to agent activity telemetry - name: apps description: Operations related to apps - name: bundles description: Operations related to bundles - name: campaigns description: Operations related to access review campaigns - name: configuration-templates description: Operations related to configuration templates - name: delegations description: Operations related to request reviewer delegations - name: event-streams description: Operations related to event streaming connections - name: events description: Operations related to events - name: groups description: Operations related to groups - name: group-bindings description: Operations related to group bindings - name: idp-group-mappings description: Operations related to IDP group mappings - name: message-channels description: Operations related to message channels - name: non-human-identities description: Operations related to non-human identities - name: on-call-schedules description: Operations related to on-call schedules - name: opal-queries description: Operations related to OpalQuery - name: opal-scripts description: Operations related to OpalScripts - name: owners description: Operations related to owners - name: requests description: Operations related to requests - name: resources description: Operations related to resources - name: role-assignments description: >- Operations related to role assignments (general grants between an entity and a principal) - name: paladin description: Operations related to Paladin - name: service-users description: Operations related to service users (non-human identities owned by a team) - name: sessions description: Operations related to sessions - name: tags description: Operations related to tags - name: tokens description: Operations related to API tokens - name: uars description: Operations related to UARs. Deprecated in favor of the `campaigns` API. - name: users description: Operations related to users paths: /service-users: post: tags: - service-users summary: Create service user description: > Creates a new service user (a non-human identity owned by a team). Mirrors the GraphQL `createServiceUser` mutation; admin-only. The returned `User` object is the newly created service user and is a regular `User` row — read it later via `GET /users/{user_id}`, delete it with `DELETE /users/{user_id}`, and manage its tags via the usual `/users/{user_id}/tags` endpoints. **Role grants are a separate concern.** To grant a service user access to resources or groups, use `POST /role-assignments` (or the per-pair endpoints such as `/resources/{id}/users/{id}`). Keeping role assignments out of this request body means each grant stays independently addressable — the shape Terraform and other declarative clients prefer, with no field here that would silently drift when a grant is added or revoked through a different code path. **Automations are not configurable here either.** The GraphQL mutation accepts a wide typed-union of automation configuration; that surface is intentionally omitted from this REST endpoint for the same reason. Service users created through this endpoint start with no automations. operationId: createServiceUser requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateServiceUserRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/User' description: The created service user. '400': description: | Invalid request body: malformed JSON, unknown field, missing or empty `name`, or missing / malformed `owner_id`. '403': description: Caller is not an admin. '404': description: The `owner_id` does not reference an owner in the organization. security: - BearerAuth: [] components: schemas: CreateServiceUserRequest: description: | Request body for `POST /service-users`. Intentionally minimal: only the two fields that uniquely identify a new service user. Role grants are a separate resource managed through `/role-assignments`, which keeps each grant independently addressable and avoids silent drift when grants are added or revoked through another code path. example: name: paladin-prod owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8 properties: name: description: The display name of the service user. example: paladin-prod minLength: 1 type: string owner_id: description: >- The ID of the owner (team of record) that owns the service user. Must reference an existing owner in the caller's organization. example: 7c86c85d-0651-43e2-a748-d69d658418e8 format: uuid type: string required: - name - owner_id type: object User: description: |- # User Object ### Description The `User` object is used to represent a user. ### Usage Example Fetch from the `LIST Sessions` endpoint. example: user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac email: john.doe@company.dev full_name: John Doe first_name: John last_name: Doe position: Engineer properties: user_id: description: The ID of the user. example: h0z968412-2451-4bbd-42h4-057l715d917m format: uuid type: string email: description: The email of the user. example: john.doe@company.dev type: string full_name: description: The full name of the user. example: John Doe type: string first_name: description: The first name of the user. example: John type: string last_name: description: The last name of the user. example: Doe type: string position: description: The user's position. example: Senior Engineer type: string manager_id: description: The ID of the user's manager. Null if the user has no manager. example: 29827fb8-f2dd-4e80-9576-28e31e9934ac format: uuid nullable: true type: string hr_idp_status: $ref: '#/components/schemas/UserHrIdpStatusEnum' required: - user_id - email - full_name - first_name - last_name - position type: object UserHrIdpStatusEnum: description: User status pulled from an HR/IDP provider. enum: - ACTIVE - SUSPENDED - DEPROVISIONED - DELETED - NOT_FOUND example: ACTIVE type: string securitySchemes: BearerAuth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.