createUser

Mock

Mock. This operation is part of the approved contract but its module is not built yet. Run Core with N1_API_MODE=mock N1_DEV_AUTH=stub to get deterministic demo-shop data from it. The real server answers NOT_IMPLEMENTED until it ships; the schema and examples here will not change when it does.

Add a person to the shop

Compare

Add a person to the shop. Owner and admin only. USER_ALREADY_EXISTS if the email or phone is taken.

POST/graphqlapp audience

Who can call this. Owner and admin. You can run it against Local or Staging from the request panel, with a demo-shop token.

Headers

Required Optional

AuthorizationstringRequired
Bearer <token>, issued for this endpoint's audience. The token decides the shop and roles; nothing in the request body can change them.
Example: Bearer eyJhbGciOiJFZERTQSJ9…
Content-TypestringRequired
Always application/json. Only POST is accepted.
Example: application/json
Idempotency-KeystringRequired
A key you generate once per user action (a UUID). Retrying with the same key never applies the change twice.
Example: 0192f0c1-9b2a-7d40-8c3e-1f5a6b7c8d9e
X-Request-IdstringOptional
Your id for this request (8–128 characters of A–Z a–z 0–9 . _ : -). Echoed back in the response header and in every error, so you can quote it when reporting a problem. Core makes one if you send none.
Example: app-7f3c2a9e-checkout

Arguments

Required Optional

inputCreateUserInput!Required
The new person.
Example: {"name":"Ila Demo","phone":"+91 90000 01234","role":"OPERATOR","initialPassword":"first-demo-password-3"}
Show children
- emailStringOptional
  Sign-in email.
- initialPasswordString!Required
  10–128 characters. Share it once; they change it at first sign-in.
- nameString!Required
  Full name.
- phoneStringOptional
  Sign-in phone.
- roleRoleName!Required
  Their role.

Returns

Required Optional

createUserUser!Required
Add a person to the shop. Owner and admin only. USER_ALREADY_EXISTS if the email or phone is taken.
Show children
- createdAtString!Required
  UTC time the user was added.
  Example: "2026-10-12T04:30:00.000Z"
- emailStringOptional
  Sign-in email, if any.
  Example: null
- idID!Required
  Stable id (UUIDv7).
  Example: "0192f0c1-0000-7000-8000-a00000001000"
- lastLoginAtStringOptional
  UTC time of the last sign-in; null if never.
  Example: null
- nameString!Required
  Full name.
  Example: "Ila Demo"
- phoneStringOptional
  Sign-in phone, if any.
  Example: "+91 90000 01234"
- roleRoleName!Required
  Their role in this shop.
  Example: "OPERATOR"
  - ACCOUNTANTCustomers, invoices and payments.
  - ADMINManages people, settings and customers on the owner’s behalf.
  - OPERATORRuns machines and logs production.
  - OWNERRuns the shop. Everything, including who else can sign in.
  - QCInspects parts and records results.
  - SUPERVISORPlans and watches the shop floor.
- statusUserStatus!Required
  Whether they can sign in.
  Example: "ACTIVE"
  - ACTIVECan sign in.
  - INACTIVECannot sign in; their sessions were revoked. History stays.

Errors

Code	HTTP	When
`FORBIDDEN`	`403`	Signed in, but the role or tenant does not allow the action.
`USER_ALREADY_EXISTS`	`409`	Creating or editing a user with an email or phone another user in this shop already has.
`VALIDATION_FAILED`	`400`	Input failed Zod or route schema validation. `details` lists each field path and problem.

Every error has the same body. See Errors.

Rate limit tier

Tier: per user. Over the limit you get RATE_LIMITED (HTTP 429) with a Retry-After header. See Response handling.