Create user

Creates a database user that authenticates with either a password or a generated API key.

POST /v1/tenants/{tenant}/db/users

Create a database user's credentialsA database-user key is separate from an organization-management credential.

Choose the user's accessSelect its roles and authentication method.
Create the userSupply a password or request a generated API key.
Store the credential securelyCapture a returned API key without exposing it.

Before you start

Use your database bearer token.

Connection setup

Use an identity authorized to manage access. Create the roles you will assign, and store a returned API key securely.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Request body

application/json

Limits and accepted values

auth is one of: password, api_key.
password is required (non-empty) when auth is password and must use the portable character set accepted by every wire protocol.
roles defaults to [].
An existing username is a 400.

Field	Type	Required
`auth`	`string`	Required
`password`	`string`	Optional
`roles`	`string[]`	Optional

Fields in roles

Field	Type	Required
`roles`	`string`	Optional

Field	Type	Required
`username`	`string`	Required

For auth: api_key, capture the returned api_key securely. The assigned roles determine access. This database-user API key is not an organization-management credential or a promise that a PostgreSQL listener exists.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
409	Resolve the conflict before retrying.
413	Split or reduce the request body.
415	Send the required Content-Type.
422	Correct the values or unsupported combination.
429	Honor Retry-After when present; back off.
500	Check the outcome before retrying a write.
501	Check deployment support for this operation.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request POST "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/users" \
  --header "Authorization: Bearer ${OC_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary '{
  "username": "demo_user",
  "auth": "api_key",
  "roles": [
    "demo_reader"
  ]
}'

Response example

Examples use synthetic values to show the response format.

Response status

{
  "username": "demo_user",
  "api_key": "<new-user-api-key>"
}

One-time credential placeholder; store the actual returned key securely.

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

HeadersCopy Anchor Link

Request bodyCopy Anchor Link

Read the resultCopy Anchor Link

Response statusesCopy Anchor Link

Before you start

Path parameters

Headers

Request body

Read the result

Response statuses