> ## Documentation Index > Fetch the complete documentation index at: https://developers.phrase.com/llms.txt > Use this file to discover all available pages before exploring further. # Create user > Provisions a new user into the authenticated organization using the SCIM `urn:ietf:params:scim:schemas:core:2.0:User` schema. If a user with the same `userName` or primary email already exists in another organization within the same customer group (SSO-linked), the user is added to this organization instead of being created. ## OpenAPI ````yaml /openapi/phrase-platform.json post /scim/Users openapi: 3.0.0 info: title: Phrase Platform API description: | ### Phrase Platform related API. version: 1.0.0 termsOfService: https://phrase.com/terms/ contact: url: https://phrase.com servers: - url: https://eu.phrase.com/idm/ description: The API server for EU data center. - url: https://us.phrase.com/idm/ description: The API server for US data center. security: [] tags: - name: OAuth description: OAuth Protocol - name: SCIM description: >- System for Cross-domain Identity Management (RFC 7643, RFC 7644). Enables automated user provisioning and deprovisioning from an identity provider (IdP). paths: /scim/Users: post: tags: - SCIM summary: Create user description: >- Provisions a new user into the authenticated organization using the SCIM `urn:ietf:params:scim:schemas:core:2.0:User` schema. If a user with the same `userName` or primary email already exists in another organization within the same customer group (SSO-linked), the user is added to this organization instead of being created. operationId: createScimUser requestBody: required: true content: application/scim+json: schema: $ref: '#/components/schemas/ScimUserRequest' application/json: schema: $ref: '#/components/schemas/ScimUserRequest' responses: '201': description: User created successfully content: application/scim+json: schema: $ref: '#/components/schemas/ScimUser' '400': description: Bad request — validation error or malformed body content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '401': description: Unauthorized — missing or invalid token content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '409': description: Conflict — `userName` already in use content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '422': description: >- Unprocessable entity — business rule violation (e.g. duplicate email, invalid locale or timezone) content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '500': description: Internal server error content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' security: - scimToken: [] components: schemas: ScimUserRequest: description: SCIM User resource for create and update (PUT) operations type: object required: - userName - emails properties: schemas: description: SCIM schema URNs type: array items: type: string example: - urn:ietf:params:scim:schemas:core:2.0:User externalId: description: Identifier assigned by the provisioning client (IdP) type: string userName: description: >- Unique username within the Phrase Platform. Required for create; optional for replace if unchanged. type: string name: $ref: '#/components/schemas/ScimName' emails: description: >- List of email addresses. Must include at least one entry. The primary email is derived from the entry with `primary: true`, or the first entry if none is marked primary. type: array minItems: 1 items: $ref: '#/components/schemas/ScimEmail' active: description: >- Whether the user account should be enabled. **Ignored on create** — newly provisioned users are always active regardless of this value. type: boolean locale: description: >- User locale in IETF BCP 47 format (e.g. `en-US`). Falls back to the organization default when not provided or when the value does not match a supported locale. type: string timezone: description: >- User time zone in IANA Time Zone Database format (e.g. `Europe/Berlin`). Falls back to the organization default when not provided or when the value is not a recognized IANA timezone. type: string roles: description: >- Roles to assign on create. Only processed when SCIM role management is enabled for the organization. **Ignored on PUT and PATCH** — role updates via SCIM are not supported. **Standard format** (Okta, JumpCloud): one entry per Phrase product with `type` starting with `phrase__` and `value` set to the role name. The `phrase__platform` entry is mandatory and cannot be set to `none`. **Azure AD format**: single entry with `type: "WindowsAzureActiveDirectoryRole"` and `value` set to a JSON-escaped array of standard role objects. Example (standard): ```json [ { "type": "phrase__platform", "value": "MEMBER" }, { "type": "phrase__tms", "value": "none" }, { "type": "phrase__strings", "value": "Translator" } ] ``` Example (Azure AD): ```json [ { "type": "WindowsAzureActiveDirectoryRole", "value": "[{\"type\":\"phrase__platform\",\"value\":\"MEMBER\"},{\"type\":\"phrase__tms\",\"value\":\"none\"},{\"type\":\"phrase__strings\",\"value\":\"Translator\"}]" } ] ``` type: array items: $ref: '#/components/schemas/ScimRole' ScimUser: description: SCIM User resource (`urn:ietf:params:scim:schemas:core:2.0:User`) type: object properties: schemas: description: SCIM schema URNs type: array items: type: string example: - urn:ietf:params:scim:schemas:core:2.0:User id: description: >- Unique Phrase Platform identity UID, assigned by the service provider type: string readOnly: true externalId: description: >- Identifier assigned by the provisioning client (IdP). Used to correlate the Phrase identity with the IdP record. type: string userName: description: Unique username within the Phrase Platform type: string name: $ref: '#/components/schemas/ScimName' emails: description: >- List of email addresses. The first entry marked `primary: true` is used as the user's primary email. type: array items: $ref: '#/components/schemas/ScimEmail' active: description: Whether the user account is enabled type: boolean locale: description: User locale in IETF BCP 47 format (e.g. `en-US`) type: string timezone: description: >- User time zone in IANA Time Zone Database format (e.g. `Europe/Berlin`) type: string roles: description: >- Roles to assign on create. Only processed when SCIM role management is enabled for the organization. type: array items: $ref: '#/components/schemas/ScimRole' meta: $ref: '#/components/schemas/ScimMeta' ScimError: description: SCIM error response (RFC 7644 Section 3.12) type: object properties: schemas: type: array items: type: string example: - urn:ietf:params:scim:api:messages:2.0:Error status: description: HTTP status code as a string type: string scimType: description: >- SCIM error keyword (RFC 7644 Section 3.12), e.g. `invalidFilter`, `invalidValue`, `uniqueness` type: string detail: description: Human-readable error description type: string ScimName: description: User's name components type: object properties: givenName: description: First name type: string familyName: description: Last name type: string ScimEmail: description: Email address entry type: object properties: value: description: Email address type: string format: email primary: description: Whether this is the user's primary email address type: boolean ScimRole: description: >- Role assigned to the user. Used in create requests when SCIM role management is enabled for the organization. Two formats are supported: **Standard format** (Okta, JumpCloud): one entry per Phrase product, each with a `phrase__`-prefixed `type` and a role `value`. **Azure AD format**: a single entry with `type: "WindowsAzureActiveDirectoryRole"` and a `value` containing a JSON-escaped array of standard role objects (e.g. `[{\"type\":\"phrase__platform\",\"value\":\"MEMBER\"}]`). type: object properties: type: description: >- Phrase product identifier. Must start with `phrase__` (e.g. `phrase__platform`, `phrase__tms`, `phrase__strings`). The `phrase__platform` role is mandatory when SCIM role management is enabled — it cannot be omitted or set to `none`. Alternatively, use `WindowsAzureActiveDirectoryRole` for the Azure AD format, in which case `value` must be a JSON-escaped array of standard role objects. type: string example: phrase__platform value: description: >- Role name for the target product. Use `default` to assign the system configured default role. Use `none` to exclude access to a product — **not applicable to `phrase__platform`**, which is mandatory and cannot be `none`. Valid values per product: | Product | Valid values | |---|---| | `phrase__platform` | `OWNER`, `ADMIN`, `MEMBER`, `default` | | `phrase__tms` | `ADMIN`, `PROJECT_MANAGER`, `LINGUIST`, `GUEST`, `SUBMITTER`, `PORTAL_MEMBER`, `default`, `none` | | `phrase__strings` | `Owner`, `Admin`, `ProjectManager`, `Developer`, `Designer`, `Translator`, `Guest`, `default`, `none` | Role names are case-sensitive. Other app-specific role names can be found in the SCIM configuration page in Phrase Platform. When `type` is `WindowsAzureActiveDirectoryRole`, this field must be a JSON-escaped array string: `"[{\"type\":\"phrase__platform\",\"value\":\"MEMBER\"}]"`. Items missing `type` or `value` keys are silently skipped. type: string example: MEMBER ScimMeta: description: Resource metadata set by the service provider type: object readOnly: true properties: resourceType: description: SCIM resource type type: string example: User created: description: Timestamp when the identity was created type: string format: date-time lastModified: description: Timestamp of the last update to the identity type: string format: date-time location: description: Canonical URI of this resource type: string securitySchemes: scimToken: type: http scheme: bearer description: >- SCIM access token issued via Phrase Platform organization settings. The Bearer token value must be configured in Phrase Platform SCIM section. ````