Create Consumer

Endpoint

POST /apiops/projects/{projectName}/consumers

Authentication

Requires a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name

Request Body

{
  "username": "api-user",
  "password": "SecurePassword123!",
  "fullName": "API User",
  "email": "api-user@example.com",
  "description": "Consumer of the payments team",
  "enabled": true,
  "ipList": ["192.168.1.100"],
  "expireDate": "2027-12-31T23:59:59.000Z",
  "roleNameList": ["API_USER"],
  "organizationCode": "acme-partners",
  "trafficLogDisabled": false
}

Field	Type	Required	Description
username	string	Yes	Username of the consumer. Unique in the project. Immutable after create
password	string	Yes	Password. Stored encrypted and never returned
fullName	string	No	Display name
email	string	No	Email address
description	string	No	Description
enabled	boolean	No	Whether the consumer is enabled
ipList	array of string	No	Allowed IP addresses
expireDate	timestamp	No	Expiry of the consumer
roleNameList	array of string	No	Names of consumer roles. A name resolves in the project of the consumer first, then in the admin project. A role of another project is not resolved. An unknown role answers 400 malformedRequest (params.reason = unknownRole)
metadata	array	No	Custom metadata entries. Fields below
trafficLogDisabled	boolean	No	true keeps the traffic of this consumer out of the traffic-log connectors
organizationCode	string	No	Organization of the project to file the consumer under. An unknown code answers 404 resourceNotFound

Do not send consumerKey. The installation assigns it, and a request that names one answers 400 immutableField.

Metadata entry fields:

Field	Type	Description
key	string	Metadata key
value	string	Metadata value. For a secret entry the value is write-only
secret	boolean	true for a secret entry
includeInJwt	boolean	Add the entry to the JWT
includeInTokenResponse	boolean	Add the entry to the token response
jwtClaimName	string	Claim name in the JWT

Response

201 Created with a Location header (/apiops/projects/{projectName}/consumers/{consumerKey}).

The response is a write response. result is the consumer. runtimeDeployment.state is IN_SYNC when every environment acknowledged the change, or DEGRADED when the change is stored but at least one environment did not acknowledge it. Do not retry a DEGRADED write; redeploy instead. resourceVersion is not returned.

{
  "status": "SUCCESS",
  "result": {
    "consumerKey": "CONSUMER_KEY",
    "username": "api-user",
    "enabled": true,
    "organizationCode": "acme-partners"
  },
  "runtimeDeployment": {
    "state": "IN_SYNC",
    "environments": [
      { "name": "production", "acknowledged": true }
    ]
  }
}

Errors

Status	Error key	Cause
400	malformedRequest	username or password is missing (params.field, params.reason = required), or a role name is unknown
400	immutableField	The body names a consumerKey
404	resourceNotFound	The organization code is unknown
409	duplicateName	The username is already taken in the project

cURL Example

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/consumers" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "api-user",
    "password": "SecurePassword123!",
    "email": "api-user@example.com",
    "enabled": true
  }'

Permissions

• User must have IDENTITY + MANAGE permission in the project
• A project outside the scope of the caller answers 404 resourceNotFound, never 403
• The admin project has no consumers: a call on it answers 400 malformedRequest (params.reason = platformScopeNotSupported)