Create Account

Create an account owned by a user or an organization — see Service Accounts for what that means and the full recipe from here to a working key.

POST `/users/target/:target/:target_id`

Path Parameters

Parameter	Type	Required	Description
`target`	string	Yes	Owner type: `user` or `org`.
`target_id`	string	Yes	The unique ID or alias of the owning user or organization.

Request Body

Parameter	Type	Required	Description
`type`	string	Yes	Account kind. Only `service` exists today.
`name`	string	Yes	Display name, 1–128 characters. Free-form and not unique.

type is the extension point for this endpoint, not a set of endpoints. A future kind of account is a new enum value here — never a new endpoint, and never a new path.

Response

Parameter	Type	Description
`user`	object	The created account.

Errors

Status	Error	Cause
400	`invalid_request_body`	Wrong `type`, missing/invalid `name`, or an extra field.
400	`invalid_target`	`target` is not `user` or `org` (e.g. `blob`).
400	`owner_not_found`	The named owner does not exist.
400	`service_account_cannot_own_account`	`target=user` names a service account, which can’t own one.
403	`forbidden`	Missing `admin` access to the owner, or no human behind the request.

See Permissions below for who can call this endpoint at all.

Example

curl -X POST https://api.blobhub.io/v1/users/target/org/d7bd017b-0b15-4869-adff-9f11cbceda1e \
  -H "X-API-Key: $ORG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "service",
    "name": "CI Bot"
  }'

{
  "status": "success",
  "user": {
    "id": "fe827336-3548-429c-a37c-a06d9b689eac",
    "name": "CI Bot",
    "type": "service",
    "status": "active",
    "owner_target": "org",
    "owner_target_id": "d7bd017b-0b15-4869-adff-9f11cbceda1e",
    "owner_target_target_id": "org#d7bd017b-0b15-4869-adff-9f11cbceda1e"
  }
}

owner_target_target_id is an internal index key the API happens to serialize — safe to ignore.

Identifier

target_id accepts a UUID or an alias. When target=user it also accepts me.

Permissions

Caller	Access
The owning user, signed in as themselves	Allowed.
An admin of the owning organization	Allowed.
An org-scoped API key with the `admin` role, for the owning org	Allowed — the path most CI pipelines use.
An acting token, where the account it acts as reaches the owner	Allowed.
A service account’s own key, for itself or anything else	Forbidden, always.

Creating an account is a human act: the request fails with 403 whenever there is no human behind it at all, which is what makes the last row unconditional rather than role-dependent — a service account’s key can never satisfy it, no matter what role that key carries. An acting token does satisfy it, because it names the human who minted it; reaching the owner is then the ordinary admin access check, unchanged. See The Access Perimeter for the same rule across all ten operations it governs.

REST API

WebSocket API

POST `/users/target/:target/:target_id`

Path Parameters

Request Body

Response

Errors

Example

Identifier

Permissions

​POST /users/target/:target/:target_id

​Path Parameters

​Request Body

​Response

​Errors

​Example

​Identifier

​Permissions

POST `/users/target/:target/:target_id`

Path Parameters

Request Body

Response

Errors

Example

Identifier

Permissions