> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blobhub.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Account

Create an account owned by a user or an organization — see [Service Accounts](/general/service-accounts)
for what that means and the full recipe from here to a working key.

## **POST** `/users/target/:target/:target_id`

### Path Parameters

| Parameter   | Type   | Required | Description                                                |
| :---------- | :----- | :------- | :--------------------------------------------------------- |
| `target`    | string | Yes      | Owner type: `user` or `org`.                               |
| `target_id` | string | Yes      | The unique ID or alias of the owning user or organization. |

### Request Body

| Parameter | Type   | Required | Description                                               |
| :-------- | :----- | :------- | :-------------------------------------------------------- |
| `type`    | string | Yes      | Account kind. Only `service` exists today.                |
| `name`    | string | Yes      | Display name, 1–128 characters. Free-form and not unique. |

<Note>
  `type` is the extension point for this endpoint, not a set of endpoints. A future kind of account is a
  new enum value here — never a new endpoint, and never a new path.
</Note>

### Response

| Parameter | Type   | Description          |
| :-------- | :----- | :------------------- |
| `user`    | object | The created account. |

### Errors

| Status | Error                                | Cause                                                                |
| :----- | :----------------------------------- | :------------------------------------------------------------------- |
| 400    | `invalid_request_body`               | Wrong `type`, missing/invalid `name`, or an extra field.             |
| 400    | `invalid_target`                     | `target` is not `user` or `org` (e.g. `blob`).                       |
| 400    | `owner_not_found`                    | The named owner does not exist.                                      |
| 400    | `service_account_cannot_own_account` | `target=user` names a service account, which can't own one.          |
| 403    | `forbidden`                          | Missing `admin` access to the owner, or no human behind the request. |

See [Permissions](#permissions) below for who can call this endpoint at all.

### Example

<CodeGroup>
  ```bash Request theme={null}
  curl -X POST https://api.blobhub.io/v1/users/target/org/d7bd017b-0b15-4869-adff-9f11cbceda1e \
    -H "X-API-Key: $ORG_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "type": "service",
      "name": "CI Bot"
    }'
  ```

  ```json Response theme={null}
  {
    "status": "success",
    "user": {
      "id": "fe827336-3548-429c-a37c-a06d9b689eac",
      "name": "CI Bot",
      "type": "service",
      "status": "active",
      "owner_target": "org",
      "owner_target_id": "d7bd017b-0b15-4869-adff-9f11cbceda1e",
      "owner_target_target_id": "org#d7bd017b-0b15-4869-adff-9f11cbceda1e"
    }
  }
  ```
</CodeGroup>

`owner_target_target_id` is an internal index key the API happens to serialize — safe to ignore.

### Identifier

`target_id` accepts a UUID or an alias. When `target=user` it also accepts
[`me`](/rest-api/conventions#the-me-alias).

### Permissions

| Caller                                                                                        | Access                                    |
| :-------------------------------------------------------------------------------------------- | :---------------------------------------- |
| The owning user, signed in as themselves                                                      | Allowed.                                  |
| An admin of the owning organization                                                           | Allowed.                                  |
| An org-scoped API key with the `admin` role, for the owning org                               | Allowed — the path most CI pipelines use. |
| An [acting token](/rest-api/auth/impersonate), where the account it acts as reaches the owner | Allowed.                                  |
| A service account's own key, for itself or anything else                                      | Forbidden, always.                        |

Creating an account is a human act: the request fails with `403` whenever there is no human behind
it at all, which is what makes the last row unconditional rather than role-dependent — a service
account's key can never satisfy it, no matter what role that key carries. An acting token does satisfy it,
because it names the human who minted it; reaching the owner is then the ordinary `admin` access check,
unchanged. See [The Access Perimeter](/general/service-accounts#the-access-perimeter) for the same rule
across all ten operations it governs.