Create a user with optional password + created_at

POST

/admin/seed/users

• Local development behind nginx (port 8088 by default)

Operator-tooling endpoint for the demo-seed loader. NOT for general operator use — gated on system.admin; not surfaced in the admin UI.

Creates a single user. Idempotency key is the supplied username (UNIQUE in the user table) — a re-run with the same username returns 200 with the existing row instead of 409, so apply scripts can re-run safely without first checking for prior state.

Apply scripts build a local username→ref map from the returned ref and use it when seeding posts / collections / comments that reference users by ref.

Emits one admin.seed.user_created audit per actual insert (re-runs skip the audit — same pattern as /admin/seed/comments).

Authorizations

• cookieAuth
• bearerAuth

Request Body ^required

object

username

required

Stable identifier across apply-script re-runs. UNIQUE in the user table — duplicate request returns 200 with the existing row instead of 409.

string

>= 1 characters <= 50 characters

fullname

string

nullable <= 100 characters

email

string format: email

nullable

password

Optional plaintext password to hash + persist. When omitted, the user is created with no password (the password column is NULL) so they can’t log in — useful for fictional seed users who exist as actors on posts/comments but never sign in.

string

nullable

usergroup

Legacy permission group. Defaults to 2 (regular user) when omitted. Set to 3 only for admin-tier seed users; the seed loader uses 2 for everything else by convention.

integer format: int64

nullable

approved

When true, the user is approved at create time (matching the regular CreateUser path). Seed users should almost always be approved; pending-approval state is a normal signup-flow concern, not a seed concern.

boolean

default: true

created_at

Optional creation timestamp. Defaults to NOW() when omitted. The seed loader uses this to align user “joined” dates with the 14-month interlaced timeline.

string format: date-time

nullable

Responses

200

Idempotent re-run — the supplied username already exists; the existing row’s ref is returned unchanged.

object

ref

required

Server-assigned user.ref PK.

integer format: int64

username

required

string

already_existed

required

True on idempotent re-run (response status 200), false on fresh insert (response status 201).

boolean

201

User created.

object

ref

required

Server-assigned user.ref PK.

integer format: int64

username

required

string

already_existed

required

True on idempotent re-run (response status 200), false on fresh insert (response status 201).

boolean

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed