> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # Create a user > Creates a user in your realm and e-mails them an invitation to complete onboarding. The user is created `IN_ONBOARDING` and becomes `ACTIVE` once they finish the onboarding the invitation links to. They are added to every organization in `organizations`; you must be an admin of each of them, and only a realm administrator can create a realm `ADMIN`. The e-mail address can't be changed afterwards. ## OpenAPI ````yaml /api-reference/identity.openapi.json post /realms/{realmId}/users openapi: 3.0.3 info: title: Identity version: 1.0.0 description: >- Portão 3 identity API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). 4 app groups run without the identity authorizer; publicPatterns enumerates every route they expose, except POST /auth/sign-in, documented with HTTP Basic for the API-client credentials flow. Confidence tiers: generated:typed=45 copied:manual=0 unknown=0. servers: - url: https://api.identity.v2.portao3.com.br/ description: production - url: https://api.identity.dev.3pers.com.br/ description: development security: [] tags: - name: Authentication - name: Current User - name: Custom Fields - name: API Clients - name: Users - name: Organizations - name: Groups - name: Realms paths: /realms/{realmId}/users: post: tags: - Users summary: Create a user description: >- Creates a user in your realm and e-mails them an invitation to complete onboarding. operationId: postRealmsByRealmIdUsers parameters: - name: realmId in: path required: true description: |- ID of your realm. The user is created in it. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b requestBody: required: true content: application/json: schema: type: object properties: email: type: string format: email pattern: >- ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ description: >- E-mail address the user will sign in with. The invitation is sent to it, and it can't be changed later. example: ana.souza@acme.com.br cpf: type: string minLength: 1 description: CPF, digits only. Must be a valid CPF. example: '52998224725' birthdate: description: >- Date of birth, as an ISO 8601 date-time at midnight UTC. A plain `YYYY-MM-DD` date is also accepted. example: '1990-05-17T00:00:00.000Z' type: string format: date-time firstName: type: string minLength: 1 description: First name. example: Ana lastName: default: '' description: Last name. example: Souza type: string phone: type: string minLength: 1 pattern: ^\+[1-9]\d{7,14}$ description: >- Phone number in E.164 format: `+`, the country code and the number, digits only. Mobile or landline, Brazilian or not; it must be a real, reachable number. example: '+5511987654321' realm: type: object properties: level: type: string enum: - ADMIN - USER description: >- The user's access level in the realm. `ADMIN` manages every organization and user of the realm — only a realm administrator can grant it; `USER` acts only in `organizations`. example: USER required: - level description: The user's realm access. organizations: minItems: 1 type: array items: type: object properties: id: type: string format: uuid description: |- ID of an organization of your realm. Format: `UUID` example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 level: type: string enum: - ADMIN - USER description: >- Access level in the organization: `ADMIN` manages its users and settings, `USER` uses its wallets and cards. example: USER required: - id - level description: >- Organizations the user belongs to. You must be an admin of every organization listed. customFields: description: >- Values of the realm's user custom fields, keyed by the custom field's `slug`, for example `{"cost-center": "Marketing"}`. Every key must be the slug of an active user custom field of one of the listed organizations. type: object additionalProperties: {} required: - email - cpf - birthdate - firstName - phone - realm - organizations responses: '201': description: Successful response content: application/json: schema: type: object properties: id: type: string description: ID of the user. example: 8f1c2d3e-4b5a-4c6d-9e7f-a1b2c3d4e5f6 format: uuid email: type: string description: >- E-mail address the user signs in with. It can't be changed. example: ana.souza@acme.com.br firstName: type: string description: First name. example: Ana lastName: type: string description: Last name. example: Souza cpf: type: string description: CPF, digits only. example: '52998224725' birthdate: type: string description: Date of birth, at midnight UTC. example: '1990-05-17T00:00:00.000Z' format: date-time phone: type: string description: >- Phone number in E.164 format. Omitted when the user has none. example: '+5511987654321' status: type: string enum: - IN_ONBOARDING - CREATING - ACTIVE - DEACTIVATED - BLOCKED description: >- Lifecycle status. `IN_ONBOARDING`: invited, still completing onboarding. `ACTIVE`: can sign in. `DEACTIVATED`: access removed by an administrator. `BLOCKED`: access suspended, for example after too many wrong PINs. `CREATING`: being set up. example: ACTIVE statusCode: type: string enum: - BLOCKED_BY_PIN - BLOCKED_BY_MFA - BLOCKED_BY_ADMIN - USER_ACTIVE - USER_DEACTIVATED - ONLY_ONBOARDING description: >- Reason behind `status`: `USER_ACTIVE`, `USER_DEACTIVATED`, `ONLY_ONBOARDING`, or the cause of a block (`BLOCKED_BY_PIN`, `BLOCKED_BY_MFA`, `BLOCKED_BY_ADMIN`). example: USER_ACTIVE realm: type: object properties: id: type: string description: ID of the realm. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid level: type: string enum: - ADMIN - USER - APP_CLIENT description: >- Access level in the realm. `ADMIN` can manage every organization and user of the realm; `USER` acts only in the organizations listed in `organizations`. `APP_CLIENT` can appear on users created with that level. example: USER name: type: string description: Display name of the realm. Can be empty. example: '' required: - id - level - name description: The user's realm and their access level in it. hasMfa: type: boolean description: Whether the user has set up multi-factor authentication. example: true hasPin: type: boolean description: Whether the user has created a transaction PIN. example: true hasFacialBiometric: type: boolean description: Whether the user's face was validated during onboarding. example: true pinErrorsCount: type: number description: >- Consecutive wrong PIN attempts. At 3 the user is blocked (`BLOCKED_BY_PIN`). example: 0 mfaErrorsCount: type: number description: Consecutive wrong multi-factor codes. example: 0 customFields: type: object additionalProperties: {} description: >- Values of the realm's user custom fields, keyed by the custom field's `slug`, for example `{"cost-center": "Marketing"}`. Omitted when the user has none. createdAt: type: string description: When the user was created. example: '2026-03-02T14:21:07.512Z' format: date-time updatedAt: type: string description: When the user last changed. example: '2026-10-13T18:43:50.746Z' format: date-time createdBy: type: string description: >- ID of the user or API client that created this user. Empty when unknown. example: 43230779-2cfb-4525-a40c-77fbf15e68f0 updatedBy: type: string description: >- ID of the user or API client that last changed this user. Empty when unknown. example: 43230779-2cfb-4525-a40c-77fbf15e68f0 deletedBy: type: string description: >- ID of the user or API client that deactivated this user. Empty unless the user was deactivated. example: '' organizations: type: array items: type: object properties: id: type: string description: ID of the organization. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 format: uuid level: type: string enum: - ADMIN - USER - APP_CLIENT description: >- Access level in the organization. `ADMIN` manages the organization's users and settings; `USER` uses its wallets and cards. `APP_CLIENT` can appear on memberships created with that level. example: USER legalName: type: string description: Legal name of the organization, when known. example: Acme Comércio de Alimentos Ltda tradingName: type: string description: Trade name of the organization, when known. example: Acme Alimentos required: - id description: >- An organization the user belongs to, with its registration data. description: Organizations of the realm the user belongs to. required: - cpf - createdAt - createdBy - deletedBy - email - firstName - hasFacialBiometric - hasMfa - hasPin - id - lastName - mfaErrorsCount - organizations - pinErrorsCount - realm - status - statusCode - updatedAt - updatedBy description: A user of the realm. '403': description: >- `INSUFFICIENT_PERMISSIONS` — You are not an admin of every organization in `organizations`, or `realm.level` is `ADMIN` and you are not a realm administrator (an API client never is). content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - INSUFFICIENT_PERMISSIONS description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: INSUFFICIENT_PERMISSIONS origin: IDENTITY message: insufficient permissions '404': description: >- `ORGANIZATION_NOT_FOUND` — An `organizations[].id` is not an organization of your realm. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - ORGANIZATION_NOT_FOUND description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: ORGANIZATION_NOT_FOUND origin: IDENTITY message: Organization not found '409': description: '`USER_CONFLICT` — A user with this `email` already exists.' content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - USER_CONFLICT description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: USER_CONFLICT origin: IDENTITY message: User already exists '422': description: >- `BAD_REQUEST` — The path or body failed validation; `fields` lists each invalid field. `INVALID_USER_PHONE_ERROR` — `phone` is well-formed but is not a real, reachable number. `CUSTOM_FIELD_NOT_ALLOWED` — A `customFields` key is not the slug of an active user custom field of the listed organizations; `fields` names it. `CUSTOM_FIELD_INVALID_VALUE` — A `customFields` value doesn't match its custom field's type or options; `fields` names it. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST - INVALID_USER_PHONE_ERROR - CUSTOM_FIELD_NOT_ALLOWED - CUSTOM_FIELD_INVALID_VALUE description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: IDENTITY message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: email message: 'Invalid input: expected string, received undefined' code: EMAIL_REQUIRED ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.