> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a principal

> Create a ``human`` or ``service`` principal and apply its role (admin only).

The door mints a ``user_id`` when absent. A duplicate id is a 409; an unknown role is a
400. ``created_by`` records the admin who created it.



## OpenAPI

````yaml /openapi.json post /api/auth/principals
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 18.0.1
servers: []
security: []
paths:
  /api/auth/principals:
    post:
      tags:
        - access-control
      summary: Create a principal
      description: >-
        Create a ``human`` or ``service`` principal and apply its role (admin
        only).


        The door mints a ``user_id`` when absent. A duplicate id is a 409; an
        unknown role is a

        400. ``created_by`` records the admin who created it.
      operationId: post_api_auth_principals
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PrincipalCreate'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/Principal'
                required:
                  - data
                type: object
          description: Success.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Malformed request.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Forbidden.
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Conflict with the current resource state.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    PrincipalCreate:
      description: >-
        The create-principal request body.


        ``user_id`` is optional — the door mints one when absent. ``kind`` is
        ``human`` or

        ``service``; ``role`` names the role template applied to the principal's
        policy.
      properties:
        display_name:
          minLength: 1
          title: Display Name
          type: string
        kind:
          enum:
            - human
            - service
          title: Kind
          type: string
        role:
          minLength: 1
          title: Role
          type: string
        user_id:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          title: User Id
      required:
        - kind
        - display_name
        - role
      title: PrincipalCreate
      type: object
    Principal:
      additionalProperties: false
      description: >-
        A principal: the unit of identity and authority every credential belongs
        to.


        ``user_id`` is the id the access-control policy row is keyed by.
        ``kind`` is

        ``human`` (authenticates through an accounts provider) or ``service``
        (holds

        keys only, never logs in interactively). ``display_name`` is the
        operator-

        facing label. ``created_by`` is the principal id that created this one,
        or

        ``None`` for the owner the setup door mints. ``disabled`` turns off
        every

        credential the principal owns. ``created_at`` is timezone-aware (UTC).
      properties:
        created_at:
          format: date-time
          title: Created At
          type: string
        created_by:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          title: Created By
        disabled:
          default: false
          title: Disabled
          type: boolean
        display_name:
          title: Display Name
          type: string
        kind:
          enum:
            - human
            - service
          title: Kind
          type: string
        user_id:
          title: User Id
          type: string
      required:
        - user_id
        - kind
        - display_name
        - created_at
      title: Principal
      type: object
    Error:
      properties:
        code:
          description: >-
            Stable machine-readable reason a client keys a dedicated error state
            on, present on refusals that opt in (e.g. a 501 not-configured
            refusal). Optional: absent when the error carries only a
            human-readable message.
          type: string
        error:
          type: string
      required:
        - error
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````