Add user

This method adds a new user to the Vault.

  • Make sure there are no spaces in the URL.

  • The following characters are not supported in URL values: + & %

  • If the URL includes a dot (.), add a forward slash (/) at the end of the URL. For example: api/Safes/MySafe/Members/user@cyber.com/

To run this Web service, you must have the following permissions:

  • Add Users
  • Update Users

URL

 
https://<IIS_Server_Ip>/PasswordVault/API/Users/

Resource information

HTTP method

POST

Content type

application/json

Header parameter

Parameter

Authorization

Type

String

Description

The token that identifies the session.

Valid values

A session token that was returned from the “Logon” method.

Body parameters

 
{
    "username":"newUser",
    "userType": "EPVUser",
    "initialPassword": "MyPassword123",
    "authenticationMethod": ["AuthTypePass"],
    "location": "\\",
    "unAuthorizedInterfaces": ["PSM", "PSMP"],
    "expiryDate": 1577836800,
    "vaultAuthorization": ["AddSafes", "AuditUsers" ],
    "enableUser": true,
    "changePassOnNextLogon": true,
    "passwordNeverExpires": true,
    "distinguishedName": "newUser@cyberark",
    "description": "This user is privileged",
    "businessAddress":
     {
     "workStreet": "Hapssagot 9",
     "workCity": "Petah Tikva",
     "workState": "Israel",
     "workZip": "9999999",
     "workCountry": "Israel"
     },
    "internet":
     {
     "homePage": "Cyberark.com",
     "homeEmail": "user@gmail.com",
     "businessEmail": "user@cyberark.com",
     "otherEmail": "user2@gmail.com"
     },
    "phones": {
     "homeNumber": "555123456",
     "businessNumber": "555456789",
     "cellularNumber": "555789789",
     "faxNumber": "999999",
     "pagerNumber": "111111"
  },
  "personalDetails": {
    "street": "Dizzengof 56",
    "city": "Tel Aviv",
    "state": "Israel",
    "zip": "123456",
    "country": "Israel",
    "title": "Mr. VIP",
    "organization": "Cyber ark",
    "department": "R&D",
    "profession": "software development",
    "firstName": "John",
    "middleName": "Doe",
    "lastName": "Smith"
  },
}

 

Parameter

Description

username

(Mandatory) The name of the user.

Validations:

  • Length <= 128
  • No leading or trailing space
  • No trailing dot
  • When a name is longer than 28 characters, the 28th character in the name cannot be space
  • Cannot include the characters: "\\/:*?\"<>|\t\r\n\x1F"
  • The first 28 characters in the name must be unique

Type: string

userType

The user type that was returned according to the license.

Possible types could be any user types according to the license.

Type: string

Default: EPVUser.

nonAuthorizedInterfaces

The CyberArk interfaces that this user is not authorized to use.

Valid values (depend on the specific user type as defined in the license):

  • PIMSU
  • PSM
  • PSMP
  • PVWA
  • WINCLIENT
  • PTA
  • PACLI
  • HTTPGW
  • EVD
  • PIMSu
  • AIMApp
  • CPM
  • PVWAApp
  • PSMApp
  • AppPrv
  • AIMApp
  • PSMPApp

Type: list of strings

location

The location in the Vault where the user will be created.

Validations:

  • Length <= 128 characters
  • Must begin with "\\", but cannot contain or end with "\\"
  • No trailing space

Type: string

Default: Root

expiryDate

The date when the user expires.

Type: Date-time

enableUser

Whether the user will be enabled upon creation.

Type: boolean

Default: true

authenticationMethod

The authentication method that the user will use to log on.

valid values:

  • CyberArk
  • LDAP
  • RADIUS

Type: string

Default: CyberArk

password

The password that the user will use to log on for the first time.

This password must meet the password policy requirements.

Not required for PKI or LDAP.

Length <= 39 characters.

Type: string

changePasswordOnTheNextLogon

Whether or not the user must change their password from the second log on onward.

Type: boolean

Default: true

passwordNeverExpires

Whether the user’s password will not expire unless they decide to change it.

Type: boolean

Default: false

distinguishedName

The user’s distinguished name.

The usage is for PKI authentication, this will match the certificate Subject Name or domain name.

Type: string

vaultAuthorization

The user permissions.

To apply specific authorizations to a user, the user who runs this API must have the same authorizations.

Valid values:

  • AddSafes
  • AuditUsers
  • AddUpdateUsers
  • ResetUsersPasswords
  • ActivateUsers
  • AddNetworkAreas
  • ManageDirectoryMapping
  • ManageServerFileCategories
  • BackupAllSafes
  • RestoreAllSafes

Type: list of strings

businessAddress

The user’s postal address, including:

  • City, state, zip, and country (max 19 characters)
  • Street (max 29 characters)

Type: object

internet

The user's email addresses, including:

  • Home page
  • Home email
  • Business email
  • Other email

Max 319 characters (for each).

Type: object

phones

The user's phone numbers, including:

  • Home
  • Business
  • Cellular
  • Fax
  • Pager

Max 24 characters (for each).

Type: object

description

Notes and comments.

Max 99 characters.

Type: string

personalDetails

The user's personal details, including:

  • firstName, middleName, lastName, address (max 29 characters)
  • city, state, zip, country (max 19 characters)
  • title, organization, department, profession (max 49 characters)

Type: object

Result

 
{
  "enableUser": true,
  "changePassOnNextLogon": true,
  "expiryDate": 1577836800,
  "suspended": false,
  "lastSuccessfulLoginDate": 1561282853,
  "unAuthorizedInterfaces": [
    "PSMP",
    "PSM"
  ],
  "authenticationMethod": [
    "AuthTypePass"
  ],
  "passwordNeverExpires": true,
  "distinguishedName": "newUser@cyberark",
  "description": "This user is privileged",
  "businessAddress": {
    "workStreet": "9999999",
    "workCity": "Petah Tikva",
    "workState": "Hapssagot 9",
    "workZip": "Petah Tikva",
    "workCountry": "Israel"
  },
  "internet": {
    "homePage": "Cyberark.com",
    "homeEmail": "user@gmail.com",
    "businessEmail": "user@cyberark.com",
    "otherEmail": "user2@gmail.com"
  },
  "phones": {
    "homeNumber": "555123456",
    "businessNumber": "555456789",
    "cellularNumber": "555789789",
    "faxNumber": "999999",
    "pagerNumber": "111111"
  },
  "personalDetails": {
    "street": "Dizzengof 56",
    "city": "Tel Aviv",
    "state": "Israel",
    "zip": "123456",
    "country": "Israel",
    "title": "Mr. VIP",
    "organization": "Cyber ark",
    "department": "R&D",
    "profession": "software development",
    "firstName": "John",
    "middleName": "Doe",
    "lastName": "Smith"
  },
  "id": 350,
  "username": "newUser",
  "source": "CyberArk",
  "userType": "EPVUser",
  "componentUser": false,
  "vaultAuthorization": [
    "AddSafes",
    "AuditUsers"
  ],
  "location": "\\"
}

 

Parameter

Description

id

The user's unique ID.

Type: number

username

(Mandatory) The name of the user.

Validations:

  • Length <= 128
  • No leading or trailing space
  • No trailing dot
  • When a name is longer than 28 characters, the 28th character in the name cannot be space
  • Cannot include the characters: "\\/:*?\"<>|\t\r\n\x1F"
  • The first 28 characters in the name must be unique

Type: string

source

The user management system the user belongs to.

Valid values:

  • CyberArk
  • LDAP

Type: boolean expression

changePasswordOnTheNextLogon

Whether or not the user must change their password from the second log on onward.

Type: boolean

Default: true

expiryDate

The date when the user expires.

Type: Date-time

userType

The user type that was returned according to the license.

Possible types could be any user types according to the license.

Type: string

unauthorizedInterfaces

The CyberArk interfaces that this user is not authorized to use.

Valid values (depend on the specific user type as defined in the license):

  • PIMSU
  • PSM
  • PSMP
  • PVWA
  • WINCLIENT
  • PTA
  • PACLI
  • HTTPGW
  • EVD
  • PIMSu
  • AIMApp
  • CPM
  • PVWAApp
  • PSMApp
  • AppPrv
  • AIMApp
  • PSMPApp

Type: list of strings

componentUser

Whether the user is a known component or not.

if the user is a component, then the value is true. Otherwise, it is false.

The following user types are considered components:

  • CPM
  • ENE
  • PVWA
  • PSM
  • AppProvider
  • OPMProvider
  • PIMProvider
  • PSMPServer
  • PSMPADBridge
  • PSMHTML5Gateway
  • CIFS
  • FTP
  • SFE
  • DCAInstance
  • FEWA
  • SEG

 

location

The user location.

Type: string

enabled

Whether or not the user is enabled.

Type: boolean

suspended

Whether or not the user is suspended.

Type: boolean

authenticationMethod

The authentication method that the user will use to log on.

Type: string

passwordNeverExpires

Whether the user’s password will not expire unless they decide to change it.

Type: boolean

distinguishedName

The user’s distinguished name.

The usage is for PKI authentication, this will match the certificate Subject Name or domain name.

Type: string

vaultAuthorization

The user permissions.

Valid values:

  • AddSafes
  • AuditUsers
  • AddUpdateUsers
  • ResetUsersPasswords
  • ActivateUsers
  • AddNetworkAreas
  • ManageDirectoryMapping
  • ManageServerFileCategories
  • BackupAllSafes
  • RestoreAllSafes

Type: list of strings

businessAddress

The user’s postal address, including:

  • City, state, zip, and country
  • Street

Type: object

internet

The user's email addresses, including:

  • Home page
  • Home email
  • Business email
  • Other email

Type: object

phones

The user's phone numbers, including:

  • Home
  • Business
  • Cellular
  • Fax
  • Pager

Type: object

description

Notes and comments.

Max 99 characters.

Type: string

personalDetails

The user's personal details, including:

  • firstName, middleName, lastName, address
  • city, state, zip, country
  • title, organization, department, profession

Type: object

lastSuccessfulLoginDate

The date that the user last logged on to the Vault successfully.

Type: Date time

Return codes

For a complete list of return codes, see Return Codes.