Identity Provider API, gRPC: UserService.Create

Written by

Yandex Cloud

Updated at October 3, 2025

gRPC request
CreateUserRequest
PasswordSpec
PasswordHash
operation.Operation
CreateUserMetadata
User

Creates a user in the specified userpool.

gRPC request

rpc Create (CreateUserRequest) returns (operation.Operation)

CreateUserRequest

{
  "userpool_id": "string",
  "username": "string",
  "full_name": "string",
  "given_name": "string",
  "family_name": "string",
  "email": "string",
  "phone_number": "string",
  // Includes only one of the fields `password_spec`, `password_hash`
  "password_spec": {
    "password": "string",
    "generation_proof": "string"
  },
  "password_hash": {
    "password_hash": "string",
    "password_hash_type": "PasswordHashType"
  },
  // end of the list of possible fields
  "is_active": "google.protobuf.BoolValue",
  "external_id": "string"
}

Request to create a new user.

Field	Description
userpool_id	string Required field. ID of the userpool to create the user in.
username	string Required field. Username for the new user.
full_name	string Required field. Full name of the user.
given_name	string First name of the user.
family_name	string Last name of the user.
email	string Email address of the user.
phone_number	string Phone number of the user.
password_spec	PasswordSpec Password specification. Includes only one of the fields `password_spec`, `password_hash`. User credentials.
password_hash	PasswordHash Password hash. Includes only one of the fields `password_spec`, `password_hash`. User credentials.
is_active	google.protobuf.BoolValue Whether the user is active. Default is true.
external_id	string External identifier for the user.

PasswordSpec

Password specification.

Field

Description

password

string

Required field. The password string.

generation_proof

string

Proof that the password was generated by the system.

PasswordHash

Password hash information.

Field

Description

password_hash

string

Required field. The password hash string.

password_hash_type

enum PasswordHashType

Required field. Type of the password hash.

PASSWORD_HASH_TYPE_UNSPECIFIED: The password hash type is not specified.
AD_MD4: Microsoft Active Directory MD4 hash.

operation.Operation

{
  "id": "string",
  "description": "string",
  "created_at": "google.protobuf.Timestamp",
  "created_by": "string",
  "modified_at": "google.protobuf.Timestamp",
  "done": "bool",
  "metadata": {
    "user_id": "string"
  },
  // Includes only one of the fields `error`, `response`
  "error": "google.rpc.Status",
  "response": {
    "id": "string",
    "userpool_id": "string",
    "status": "Status",
    "username": "string",
    "full_name": "string",
    "given_name": "string",
    "family_name": "string",
    "email": "string",
    "phone_number": "string",
    "created_at": "google.protobuf.Timestamp",
    "updated_at": "google.protobuf.Timestamp",
    "external_id": "string"
  }
  // end of the list of possible fields
}

An Operation resource. For more information, see Operation.

Field	Description
id	string ID of the operation.
description	string Description of the operation. 0-256 characters long.
created_at	google.protobuf.Timestamp Creation timestamp.
created_by	string ID of the user or service account who initiated the operation.
modified_at	google.protobuf.Timestamp The time when the Operation resource was last modified.
done	bool If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
metadata	CreateUserMetadata Service-specific metadata associated with the operation. It typically contains the ID of the target resource that the operation is performed on. Any method that returns a long-running operation should document the metadata type, if any.
error	google.rpc.Status The error result of the operation in case of failure or cancellation. Includes only one of the fields `error`, `response`. The operation result. If `done == false` and there was no failure detected, neither `error` nor `response` is set. If `done == false` and there was a failure detected, `error` is set. If `done == true`, exactly one of `error` or `response` is set.
response	User The normal response of the operation in case of success. If the original method returns no data on success, such as Delete, the response is google.protobuf.Empty. If the original method is the standard Create/Update, the response should be the target resource of the operation. Any method that returns a long-running operation should document the response type, if any. Includes only one of the fields `error`, `response`. The operation result. If `done == false` and there was no failure detected, neither `error` nor `response` is set. If `done == false` and there was a failure detected, `error` is set. If `done == true`, exactly one of `error` or `response` is set.

CreateUserMetadata

Metadata for the UserService.Create operation.

Field

Description

user_id

string

ID of the user that is being created.

User

A user in the Identity Provider system.

Users are created within a userpool and can authenticate to access cloud resources.
Each user has a unique identifier, credentials, and profile information.

Field	Description
id	string Unique identifier of the user. This ID is generated automatically when the user is created.
userpool_id	string ID of the userpool this user belongs to. To get the userpool ID, make a UserpoolService.List request.
status	enum Status Current status of the user. Determines whether the user can authenticate and access the system. `STATUS_UNSPECIFIED`: The status is not specified. `CREATING`: The user is in the process of being created. `ACTIVE`: The user is active and can authenticate. Active users have full access to the system according to their permissions. `SUSPENDED`: The user is suspended and cannot authenticate. Suspended users retain their data but cannot access the system. `DELETING`: The user is in the process of being deleted. This is a transitional state before the user is completely removed from the system.
username	string Username used for authentication. Usually in the format of an email address.
full_name	string User's full name (display name). This is typically shown in the UI and used for identification purposes.
given_name	string User's first name. Part of the user's profile information.
family_name	string User's last name. Part of the user's profile information.
email	string User's email address.
phone_number	string User's phone number.
created_at	google.protobuf.Timestamp Timestamp when the user was created.
updated_at	google.protobuf.Timestamp Timestamp when the user was last updated.
external_id	string External identifier for federation with external identity systems. This ID can be used to link this user with an account in an external system.

Identity Provider API, gRPC: UserService.Create

gRPC requestgRPC request

CreateUserRequestCreateUserRequest

PasswordSpecPasswordSpec

PasswordHashPasswordHash

operation.Operationoperation.Operation

CreateUserMetadataCreateUserMetadata

UserUser

Was the article helpful?

gRPC request

CreateUserRequest

PasswordSpec

PasswordHash

operation.Operation

CreateUserMetadata

User