# Create users from rest API

**URL:** <https://forum.keycloak.org/t/create-users-from-rest-api/14827>\
**Category:** Securing applications\
**Created:** [April 6, 2022, 3:22pm UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827 "2022-04-06T15:22:20Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 6, 2022, 3:22pm UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/1 "2022-04-06T15:22:20Z")

</div>

Hello

I use the REST API to create user in demo realm. I want to use client credential grant to do that.

I am using Keycloak 17

I use the admin-cli client\_id of the master realm to create the token. I have added manage-users and realm-management to this client id in the “Service Account Roles” tabs.

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/a/aad963aef824c6ac5bb953b0a1fd1193ce069620.png)

I get the following token

{  
“access\_token”: “eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ6dE9WR0tqQ18teWhOTG1PRVU4R2hhS0hoOFJpY0VaNFNZTnpaWlhrTHdVIn0.eyJleHAiOjE2NDkyNTc5NDgsImlhdCI6MTY0OTI1Nzg4OCwianRpIjoiYzQ4NzVkMDktZjFhYy00OTVlLThhMzUtZjdjNzA4N2Q1MjdlIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy9tYXN0ZXIiLCJzdWIiOiI5Y2JkNDE4Zi0zYzkzLTQ0Y2QtYjQ3Ni0zN2EwODFlN2FiNWUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhZG1pbi1jbGkiLCJhY3IiOiIxIiwicmVzb3VyY2VfYWNjZXNzIjp7ImFkbWluLWNsaSI6eyJyb2xlcyI6WyJyZWFsbS1tYW5hZ2VtZW50IiwibWFuYWdlLXVzZXJzIl19fSwic2NvcGUiOiJwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJjbGllbnRIb3N0IjoiMTcyLjE3LjAuMSIsImNsaWVudElkIjoiYWRtaW4tY2xpIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic2VydmljZS1hY2NvdW50LWFkbWluLWNsaSIsImNsaWVudEFkZHJlc3MiOiIxNzIuMTcuMC4xIn0.RK\_45QNSnyaCF5nmWliX1LMFEiiIhGk03jkNDFmM5WaR\_W9hi7w4dWYOrMtdYA3DzX8TFkK1a9Veve45RSntl5eEVWAeZb8naXBYFLPa7pomxlKTtXPtDIOYGZnBdhoIXD-mxuXi4HpBdRb6\_anBRasZIHixYvq0AFQO83qF3aaC-8C6\_T7Ux-wvInf9nbmYBwnhLblIw-ntHZxNtcWc24iAdKhz2tM5eT20t96RBGZHMVd3szTaXxZYVBYThUuPBGyOAXVD9SYmWJaWynXJrtQNSvAw6\_HS94phC0fOs-nxsGNPnziedTpfIIyUx3puRbiMJRU2eEM0BxhiZFW6Hg”,  
“expires\_in”: 60,  
“refresh\_expires\_in”: 0,  
“token\_type”: “Bearer”,  
“not-before-policy”: 0,  
“scope”: “profile email”  
}

We can sow previous role in that token

After that I call this url [http://localhost:8080/admin/realms/master/users](http://localhost:8080/admin/realms/master/users) to create one user

I use the previous token as Bearer authentication and I send this payload in the request body

{  
“id”: “1234”,  
“firstName”: “Alf”,  
“lastName”: “fromspace”,  
“email”: “alf@from.space”,  
“enabled”: “true”,  
“username”: “alf”,  
“attributes”: {  
“isn”: “isn”  
}  
}

and I always receive a 403 Forbidden with this payload in body

{  
“error”: “unknown\_error”  
}

regards

Stéphane GINER

---

<div class="post-metadata">

**Author:** ![mbonn](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mbonn/32/5755_2.png) [@mbonn](https://forum.keycloak.org/u/mbonn)\
**Post date:** [April 7, 2022, 6:15am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/2 "2022-04-07T06:15:36Z")

</div>

Try adding the Client Roles “manage-users” (…) for autocreated client “demo-realm” instead for admin-cli.

(I think it is not even necessary to use the admin-cli client of the master realm. Instead, you could create a dedicated confidential client (with service accounts and client credentials grant enabled) in your demo realm. Add the Client Roles “manage-users” of client “realm-management” as servcice account roles. Do the same in tab “scope” so the roles will be added to the access tokens.)

regards,  
Matthias

---

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 11, 2022, 6:02am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/3 "2022-04-11T06:02:55Z")

</div>

Thank you for your reply

I’ll test it as soon as possible and I comme back to you to tell you if it work

Regards

Stéphane GINER

---

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 13, 2022, 8:01am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/4 "2022-04-13T08:01:07Z")

</div>

Hi

It work fine, Thanks, I give you my Keycloak configuration if somebody have the same needs

First I created the Demo realm and I set those settings

 ![config-admin-cli](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/47b6abde94d3c091eabc7dc4bead909c8a78d43a.jpeg)

---

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 13, 2022, 8:01am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/5 "2022-04-13T08:01:44Z")

</div>

![manageScope](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/d/d6bca81ddb620c6ec1cf2de6e04816dbad47c096.jpeg)

---

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 13, 2022, 8:02am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/6 "2022-04-13T08:02:21Z")

</div>

![manageUserDemo](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/b/b6c4cfb9f8e38b920813744fda54305776ca44c3.jpeg)

---

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 13, 2022, 8:03am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/7 "2022-04-13T08:03:15Z")

</div>

Second, I request realm management to get access-token

 ![PostmanGetAccessToken](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/3/3a591944a77a1021ed299babd1cab1d84df8ff3e.png)

---

<div class="post-metadata">

**Author:** ![sginer](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sginer](https://forum.keycloak.org/u/sginer)\
**Post date:** [April 13, 2022, 8:07am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/9 "2022-04-13T08:07:28Z")

</div>

Third, I create the user

 ![PostmanCreateUser](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/4ddd0f1221d019dd10b67fe691ea166f4497d209.png)

---

<div class="post-metadata">

**Author:** ![rcbandit](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rcbandit/32/7189_2.png) [@rcbandit](https://forum.keycloak.org/u/rcbandit)\
**Post date:** [May 20, 2023, 12:13am UTC](https://forum.keycloak.org/t/create-users-from-rest-api/14827/10 "2023-05-20T00:13:33Z")

</div>

Do you know for Keycloak 21 how to set permissions?