Authenticate with an Organization Admin User API key, sent in the skyfire-api-key header. Keys belonging to callers whose organization role is ADMIN are accepted; a MEMBER key, or any Agent API key, is rejected with 401.

The user identified by userId must belong to your organization and must be active. A user from another organization, or one that does not exist, is reported as 404. A deactivated user returns 400.

What this call creates

A single request creates:

1. A seller agent owned by the user, with the displayName you supply.
2. A wallet for that agent.
3. An API key for that agent, returned as apiKey.

apiKey is returned only in this response and cannot be retrieved again. Store it securely before discarding the response. Further keys can be created with Create Agent API Key.

Any number of seller agents per user

A user can hold as many seller agents as you create for them, for example one per store, brand, or product line. Each has its own wallet, its own API keys, and its own ID, which every token addressed to it carries in the aud claim.

Seller agents are not created automatically. Create Organization User provisions a buyer agent only, so call this endpoint for each seller the user needs.

Naming rules

displayName must be printable ASCII, 1 to 100 characters, with at least one non-space character. Names are compared case-insensitively with whitespace trimmed and collapsed, so Acme, acme, and Acme are the same name. The name must be free among the user's active agents, and may not match an active agent group in your organization. Either collision returns 409. A deactivated agent does not reserve its name.

The name appears to sellers' counterparties as the agent's display name and in the Skyfire Directory. Rename or deactivate the agent later with Update Organization User Agent.