--- title: "Make a user and a first credential (bootstrap secret only; self-hosted, one person)" --- > Documentation Index > Fetch the complete documentation index at: https://docs.gitpando.com/llms.txt > Use this file to discover all available pages before exploring further. Path: Pando API › users `POST /v1/users` ## Authentication - `bootstrap`, http, header `Authorization` ## Request body _Required._ - `createUser.login` (string, required) — Lowered first. 400 `reserved_name` for a reserved one; 409 `namespace_taken` when a person or an organization has it. - pattern `^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}$` - `createUser.name` (string, optional) — A display name. - `createUser.email` (string, optional) — Used on merge commits. - `createUser.credential_name` (string, optional) — A name for the first credential, for example the machine name. Default `bootstrap`. ## Example request ```json { "login": "string", "name": "string", "email": "string", "credential_name": "string" } ``` ## Code samples ### cURL ```curl curl --request POST \ --url https://app.gitpando.com/v1/users \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data ' { "login": "string", "name": "string", "email": "string", "credential_name": "string" } ' ``` ### TypeScript ```typescript const url = 'https://app.gitpando.com/v1/users'; const options = { method: 'POST', headers: {'Content-Type': 'application/json', Authorization: 'Bearer '}, body: JSON.stringify({login: 'string', name: 'string', email: 'string', credential_name: 'string'}) }; fetch(url, options) .then(res => res.json()) .then(json => console.log(json)) .catch(err => console.error(err)); ``` ### Python ```python import requests url = "https://app.gitpando.com/v1/users" payload = { "login": "string", "name": "string", "email": "string", "credential_name": "string" } headers = { "Content-Type": "application/json", "Authorization": "Bearer " } response = requests.post(url, json=payload, headers=headers) print(response.text) ``` ## Responses ### 201 Created #### Example ```json { "user": { "login": "string", "name": "string", "email": "string", "picture_url": "string", "created_at": "2019-08-24T14:15:22Z" }, "credential": { "id": "string", "name": "string", "kind": "machine", "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "secret": "string" } } ``` - `createUser.response.201.user` (object, required) - `createUser.response.201.user.login` (string, required) - `createUser.response.201.user.name` (string | null, required) - `createUser.response.201.user.email` (string | null, required) - `createUser.response.201.user.picture_url` (string | null, required) — Their WorkOS profile picture (an https URL of at most 2,048 characters), stored at each sign-in, browser or `pando login`, and refreshed every time (a removed picture becomes null). Null when there is none or it is not https: the web draws one. Pando never fetches, proxies or caches it. - `createUser.response.201.user.created_at` (string, required) - format `date-time` - `createUser.response.201.credential` (object, required) - `createUser.response.201.credential.id` (string, required) - `createUser.response.201.credential.name` (string, required) - `createUser.response.201.credential.kind` (string, required) - one of `"machine"`, `"sandbox"`, `"bootstrap"`, `"browser"` - `createUser.response.201.credential.created_at` (string, required) - format `date-time` - `createUser.response.201.credential.secret` (string, required) — `pando_` and 40 hex characters. Shown once; Pando keeps only its SHA-256. - `createUser.response.201.credential.last_used_at` (string | null, optional) - format `date-time` - `createUser.response.201.credential.expires_at` (string | null, optional) — Browser sessions only: the end unless used before then (each use pushes it to 30 days). - format `date-time` ### 401 An error #### Example ```json { "error": { "code": "string", "message": "string", "paths": [ "string" ], "checks": { "sha": "string", "state": "success", "required": [ "string" ], "checks_unknown": "string", "missing": [ "string" ], "statuses": [ { "sha": "string", "context": "string", "state": "pending", "target_url": "string", "description": "string", "creator": "string", "app": "string", "created_at": "2019-08-24T14:15:22Z" } ] } } } ``` - `createUser.response.401.error` (object, required) - `createUser.response.401.error.code` (string, required) - `createUser.response.401.error.message` (string, required) - `createUser.response.401.error.paths` (array, optional) - `createUser.response.401.error.checks` (object, optional) — GitHub's combined status, plus the required contexts and which are missing. - `createUser.response.401.error.checks.sha` (string | null, required) - `createUser.response.401.error.checks.state` (string, required) — `success` when the merge gate passes; `missing` when a required context has not reported; `unknown` while the required checks are (an unforced merge is refused). - one of `"success"`, `"pending"`, `"failure"`, `"error"`, `"missing"`, `"unknown"` - `createUser.response.401.error.checks.required` (array | null, required) — Null while unknown. - `createUser.response.401.error.checks.checks_unknown` (string | null, required) — Why the required checks are unknown, in plain words: "Pando couldn't read this monorepo's required checks; try again", or "pando.toml line 3: expected comma or end of structure; fix it on main, or merge with force". Null otherwise. - `createUser.response.401.error.checks.statuses` (array, required) — The latest status per context. - `createUser.response.401.error.checks.statuses.sha` (string, required) - `createUser.response.401.error.checks.statuses.context` (string, required) - `createUser.response.401.error.checks.statuses.state` (string, required) - one of `"pending"`, `"success"`, `"failure"`, `"error"` - `createUser.response.401.error.checks.statuses.created_at` (string, required) - format `date-time` - `createUser.response.401.error.checks.statuses.target_url` (string | null, optional) - `createUser.response.401.error.checks.statuses.description` (string | null, optional) - `createUser.response.401.error.checks.statuses.creator` (string, optional) — The member who posted it (a login); `app:` for a status posted with a status token or by a CI integration; `hook:` for a status token from a web hook with no app. - `createUser.response.401.error.checks.statuses.app` (string | null, optional) — The CI service that reported it (`buildkite`, `github-actions`, ...), stamped by Pando from a status token or a CI integration, never from the body or `target_url`. Null when a member posted it with their own credential. The web shows the service's mark for a slug it knows. - `createUser.response.401.error.checks.missing` (array, optional) ### 409 An error #### Example ```json { "error": { "code": "string", "message": "string", "paths": [ "string" ], "checks": { "sha": "string", "state": "success", "required": [ "string" ], "checks_unknown": "string", "missing": [ "string" ], "statuses": [ { "sha": "string", "context": "string", "state": "pending", "target_url": "string", "description": "string", "creator": "string", "app": "string", "created_at": "2019-08-24T14:15:22Z" } ] } } } ``` - `createUser.response.409.error` (object, required) - `createUser.response.409.error.code` (string, required) - `createUser.response.409.error.message` (string, required) - `createUser.response.409.error.paths` (array, optional) - `createUser.response.409.error.checks` (object, optional) — GitHub's combined status, plus the required contexts and which are missing. - `createUser.response.409.error.checks.sha` (string | null, required) - `createUser.response.409.error.checks.state` (string, required) — `success` when the merge gate passes; `missing` when a required context has not reported; `unknown` while the required checks are (an unforced merge is refused). - one of `"success"`, `"pending"`, `"failure"`, `"error"`, `"missing"`, `"unknown"` - `createUser.response.409.error.checks.required` (array | null, required) — Null while unknown. - `createUser.response.409.error.checks.checks_unknown` (string | null, required) — Why the required checks are unknown, in plain words: "Pando couldn't read this monorepo's required checks; try again", or "pando.toml line 3: expected comma or end of structure; fix it on main, or merge with force". Null otherwise. - `createUser.response.409.error.checks.statuses` (array, required) — The latest status per context. - `createUser.response.409.error.checks.statuses.sha` (string, required) - `createUser.response.409.error.checks.statuses.context` (string, required) - `createUser.response.409.error.checks.statuses.state` (string, required) - one of `"pending"`, `"success"`, `"failure"`, `"error"` - `createUser.response.409.error.checks.statuses.created_at` (string, required) - format `date-time` - `createUser.response.409.error.checks.statuses.target_url` (string | null, optional) - `createUser.response.409.error.checks.statuses.description` (string | null, optional) - `createUser.response.409.error.checks.statuses.creator` (string, optional) — The member who posted it (a login); `app:` for a status posted with a status token or by a CI integration; `hook:` for a status token from a web hook with no app. - `createUser.response.409.error.checks.statuses.app` (string | null, optional) — The CI service that reported it (`buildkite`, `github-actions`, ...), stamped by Pando from a status token or a CI integration, never from the body or `target_url`. Null when a member posted it with their own credential. The web shows the service's mark for a slug it knows. - `createUser.response.409.error.checks.missing` (array, optional) ### 503 `bootstrap_not_configured`: the PANDO_BOOTSTRAP secret is not set. #### Example ```json { "error": { "code": "string", "message": "string", "paths": [ "string" ], "checks": { "sha": "string", "state": "success", "required": [ "string" ], "checks_unknown": "string", "missing": [ "string" ], "statuses": [ { "sha": "string", "context": "string", "state": "pending", "target_url": "string", "description": "string", "creator": "string", "app": "string", "created_at": "2019-08-24T14:15:22Z" } ] } } } ``` - `createUser.response.503.error` (object, required) - `createUser.response.503.error.code` (string, required) - `createUser.response.503.error.message` (string, required) - `createUser.response.503.error.paths` (array, optional) - `createUser.response.503.error.checks` (object, optional) — GitHub's combined status, plus the required contexts and which are missing. - `createUser.response.503.error.checks.sha` (string | null, required) - `createUser.response.503.error.checks.state` (string, required) — `success` when the merge gate passes; `missing` when a required context has not reported; `unknown` while the required checks are (an unforced merge is refused). - one of `"success"`, `"pending"`, `"failure"`, `"error"`, `"missing"`, `"unknown"` - `createUser.response.503.error.checks.required` (array | null, required) — Null while unknown. - `createUser.response.503.error.checks.checks_unknown` (string | null, required) — Why the required checks are unknown, in plain words: "Pando couldn't read this monorepo's required checks; try again", or "pando.toml line 3: expected comma or end of structure; fix it on main, or merge with force". Null otherwise. - `createUser.response.503.error.checks.statuses` (array, required) — The latest status per context. - `createUser.response.503.error.checks.statuses.sha` (string, required) - `createUser.response.503.error.checks.statuses.context` (string, required) - `createUser.response.503.error.checks.statuses.state` (string, required) - one of `"pending"`, `"success"`, `"failure"`, `"error"` - `createUser.response.503.error.checks.statuses.created_at` (string, required) - format `date-time` - `createUser.response.503.error.checks.statuses.target_url` (string | null, optional) - `createUser.response.503.error.checks.statuses.description` (string | null, optional) - `createUser.response.503.error.checks.statuses.creator` (string, optional) — The member who posted it (a login); `app:` for a status posted with a status token or by a CI integration; `hook:` for a status token from a web hook with no app. - `createUser.response.503.error.checks.statuses.app` (string | null, optional) — The CI service that reported it (`buildkite`, `github-actions`, ...), stamped by Pando from a status token or a CI integration, never from the body or `target_url`. Null when a member posted it with their own credential. The web shows the service's mark for a slug it knows. - `createUser.response.503.error.checks.missing` (array, optional) Source: https://docs.gitpando.com/api/users/createUser/index.md