action dracoon_create_user {
  label: "Create new user"
  description: "### Description:\nCreate a new user.\n\n### Precondition:\nRight <span style='padding: 3px; background-color: #F6F7F8; border: 1px solid #000; border-radius: 5px; display: inline;'>&#128275; change users</span> required.\n\n### Postcondition:\nNew user is created.\n\n### Further Information:\n* If a user should **NOT** expire, leave `expireAt` empty.\n* All input fields are limited to **150** characters\n* Forbidden characters in first or last name: [`<`, `>`]\n* Forbidden characters in passwords: [`&`, `'`, `<`, `>`]\n\n### Authentication Method Options:\n<details style=\"padding: 10px; background-color: #F6F7F8; border: 1px solid #AAA; border-radius: 5px;\">\n<summary style=\"cursor: pointer; outline: none\"><strong>Expand</strong></summary>\n\n| Authentication Method | Option Key | Option Value |\n| :--- | :--- | :--- |\n| `basic` / `sql` | `username` | Unique user identifier |\n| `active_directory` | `ad_config_id` (optional) | Active Directory configuration ID |\n|  | `username` | Active Directory username according to authentication setting `userFilter` |\n| `radius` | `username` | RADIUS username |\n| `openid` | `openid_config_id` (optional) | OpenID Connect configuration ID |\n|  | `username` | OpenID Connect username according to authentication setting `mappingClaim` |\n\n</details>"
  provider: dracoon
  method: POST
  path: "/v4/users"
  encoding: json
  input: {
    type: "object"
    properties: {
      "X-Sds-Auth-Token": {
        type: "string"
      }
      "X-Sds-Date-Format": {
        type: "string"
        enum: ["UTC", "LOCAL", "OFFSET", "EPOCH", "LEET"]
      }
      authData: {
        type: "object"
        description: "User Authentication Data"
        required: ["method"]
        properties: {
          adConfigId: {
            type: "integer"
            format: "int32"
            description: "ID of the user's Active Directory."
          }
          login: {
            type: "string"
            description: "User login name"
          }
          method: {
            type: "string"
            description: "Authentication method\n\n\n\nAuthentication methods:\n\n* `basic`\n\n* `active_directory`\n\n* `radius`\n\n* `openid`"
          }
          mustChangePassword: {
            type: "boolean"
            description: "Determines whether user has to change his / her password\n\n* default: `true` for `basic` auth type\n\n* default: `false` for `active_directory`, `openid` and `radius` auth types"
          }
          oidConfigId: {
            type: "integer"
            format: "int32"
            description: "ID of the user's OIDC provider."
          }
          password: {
            type: "string"
            description: "Password (only relevant for `basic` authentication type)\n\n*NOT* your Active Directory, OpenID or RADIUS password!"
          }
        }
      }
      authMethods: {
        type: "array"
        description: "&#128679; Deprecated since v4.13.0\n\nAuthentication methods:\n\n* `sql`\n\n* `active_directory`\n\n* `radius`\n\n* `openid`\n\nuse `authData` instead"
        items: {
          type: "object"
          description: "Authentication method"
          required: ["authId", "isEnabled"]
          properties: {
            authId: {
              type: "string"
              description: "Authentication method\n\n\n\nAuthentication methods:\n\n* `basic`\n\n* `active_directory`\n\n* `radius`\n\n* `openid`"
            }
            isEnabled: {
              type: "boolean"
              description: "Is enabled"
            }
            options: {
              type: "array"
              description: "Authentication method options"
              items: {
                type: "object"
                description: "Key-value pair"
                required: ["key", "value"]
                properties: {
                  key: {
                    type: "string"
                    description: "Entry key"
                  }
                  value: {
                    type: "string"
                    description: "Entry value"
                  }
                }
              }
            }
          }
        }
      }
      email: {
        type: "string"
        description: "Email "
      }
      expiration: {
        type: "object"
        description: "Expiration information"
        required: ["enableExpiration"]
        properties: {
          enableExpiration: {
            type: "boolean"
            description: "enabled / disabled"
          }
          expireAt: {
            type: "string"
            format: "date-time"
            description: "Expiration date"
          }
        }
      }
      firstName: {
        type: "string"
        description: "User first name"
      }
      gender: {
        type: "string"
        description: "&#128679; Deprecated since v4.12.0\n\nGender\n\nDo NOT use `gender`! It will be ignored."
      }
      isNonmemberViewer: {
        type: "boolean"
        description: "&#128640; Since v4.12.0\n\nDetermines whether user has the role NONMEMBER_VIEWER"
      }
      lastName: {
        type: "string"
        description: "User last name"
      }
      login: {
        type: "string"
        description: "&#128679; Deprecated since v4.13.0\n\nUser login name"
      }
      mfaConfig: {
        type: "object"
        description: "Multi-factor authentication configuration"
        properties: {
          mfaEnforced: {
            type: "boolean"
          }
        }
      }
      needsToChangePassword: {
        type: "boolean"
        description: "&#128679; Deprecated since v4.13.0\n\nDetermines whether user has to change his / her initial password.\n\nuse `authDate.mustChangePassword` instead"
      }
      notifyUser: {
        type: "boolean"
        description: "&#128640; Since v4.9.0\n\nNotify user about his new account\n\n* default: `true` for `basic` auth type\n\n* default: `false` for `active_directory`, `openid` and `radius` auth types"
      }
      password: {
        type: "string"
        description: "&#128679; Deprecated since v4.13.0\n\nAn initial password may be preset\n\nuse `authData` instead"
      }
      phone: {
        type: "string"
        description: "Phone number"
      }
      receiverLanguage: {
        type: "string"
        description: "IETF language tag"
      }
      title: {
        type: "string"
        description: "&#128679; Deprecated since v4.18.0\n\nJob title"
      }
      userName: {
        type: "string"
        description: "&#128640; Since v4.13.0\n\nUsername"
      }
    }
    required: ["firstName", "lastName"]
    additionalProperties: false
  }
  output: {
    type: "object"
    description: "User information"
    required: ["authData", "avatarUuid", "firstName", "id", "isLocked", "lastName", "lockStatus", "userName"]
    properties: {
      authData: {
        type: "object"
        description: "User Authentication Data"
        required: ["method"]
        properties: {
          adConfigId: {
            type: "integer"
            format: "int32"
            description: "ID of the user's Active Directory."
          }
          login: {
            type: "string"
            description: "User login name"
          }
          method: {
            type: "string"
            description: "Authentication method\n\n\n\nAuthentication methods:\n\n* `basic`\n\n* `active_directory`\n\n* `radius`\n\n* `openid`"
          }
          mustChangePassword: {
            type: "boolean"
            description: "Determines whether user has to change his / her password\n\n* default: `true` for `basic` auth type\n\n* default: `false` for `active_directory`, `openid` and `radius` auth types"
          }
          oidConfigId: {
            type: "integer"
            format: "int32"
            description: "ID of the user's OIDC provider."
          }
          password: {
            type: "string"
            description: "Password (only relevant for `basic` authentication type)\n\n*NOT* your Active Directory, OpenID or RADIUS password!"
          }
        }
      }
      authMethods: {
        type: "array"
        description: "&#128679; Deprecated since v4.13.0\n\nAuthentication methods:\n\n* `sql`\n\n* `active_directory`\n\n* `radius`\n\n* `openid`\n\nuse `authData` instead"
        items: {
          type: "object"
          description: "Authentication method"
          required: ["authId", "isEnabled"]
          properties: {
            authId: {
              type: "string"
              description: "Authentication method\n\n\n\nAuthentication methods:\n\n* `basic`\n\n* `active_directory`\n\n* `radius`\n\n* `openid`"
            }
            isEnabled: {
              type: "boolean"
              description: "Is enabled"
            }
            options: {
              type: "array"
              description: "Authentication method options"
              items: {
                type: "object"
                description: "Key-value pair"
                required: ["key", "value"]
                properties: {
                  key: {
                    type: "string"
                    description: "Entry key"
                  }
                  value: {
                    type: "string"
                    description: "Entry value"
                  }
                }
              }
            }
          }
        }
      }
      avatarUuid: {
        type: "string"
        description: "&#128640; Since v4.11.0\n\nAvatar UUID"
      }
      email: {
        type: "string"
        description: "Email "
      }
      expireAt: {
        type: "string"
        format: "date-time"
        description: "Expiration date"
      }
      firstName: {
        type: "string"
        description: "User first name"
      }
      gender: {
        type: "string"
        description: "&#128679; Deprecated since v4.12.0\n\nGender"
      }
      hasManageableRooms: {
        type: "boolean"
        description: "User has manageable rooms"
      }
      homeRoomId: {
        type: "integer"
        format: "int64"
        description: "Homeroom ID"
      }
      id: {
        type: "integer"
        format: "int64"
        description: "Unique identifier for the user"
      }
      isEncryptionEnabled: {
        type: "boolean"
        description: "User has generated private key.\n\nPossible if client-side encryption is active for this customer"
      }
      isLocked: {
        type: "boolean"
        description: "User is locked:\n\n* `false` - unlocked\n\n* `true` - locked\n\n\n\nUser is locked and can not login anymore."
      }
      isMfaEnabled: {
        type: "boolean"
        description: "Determines whether multi-factor authentication is enabled"
      }
      isMfaEnforced: {
        type: "boolean"
        description: "Determines whether multi-factor authentication is enforced"
      }
      lastLoginSuccessAt: {
        type: "string"
        format: "date-time"
        description: "Last successful logon date"
      }
      lastName: {
        type: "string"
        description: "User last name"
      }
      lockStatus: {
        type: "integer"
        format: "int32"
        description: "&#128679; Deprecated since v4.7.0\n\nUser lock status:\n\n* `0` - locked\n\n* `1` - Web access allowed\n\n* `2` - Web and mobile access allowed\n\n\n\nPlease use `isLocked` instead."
      }
      login: {
        type: "string"
        description: "&#128679; Deprecated since v4.13.0\n\nUser login name"
      }
      phone: {
        type: "string"
        description: "Phone number"
      }
      publicKeyContainer: {
        type: "object"
        description: "Public key container"
        required: ["publicKey", "version"]
        properties: {
          createdAt: {
            type: "string"
            format: "date-time"
            description: "&#128640; Since v4.24.0\n\nCreation date"
          }
          createdBy: {
            type: "integer"
            format: "int64"
            description: "&#128640; Since v4.24.0\n\nCreated by user"
          }
          publicKey: {
            type: "string"
            description: "Public key"
          }
          version: {
            type: "string"
            description: "Version"
          }
        }
      }
      title: {
        type: "string"
        description: "&#128679; Deprecated since v4.18.0\n\nJob title"
      }
      userAttributes: {
        type: "object"
        description: "User custom attributes (list of key-value pairs)"
        required: ["items"]
        properties: {
          items: {
            type: "array"
            description: "List of key-value pairs"
            items: {
              type: "object"
              additionalProperties: true
            }
          }
        }
      }
      userName: {
        type: "string"
        description: "&#128640; Since v4.13.0\n\nUsername"
      }
      userRoles: {
        type: "object"
        description: "List of roles"
        required: ["items"]
        properties: {
          items: {
            type: "array"
            description: "List of roles"
            items: {
              type: "object"
              description: "Role information"
              required: ["description", "id", "name"]
              properties: {
                description: {
                  type: "string"
                  description: "Role description"
                }
                id: {
                  type: "integer"
                  format: "int32"
                  description: "Unique identifier for the role"
                }
                items: {
                  type: "array"
                  description: "List of reachable right over role"
                  items: {
                    type: "object"
                    description: "Right information"
                    required: ["description", "id", "name"]
                    properties: {
                      description: {
                        type: "string"
                        description: "Right description"
                      }
                      id: {
                        type: "integer"
                        format: "int32"
                        description: "Unique identifier for the right"
                      }
                      name: {
                        type: "string"
                        description: "Right (unique) name"
                      }
                    }
                  }
                }
                name: {
                  type: "string"
                  description: "Role (unique) name"
                }
              }
            }
          }
        }
      }
    }
  }
}