Create Enterprise Member

username is required, 2–50 characters (letters, digits, underscore, hyphen, dot or Chinese), unique within the enterprise. displayName is optional, at most 100 characters. Omit password to generate one; an explicit password uses the existing SM2 transport and is rejected when approval is enabled. The immediate response exposes initialPassword once; do not log it.

Authentication

MANAGEMENT / PROVISIONING key with tenant:members:write.

Authorization: Bearer <CONTROL_KEY>

Approval and retries

Approval-enabled enterprises require Idempotency-Key and may receive HTTP 409 / APPROVAL_REQUIRED with data.operation.executed=false. Nothing has executed at that point. Other enterprises execute directly; do not assume arbitrary POST requests support idempotent retries.

Approval and retry guide

Request body

usernamestringrequired

2–50 characters; unique within enterprise / 2–50 字符，企业内唯一

displayNamestring

At most 100 characters / 最长 100 字符

passwordstring

SM2 encrypted; omit to generate; forbidden in approval mode / SM2 密文；省略自动生成；审批模式禁止传入

Fields use camelCase. Required and optional fields are described above.

JSON

1{
2  "username": "team_app",
3  "displayName": "Team App"
4}

Response

HTTP 201; code: 200. Values below are illustrative; fields use camelCase.

codeinteger

200

dataobject | null

data.subAccountIdstring

data.usernamestring

data.displayNamestring

data.initialPasswordstring

Errors

Check both HTTP status and code; on failure inspect serviceCode, msg and traceId. Invalid credentials receive no data; missing scopes return API_KEY_SCOPE_DENIED. Cross-tenant resources are inaccessible. Acceptance or pending approval does not mean business completion.