Create the user for a Keycloak-only account and anchor it to one organization

POST

/api/v1/tenant-consistency/keycloak-users/{keycloakId}/anchor

curl --request POST \
  --url http://localhost:3000/api/v1/tenant-consistency/keycloak-users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/anchor \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "roleId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'

• Development
• Production

For a Keycloak account with no logiccloud orchestrate user row (“keycloak-only”): creates the row from the Keycloak account and anchors it like POST /users/{userId}/anchor, in one transaction. Refused while Entra federation is enabled (user creation is governed by Entra). Requires Super Admin privileges.

Authorizations

• api-key
• bearer

Parameters

Path Parameters

keycloakId

required

string format: uuid

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Request Body^required

Media typeapplication/json

object

organizationId

required

Organization to make the user primary in, in both logiccloud orchestrate and Keycloak.

string format: uuid

roleId

Role for a NEW membership; defaults to the system viewer role when the user is not yet a member. Rejected (400) when the user already is a member, because the existing role is kept.

string format: uuid

Example^generated

{
  "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "roleId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

Responses

200

Media typeapplication/json

object

userId

required

string format: uuid

email

required

string

organizationId

required

string format: uuid

membershipCreated

required

True when the user was not a member and a membership was created.

boolean

previousPrimaryOrganizationId

required

string format: uuid

nullable

previousKeycloakOrganizationIds

required

Organization_id attribute before the anchor, as Keycloak reported it.

Array<string>

keycloakOrganizationIds

required

Organization_id attribute now: exactly the membership set, de-duplicated. Order is not meaningful.

Array<string>

keycloakUpdated

required

False when the user has no live Keycloak account (never linked, or the linked account no longer exists): only the database primary was set (FM-1441).

boolean

keycloakLinkCleared

required

True when the linked Keycloak account no longer exists and the stale link was removed; the user is linked again on the next sign-in (FM-1441).

boolean

userCreated

required

True when a logiccloud orchestrate user row was created for a Keycloak-only account (FM-1441).

boolean

Example^generated

{
  "userId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "email": "example",
  "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "membershipCreated": true,
  "previousPrimaryOrganizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "previousKeycloakOrganizationIds": [
    "example"
  ],
  "keycloakOrganizationIds": [
    "example"
  ],
  "keycloakUpdated": true,
  "keycloakLinkCleared": true,
  "userCreated": true
}

400

Invalid input data

403

Forbidden - Super Admin required, or Entra enabled

404

Keycloak account, organization or role not found

409

The account already has a user, has no email, a user with its email exists, or the organization is not active

502

Keycloak could not be read or rejected the update

503

Keycloak is not configured