Create an organization below the caller scope
POST/api/v1/subjects
Requires Idempotency-Key. kind may be omitted from the body; the gateway then reads it as organization, the only kind slice 0 creates. The new subject path is parentPath (default: the caller scope path) plus slug; a parent outside the caller scope is refused.
Two rules on displayName beyond its schema, both because an organization name is published in the trust tree once the organization is admitted. Its letters must come from the scripts this deployment allows (Latin and Arabic unless the operator configured otherwise), and no unbroken run of letters may mix two scripts (a space, hyphen, slash, digit or any punctuation ends a run, so a Latin word joined to an Arabic word by a hyphen is accepted); digits, punctuation and combining marks are always allowed. A name that fails is refused with 400 and code subject.name_script. And it must not read the same as the name of an organization above the new one or beside it, once capitals, character width, invisible characters and spacing are set aside: 409 with code subject.name_taken, whose detail names the path of that organization. Only organizations inside the caller scope are compared, so a 201 is not a promise: the same comparison is made across the whole trust tree when the organization is admitted.
Request
Responses
- 201
- 400
- 401
- 403
- 409
- 415
- 429
- 500
- 502
- 503
The subject was created.
Response Headers
The correlation id of the request, on every response including 401.
The request is malformed. callerShould: fix-and-retry.
Response Headers
The correlation id of the request, on every response including 401.
Authentication is required. callerShould: authenticate.
Response Headers
The correlation id of the request, on every response including 401.
The token is valid but maps to no usable principal. callerShould: stop.
Response Headers
The correlation id of the request, on every response including 401.
The resource is not in a state that allows this (callerShould: re-read-and-decide), or A concurrent change conflicted with this request (callerShould: re-read-and-retry-once). Told apart by the type URI; the code member names the refusal (for example subject.slug_taken). A conflict the module marked not retryable carries callerShould: re-read-and-decide.
Response Headers
The correlation id of the request, on every response including 401.
The request body has an unsupported media type. Send application/json. callerShould: fix-and-retry.
Response Headers
The correlation id of the request, on every response including 401.
Too many requests. The rate limit for this caller was reached: 600 a minute per authenticated principal, 60 a minute per client address before authentication (both configurable). callerShould: retry-with-backoff, after the number of seconds in Retry-After.
Response Headers
The correlation id of the request, on every response including 401.
Whole seconds to wait before the next request.
An internal error occurred. callerShould: retry-with-backoff.
Response Headers
The correlation id of the request, on every response including 401.
A system we depend on failed. callerShould: retry-with-backoff.
Response Headers
The correlation id of the request, on every response including 401.
The service cannot serve this right now. callerShould: retry-with-backoff.
Response Headers
The correlation id of the request, on every response including 401.