Skip to main content

​
Overview

Creates a new agent account and logs the user in. The account behaves like a regular XMPP account. New accounts are disabled until their email address is verified. Phone verification is optional if a phone number is provided.

​
HTTP request

POST /Agent/Account/Create

​
Authentication

This endpoint requires an API key and secret. Sign the request with HMAC-SHA256 using the API secret as the key. Signature message: 
userName:host:eMail:password:apiKey:nonce

​
Request body

{
  "userName": "alice",
  "eMail": "alice@example.com",
  "phoneNr": "+46700000000",
  "password": "correct-horse-battery-staple",
  "apiKey": "your-api-key",
  "nonce": "random-unique-string-at-least-32-chars",
  "signature": "base64-hmac",
  "seconds": 3600,
  "language": "en"
}
FieldTypeRequiredDescription
userNamestringyesUsername for the account. Do not include @.
eMailstringyesEmail address used for verification.
phoneNrstringnoPhone number to verify (optional).
passwordstringyesAccount password.
apiKeystringyesAPI key issued by the Neuron operator.
noncestringyesUnique random string (minimum 32 chars).
signaturestringyesHMAC signature of the request.
secondsnumberyesJWT lifetime in seconds (0 < seconds 3600).
languagestringnoOptional language code for messages.

​
Response

{
  "created": "2024-08-02T10:22:11Z",
  "updated": "2024-08-02T10:22:11Z",
  "enabled": false,
  "canRelay": true,
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires": "2024-08-02T11:22:11Z",
  "eMailCodeSent": true,
  "phoneNrCodeSent": false
}
FieldTypeDescription
createdstringServer timestamp when the account was created.
updatedstringServer timestamp when the account was last updated.
enabledbooleanfalse until the email is verified.
canRelaybooleanWhether the account can relay email.
jwtstringJWT bearer token for authenticated calls.
expiresstringJWT expiration timestamp.
eMailCodeSentbooleanWhether an email verification code was sent.
phoneNrCodeSentbooleanWhether a phone verification code was sent.

​
Notes

  • Protect your API key and secret. They should only be used from secure back-end services.
  • Each API key has a limit on how many accounts it can create.
  • If you cannot protect secrets (for example, in a browser), use CreateWebForm.

​
Next steps