> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a service identity

> Creates a Keycloak service account that holds existing realm roles.

A crew schedule set to run as it reads what those roles allow, under the
account's own name. You must hold every role, and none may be built in or
carry a Ranger super group. You're added to the people who may use it.



## OpenAPI

````yaml post /api/registry/identities
openapi: 3.1.0
info:
  title: Nx1 AI API
  description: |

    AI API for Nx1 Data Platform Management and Automated Data Tasks.

    Authentication is required via PSK in Authorization header.

    Default PSK is | [ask a friend] |
  version: 0.10.2
servers: []
security: []
paths:
  /api/registry/identities:
    post:
      tags:
        - Service identities
      summary: Create a service identity
      description: >-
        Creates a Keycloak service account that holds existing realm roles.


        A crew schedule set to run as it reads what those roles allow, under the

        account's own name. You must hold every role, and none may be built in
        or

        carry a Ranger super group. You're added to the people who may use it.
      operationId: create_identity_api_registry_identities_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RunIdentityCreate'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RunIdentityResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Conflict
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Unprocessable Content
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - OAuth2AuthorizationCodeBearer: []
        - APIKeyHeader: []
components:
  schemas:
    RunIdentityCreate:
      properties:
        slug:
          type: string
          pattern: ^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$
          title: Slug
          description: >-
            Lowercase letters, digits and hyphens, up to 40. Names the Keycloak
            client `nx1-agent-<slug>`; never reused.
        description:
          type: string
          maxLength: 2000
          title: Description
          default: ''
        roles:
          items:
            type: string
          type: array
          maxItems: 20
          minItems: 1
          title: Roles
          description: >-
            Existing realm roles it reads as. You must hold each one; built-in
            roles and Ranger super groups are refused.
        allowed_users:
          items:
            type: string
          type: array
          maxItems: 100
          title: Allowed Users
          description: Usernames who may set a schedule to run as it. You are added.
        allowed_roles:
          items:
            type: string
          type: array
          maxItems: 50
          title: Allowed Roles
          description: Realm roles whose holders may set a schedule to run as it.
      type: object
      required:
        - slug
        - roles
      title: RunIdentityCreate
      description: |-
        Make a service identity: a Keycloak service account holding existing
        realm roles, that crew schedules can run as.
    RunIdentityResponse:
      properties:
        id:
          type: string
          title: Id
        slug:
          type: string
          title: Slug
        description:
          type: string
          title: Description
        roles:
          items:
            type: string
          type: array
          title: Roles
        allowed_users:
          items:
            type: string
          type: array
          title: Allowed Users
        allowed_roles:
          items:
            type: string
          type: array
          title: Allowed Roles
        enabled:
          type: boolean
          title: Enabled
        client_id:
          type: string
          title: Client Id
          description: The Keycloak client.
        service_account_name:
          type: string
          title: Service Account Name
          description: The name its runs act as in Trino, Ranger and the AI Router.
        schedules:
          type: integer
          title: Schedules
          description: Crew schedules set to run as it, enabled or not.
        can_use:
          type: boolean
          title: Can Use
          description: Whether you may set a schedule to run as it.
        created_by:
          type: string
          title: Created By
          description: Username of the admin who made it.
        created_at:
          type: string
          title: Created At
          description: ISO 8601, UTC.
        updated_at:
          type: string
          title: Updated At
          description: ISO 8601, UTC.
      type: object
      required:
        - id
        - slug
        - description
        - roles
        - allowed_users
        - allowed_roles
        - enabled
        - client_id
        - service_account_name
        - schedules
        - can_use
        - created_by
        - created_at
        - updated_at
      title: RunIdentityResponse
      description: A service identity.
    ErrorResponse:
      properties:
        error:
          type: string
          title: Error
          description: A brief description of the error that occurred.
        code:
          type: integer
          title: Code
          description: The HTTP status code associated with the error.
          default: 500
      type: object
      required:
        - error
      title: ErrorResponse
  securitySchemes:
    OAuth2AuthorizationCodeBearer:
      type: oauth2
      flows:
        authorizationCode:
          scopes: {}
          authorizationUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth
          tokenUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token
    APIKeyHeader:
      type: apiKey
      in: header
      name: Authorization-PSK

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.