> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Provision a user > Needs permission user:write. Invites the person across the whole account with your default role (Administrator until other roles can be given). 409 uniqueness when the userName or externalId is already in your account. Send an API token of your account as Authorization: Bearer , with the user:write permission across the whole account (403 otherwise). ## OpenAPI ````yaml /api-reference/specs/administration.json post /scim/v2/Users openapi: 3.0.4 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns or manages: list them with headcounts and your access to each, get one in full, add one or several at a time, see everybody who can reach one, and read which of its data an outside system manages. - name: Organisation groups description: >- Named sets of your organisations, such as the clients one team looks after. Give a person or API token a group, and they reach every organisation in it, including ones added later. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: Roles description: >- What people and API tokens can do where they have access: the built-in roles, roles of your own, and the default role. Only Administrator can be given today. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Branding description: >- Your white-label brand: edit a draft, publish it, upload its files, and set a company logo for each organisation. - name: Activity description: >- Recent administration actions in your account, and every change to who has access, newest first. - name: SCIM description: >- SCIM 2.0 provisioning: your identity provider adds, updates, suspends and removes your account's people, and gives them account-wide roles. paths: /scim/v2/Users: post: tags: - SCIM summary: Provision a user description: >- Needs permission user:write. Invites the person across the whole account with your default role (Administrator until other roles can be given). 409 uniqueness when the userName or externalId is already in your account. Send an API token of your account as Authorization: Bearer , with the user:write permission across the whole account (403 otherwise). operationId: ScimCreateUser responses: '201': description: Created content: application/scim+json: schema: $ref: '#/components/schemas/ScimUserResource' '400': description: Bad Request content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '401': description: Unauthorized content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '403': description: Forbidden content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '404': description: Not Found content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '409': description: Conflict content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '412': description: Precondition Failed content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' '503': description: Service Unavailable content: application/scim+json: schema: $ref: '#/components/schemas/ScimError' components: schemas: ScimUserResource: required: - id - meta type: object properties: schemas: type: array items: type: string id: type: string externalId: type: string nullable: true userName: type: string nullable: true name: $ref: '#/components/schemas/ScimName' displayName: type: string nullable: true emails: type: array items: $ref: '#/components/schemas/ScimEmail' nullable: true active: type: boolean meta: $ref: '#/components/schemas/ScimMeta' additionalProperties: false ScimError: required: - detail - status type: object properties: schemas: type: array items: type: string status: type: string scimType: type: string nullable: true detail: type: string additionalProperties: false ScimName: type: object properties: givenName: type: string nullable: true familyName: type: string nullable: true formatted: type: string nullable: true additionalProperties: false ScimEmail: required: - value type: object properties: value: type: string type: type: string primary: type: boolean additionalProperties: false ScimMeta: required: - location - resourceType type: object properties: resourceType: type: string created: type: string nullable: true location: type: string additionalProperties: false securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.