Skip to main content

`POST /v1/accounts`

POST 
/v1/accounts

Create account.

create account (v1 legacy). .5: holder callers can only create accounts owned by themselves. Server-side defence-in-depth:

  • If the caller is a holder (§4.3c - no holder:view-all scope) and they did not supply customer_id, we resolve it from their Auth user id (via customers).
  • If the caller is a holder and they did supply a customer_id that does not match their own, we return 403 (they cannot create accounts for someone else).
  • If no customers row exists for the holder, we return 403
  • there is no way to own the account, so creating it would leave an orphan (the list/get handlers then hide it forever).
  • Callers with holder:view-all (staff / sys / M2M) are unrestricted: they can pass any customer_id or none (for internal accounts).

Request​

Responses​

Account created