Portal

#!/usr/bin/env bash
set -euo pipefail

HOST="<your global domain>"
REALM="<your realm name>"
CLIENT_ID="<api-client-id>"
CLIENT_SECRET="<api-client-secret>"

# Users to create: "username,firstName,lastName"
USERS=(
  "test.user1@example.com,Test,UserOne"
  "test.user2@example.com,Test,UserTwo"
)

# Realm roles to assign to every created user
ROLE_NAMES=("xDM User" "xDM Admin")

# 1. Get an access token
TOKEN=$(curl -s -X POST "https://${HOST}/auth/realms/${REALM}/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=${CLIENT_ID}" \
  -d "client_secret=${CLIENT_SECRET}" | jq -r '.access_token')

# 2. Retrieve all realm roles once, ahead of any user creation
ALL_ROLES=$(curl -s -X GET "https://${HOST}/auth/realms/${REALM}/platform/roles" \
  -H "Authorization: Bearer ${TOKEN}")

# Build the {id, name} payload for the roles we want to assign, reused for every user
NAMES_JSON=$(printf '%s\n' "${ROLE_NAMES[@]}" | jq -R . | jq -s .)
ROLES_PAYLOAD=$(echo "${ALL_ROLES}" | jq -c --argjson names "${NAMES_JSON}" \
  '[.[] | select(.name as $n | $names | index($n) != null) | {id, name}]')

echo "Roles resolved once for this batch: ${ROLES_PAYLOAD}"

# 3. Loop over all users: create each one, then assign the same pre-fetched roles
for USER_ENTRY in "${USERS[@]}"; do
  IFS=',' read -r USERNAME FIRST LAST <<< "${USER_ENTRY}"

  curl -s -X POST "https://${HOST}/auth/realms/${REALM}/platform/users" \
    -H "Authorization: Bearer ${TOKEN}" \
    -H "Content-Type: application/json" \
    -d "{
          \"username\": \"${USERNAME}\",
          \"email\": \"${USERNAME}\",
          \"emailVerified\": true,
          \"firstName\": \"${FIRST}\",
          \"lastName\": \"${LAST}\",
          \"enabled\": true,
          \"status\": \"ACTIVE\"
        }" > /dev/null

  USER_ID=$(curl -s -X GET "https://${HOST}/auth/realms/${REALM}/platform/users" \
    -H "Authorization: Bearer ${TOKEN}" \
    | jq -r --arg u "${USERNAME}" '.[] | select(.username==$u) | .id')

  curl -s -X POST "https://${HOST}/auth/realms/${REALM}/platform/users/${USER_ID}/role-mappings/realm" \
    -H "Authorization: Bearer ${TOKEN}" \
    -H "Content-Type: application/json" \
    -d "${ROLES_PAYLOAD}" > /dev/null

  echo "User ${USERNAME} (${USER_ID}) created and roles assigned."
done

Solution 2. Assign Roles via the role-mappings API

This approach trades a bit of per-user flexibility for fewer API calls, since the role-to-group mapping is configured once and reused for every user.

Step 1. Create Platform Groups with the desired access level

In the Platform Administration UI (or via the Groups API), create one group per access profile needed, for example DM User, DM Admin, DPC Admin, or any combination of those.

Step 2. Create the user via API

POST https://<your global domain>/auth/realms/<your realm name>/platform/users

PUT https://<your global domain>/auth/realms/<your realm name>/platform/users/<user ID>/groups/<group ID>

#!/usr/bin/env bash
set -euo pipefail

HOST="<your global domain>"
REALM="<your realm name>"
CLIENT_ID="<api-client-id>"
CLIENT_SECRET="<api-client-secret>"
GROUP_ID="<pre-created group id>"
USERNAME="test.user@example.com"

# 1. Get an access token
TOKEN=$(curl -s -X POST "https://${HOST}/auth/realms/${REALM}/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=${CLIENT_ID}" \
  -d "client_secret=${CLIENT_SECRET}" | jq -r '.access_token')

# 2. Create the user (roles array omitted, not used by this approach)
curl -s -X POST "https://${HOST}/auth/realms/${REALM}/platform/users" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{
        \"username\": \"${USERNAME}\",
        \"email\": \"${USERNAME}\",
        \"emailVerified\": true,
        \"firstName\": \"Test\",
        \"lastName\": \"User\",
        \"enabled\": true,
        \"status\": \"ACTIVE\"
      }" > /dev/null

# 3. Retrieve the created user's ID
USER_ID=$(curl -s -X GET "https://${HOST}/auth/realms/${REALM}/platform/users" \
  -H "Authorization: Bearer ${TOKEN}" \
  | jq -r --arg u "${USERNAME}" '.[] | select(.username==$u) | .id')

# 4. Add the user to the pre-defined group (its DM roles are inherited via sync)
curl -s -X PUT "https://${HOST}/auth/realms/${REALM}/platform/users/${USER_ID}/groups/${GROUP_ID}" \
  -H "Authorization: Bearer ${TOKEN}"

echo "User ${USER_ID} created and added to group ${GROUP_ID}."

POST /dm/api/rest/admin/users/<user>/assign

Note: user must first have at least DM User platform role assigned to be able to get the DM roles.