Idempotently provision a Better Auth user and workspace access

POST /admin/v1/workspaces/{workspaceId}/users — Idempotently provision a Better Auth user and workspace access

Endpoint

POST /admin/v1/workspaces/{workspaceId}/users

Operation ID: provisionWorkspaceUser

Authentication

Send a Nexus Management Key as Authorization: Bearer <management-key>. This credential is control-plane only.

Idempotency

This operation does not declare an Idempotency-Key requirement in the accepted OpenAPI contract.

Request

Parameters

Name	Location	Required	Schema	Description
`workspaceId`	path	Yes	`string`	—

application/json body

Required: Yes

Type: ProvisionWorkspaceUserDto

Field	Required	Type	Description
`externalUserId`	Yes	`string`	—
`email`	Yes	`string / email`	—
`name`	No	`string`	—
`planId`	Yes	`string`	—
`metadata`	No	`object`	—
`issueInferenceKey`	No	`boolean`	—

Responses

Status	Description	Content type	Schema
`201`	—	application/json	`ProvisionedWorkspaceUserDto`

Only responses explicitly declared by the accepted Admin OpenAPI contract are shown. The current contract does not declare operation-specific error bodies; the SDK preserves any non-success status and body in AdminApiError.

`201` application/json schema

Type: ProvisionedWorkspaceUserDto

Field	Required	Type	Description
`userId`	Yes	`string`	—
`workspaceAccess`	Yes	`WorkspaceAccessDto`	—
`workspaceAccess.id`	Yes	`string`	—
`workspaceAccess.workspaceId`	Yes	`string`	—
`workspaceAccess.userId`	Yes	`string`	—
`workspaceAccess.externalUserId`	Yes	`string`	—
`workspaceAccess.planId`	Yes	`string`	—
`workspaceAccess.status`	Yes	`string (PENDING \| ACTIVE \| SUSPENDED \| EXPIRED \| REVOKED)`	—
`workspaceAccess.accessStartsAt`	Yes	`string / date-time`	—
`workspaceAccess.accessEndsAt`	No	`string / date-time`	—
`workspaceAccess.metadata`	No	`object`	—
`apiKey`	No	`string`	Returned only when a new key is issued. The plaintext is shown once.
`keyExpiresAt`	No	`string / date-time`	—
`quotaPeriodEndsAt`	No	`string / date-time`	—

Examples

TypeScript Management SDK

NexusAdminClient.provisionWorkspaceUser uses AdminOperationInput<"provisionWorkspaceUser"> and returns Promise<AdminOperationOutput<"provisionWorkspaceUser">>.

import { NexusAdminClient } from '@nexus/sdk-typescript';

const nexus = new NexusAdminClient({
  baseUrl: 'https://nexus.microvoid.io',
  managementKey: process.env.NEXUS_MANAGEMENT_KEY,
});

const result = await nexus.provisionWorkspaceUser({
  path: {
    workspaceId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
  },
  body: {
    externalUserId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
    email: 'user@example.com',
    planId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
  },
});

Fetch

const response = await fetch(
  'https://nexus.microvoid.io/admin/v1/workspaces/533c4e1e-2823-4349-86b9-d6f1a869a2ca/users',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.NEXUS_MANAGEMENT_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      externalUserId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
      email: 'user@example.com',
      planId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
    }),
  },
);

if (!response.ok) throw new Error(`Nexus request failed: ${response.status}`);

curl

curl --request POST \
  "https://nexus.microvoid.io/admin/v1/workspaces/533c4e1e-2823-4349-86b9-d6f1a869a2ca/users" \
  --header "Authorization: Bearer ${NEXUS_MANAGEMENT_KEY}" \
  --header "Content-Type: application/json" \
  --data "{\"externalUserId\":\"533c4e1e-2823-4349-86b9-d6f1a869a2ca\",\"email\":\"user@example.com\",\"planId\":\"533c4e1e-2823-4349-86b9-d6f1a869a2ca\"}"