---
title: "Idempotently provision a Better Auth user and workspace access"
description: "POST /admin/v1/workspaces/{workspaceId}/users — Idempotently provision a Better Auth user and workspace access"
---

> Documentation Index
> Fetch the complete documentation index at: https://nexus.microvoid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Idempotently provision a Better Auth user and workspace access

## Endpoint

```http
POST /admin/v1/workspaces/{workspaceId}/users
```

Operation ID: `provisionWorkspaceUser`

## Authentication

Send a Nexus Management Key as `Authorization: Bearer <management-key>`. This credential is control-plane only.

## Idempotency

This operation does not declare an `Idempotency-Key` requirement in the accepted OpenAPI contract.

## Request

### Parameters

| Name          | Location | Required | Schema   | Description |
| ------------- | -------- | -------- | -------- | ----------- |
| `workspaceId` | path     | Yes      | `string` | —           |

### application/json body

Required: **Yes**

Type: `ProvisionWorkspaceUserDto`

| Field               | Required | Type             | Description |
| ------------------- | -------- | ---------------- | ----------- |
| `externalUserId`    | Yes      | `string`         | —           |
| `email`             | Yes      | `string / email` | —           |
| `name`              | No       | `string`         | —           |
| `planId`            | Yes      | `string`         | —           |
| `metadata`          | No       | `object`         | —           |
| `issueInferenceKey` | No       | `boolean`        | —           |

## Responses

| Status | Description | Content type     | Schema                        |
| ------ | ----------- | ---------------- | ----------------------------- |
| `201`  | —           | application/json | `ProvisionedWorkspaceUserDto` |

Only responses explicitly declared by the accepted Admin OpenAPI contract are shown. The current contract does not declare operation-specific error bodies; the SDK preserves any non-success status and body in [`AdminApiError`](/management-sdk/error-handling).

### `201` application/json schema

Type: `ProvisionedWorkspaceUserDto`

| Field                            | Required | Type                                                            | Description                                                          |
| -------------------------------- | -------- | --------------------------------------------------------------- | -------------------------------------------------------------------- |
| `userId`                         | Yes      | `string`                                                        | —                                                                    |
| `workspaceAccess`                | Yes      | `WorkspaceAccessDto`                                            | —                                                                    |
| `workspaceAccess.id`             | Yes      | `string`                                                        | —                                                                    |
| `workspaceAccess.workspaceId`    | Yes      | `string`                                                        | —                                                                    |
| `workspaceAccess.userId`         | Yes      | `string`                                                        | —                                                                    |
| `workspaceAccess.externalUserId` | Yes      | `string`                                                        | —                                                                    |
| `workspaceAccess.planId`         | Yes      | `string`                                                        | —                                                                    |
| `workspaceAccess.status`         | Yes      | `string (PENDING \| ACTIVE \| SUSPENDED \| EXPIRED \| REVOKED)` | —                                                                    |
| `workspaceAccess.accessStartsAt` | Yes      | `string / date-time`                                            | —                                                                    |
| `workspaceAccess.accessEndsAt`   | No       | `string / date-time`                                            | —                                                                    |
| `workspaceAccess.metadata`       | No       | `object`                                                        | —                                                                    |
| `apiKey`                         | No       | `string`                                                        | Returned only when a new key is issued. The plaintext is shown once. |
| `keyExpiresAt`                   | No       | `string / date-time`                                            | —                                                                    |
| `quotaPeriodEndsAt`              | No       | `string / date-time`                                            | —                                                                    |

## Examples

### TypeScript Management SDK

`NexusAdminClient.provisionWorkspaceUser` uses `AdminOperationInput<"provisionWorkspaceUser">` and returns `Promise<AdminOperationOutput<"provisionWorkspaceUser">>`.

```ts
import { NexusAdminClient } from '@nexus/sdk-typescript';

const nexus = new NexusAdminClient({
  baseUrl: 'https://nexus.microvoid.io',
  managementKey: process.env.NEXUS_MANAGEMENT_KEY,
});

const result = await nexus.provisionWorkspaceUser({
  path: {
    workspaceId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
  },
  body: {
    externalUserId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
    email: 'user@example.com',
    planId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
  },
});
```

### Fetch

```ts
const response = await fetch(
  'https://nexus.microvoid.io/admin/v1/workspaces/533c4e1e-2823-4349-86b9-d6f1a869a2ca/users',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.NEXUS_MANAGEMENT_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      externalUserId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
      email: 'user@example.com',
      planId: '533c4e1e-2823-4349-86b9-d6f1a869a2ca',
    }),
  },
);

if (!response.ok) throw new Error(`Nexus request failed: ${response.status}`);
```

### curl

```bash
curl --request POST \
  "https://nexus.microvoid.io/admin/v1/workspaces/533c4e1e-2823-4349-86b9-d6f1a869a2ca/users" \
  --header "Authorization: Bearer ${NEXUS_MANAGEMENT_KEY}" \
  --header "Content-Type: application/json" \
  --data "{\"externalUserId\":\"533c4e1e-2823-4349-86b9-d6f1a869a2ca\",\"email\":\"user@example.com\",\"planId\":\"533c4e1e-2823-4349-86b9-d6f1a869a2ca\"}"
```

## Related guide

- [Workspace access](/docs/give-users-access/workspace-access)
- [API Reference overview](/api-reference)

Source: https://nexus.microvoid.io/api-reference/admin/users-and-access/provision-workspace-user/index.mdx