Add new Authorized user

Add New Authorized User

This endpoint creates a new authorized user (subprofile) under an existing business customer account. Authorized users can be assigned specific roles and access levels, enabling businesses to delegate banking operations to employees or representatives. Upon successful creation, the response returns a confirmation with the new authorized user's unique identifier.

Endpoint

POST /api/subProfiles/add

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a business customer needs to grant banking access to an employee, manager, or representative within their organization. Authorized users can be configured with Full, Limited, View-Only, or Custom access levels to match their role. This is applicable only to business customers — personal customers do not support subprofiles.

Request Body

{
  "email": "[email protected]",
  "givenName": "Jane",
  "familyName": "Doe",
  "dateOfBirth": "1990-04-15T00:00:00Z",
  "phoneNumber": "5551234567",
  "financialAccountId": "fa-0a1b2c3d4e5f",
  "departmentId": 3,
  "password": "S3cur3P@ssw0rd!"
}

Response

200 OK

{
  "id": "sp-7f8e9d0c1b2a",
  "message": "Authorized user created successfully."
}

Error Codes

Common Mistakes

• Sending phoneNumber with dashes, spaces, or country codes — it must be exactly 10 numeric digits (e.g., "5551234567", not "+15551234567" or "555-123-4567").
• Using the deprecated department string field instead of departmentId — always prefer departmentId for department assignment.
• Attempting to create a subprofile under a personal customer account — subprofiles are supported for business customers only.
• Providing dateOfBirth as a plain date string (e.g., "1990-04-15") instead of ISO 8601 date-time format (e.g., "1990-04-15T00:00:00Z").

Related Endpoints

• GET /api/subProfiles — Retrieve a list of all authorized users for the business account
• GET /api/subProfiles/{subProfileId} — Retrieve details for a specific authorized user
• PUT /api/subProfiles/{subProfileId} — Update an existing authorized user's information
• DELETE /api/subProfiles/{subProfileId} — Remove an authorized user from the business account

Example

curl -X POST https://api.banking.netevia.dev/api/subProfiles/add \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "givenName": "Jane",
    "familyName": "Doe",
    "dateOfBirth": "1990-04-15T00:00:00Z",
    "phoneNumber": "5551234567",
    "financialAccountId": "fa-0a1b2c3d4e5f",
    "departmentId": 3,
    "password": "S3cur3P@ssw0rd!"
  }'