You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/system-administration/about-global-users). info

Create a global user through the Edge UI, Edge API, or directly
from the Apigee web site, as described below.

> [!CAUTION]
> **IMPORTANT:**   
>
> Your ability to add new users may depend on your account type. For more information, see [Apigee Edge Pricing](https://apigee.com/api-management/#/pricing).

- **Edge UI**   
  For both Edge for Public Cloud and Edge for Private Cloud, an organization administrator uses the Edge UI to add a global user to an existing organization with a specific role. If the user already exists, the user is added to the organization.   

  If the user does not exist, then Edge creates the user and sends the user an email message to activate the account and to set a password. The user appears in the Edge UI immediately, even before the user activates the account.  

  While the organization administrator does not have the permission necessary to directly create the user, adding a new user to the organization in the Edge UI initiates the Edge workflow that creates the user.   

  > [!NOTE]
  > **Private Cloud:** For an Edge for Private Cloud installation, you must configure a connection to an SMTP email server so that Edge can send email to users. See [Configuring the Edge SMTP server](https://docs.apigee.com/private-cloud/latest/configuring-edge-smtp-server).

- **Edge API**   
  In an Edge for Private Cloud installation, a system administrator uses the Edge API to create a global user.   

  After creating the user, you must make a second API call to add the user to a system administrator role, to an organization and organization role, or both. The new user cannot sign in to the Edge UI until added to an organization.  

  > [!NOTE]
  > **Note:** While an organization administrator cannot create a global user, an organization administrator can use the Edge API to assign a user to an organization and organization role.

- **Apigee web site**   
  Anyone can register for a free Edge cloud account at <https://login.apigee.com/sign_up>. When you create an account directly on Edge, Edge automatically creates a global user and an organization for you, and your user account is assigned to the role of organization administrator for your organization. After you create the account, another organization administrator can add you to their organization.  

  See [Creating an Apigee
  Edge account](https://docs.apigee.com/api-platform/get-started/creating-apigee-edge-account) for more.

## Creating a global user through the Edge UI

An organization administrator can create a user in the Edge UI, and assign a role to the new
user in the organization:

1. Access the User page, as described below.

   ### Edge

   To access the Users page using the Edge UI:
   1. Sign in to <https://apigee.com/edge> as an **organization administrator**.
   2. Select **Admin \> Users** .


      If you are not an organization administrator, this menu is not available.

   ### New Edge UI (Private Cloud)

   > [!NOTE]
   > **Note:** The New Edge UI is available with Edge for Private Cloud only.

   To access the Users page using the New Edge UI:
   1. Sign in to the New Edge UI at `http://host:3001/edge` as an **organization administrator** , where <var translate="no">host</var> is the IP address or DNS name of the host running the New Edge UI.
   2. Select **Admin \> Users** .


      If you are not an organization administrator, this menu is not available.
2. Click **+ User** .

   The New User page displays.
3. Enter the user's email address.
4. Select the roles you want to assign to the user.  
   You can add more than one role to a user.
5. Click **Save** .

   The user appears in the Edge UI and Edge sends the new
   user an email with instructions to activate their account and sign in.

The user can sign in to the Edge UI using one of the following:

- Email address
- Username, which is the part of the email address before @.

## Creating a global user through the Edge API

> [!NOTE]
> **Private Cloud:** This procedure is for Edge for Private Cloud only.


In
Apigee Edge for Private Cloud, adding a new user through the Edge API is a two-step
process:

1. **As the system administrator** , make the API call to add the new global user:  

   ```
   curl -H "Content-Type:application/xml" -u <sysAdminEmail:pword> \
     -X POST https://<ms_IP>:8080/v1/users \
     -d '<User> \
       <FirstName>Foo</FirstName> \
       <LastName>Bar</LastName> \
       <Password>myPword</Password> \
       <EmailId>foo@bar.com</EmailId> \
     </User>'
   ```
   where \<ms_IP\> is the IP address or DNS name of the Edge Management Server.
2. Assign the new user to a role by performing one or both of the following:
   1. If the new user is going to function as a system administrator, then **as the
      system administrator** use the following API call to add the user to the system administrator role, `sysadmin`, or read-only system administrator role, `sysadmin-readonly`:

      ```
      curl -u <sysAdminEmail>:<passwd> \
       -X POST https://<ms_IP>:8080/v1/userroles/sysadmin/users \
       -d 'id=foo@bar.com'
      ```
   2. **As the system administrator or organization administrator** , assign the new user to a role in an organization. A global user does not appear in the Edge UI, and cannot log into the Edge UI, until that user is assigned to a role in an organization.   

      ```
      curl -H "Content-Type:application/x-www-form-urlencoded" \
        -u <orgOrSysAdminEmail:pword> -X POST \
        https://<ms_IP>:8080/v1/organizations/{org_name}/userroles/{role_name}/users?id=foo@bar.com
      ```
      Replace `{role_name}` with the specific role for the new user. Roles include:
      - Organization administrator: `orgadmin`
      - Read-only organization administrator (Cloud only): `readonlyadmin`
      - Operations administrator: `opsadmin`
      - Business user: `businessuser`
      - User: `user`

## Performing additional tasks to manage users

The following table shows operations that you can perform on a global user.

Many of these operations, such as deleting a global user, require system administrator
privileges. For a Cloud-based installation of Edge, contact
[Apigee Edge Support](https://docs.apigee.com/api-platform/troubleshoot/support) to perform these
actions. For an Edge for Private Cloud installation, the system administrator can perform
them.

> [!NOTE]
> **Note:** All of the APIs listed below that require the system administrator role are described in [Managing users, roles, and permissions](https://docs.apigee.com/private-cloud/latest/managing-users-roles-and-permissions) in the Edge for Private Cloud documentation. All of the APIs that require the organization administrator role are described at [http://apigee.com/docs/management/apis](https://docs.apigee.com/management/apis) using SmartDocs so that you can run them from the Apigee documentation pages.

|   | **Action** | **Required role** | **How** |
|---|---|---|---|
| **Manage global users** | List all users | sys admin | API |
| **Manage global users** | Add user**\*** | sys admin | API\* |
| **Manage global users** | Delete user | sys admin | API |
| **Manage global users** | Changing user password or other information | sys admin | API |
| **Manage global users** | List all roles for user | sys admin | API |
| **\***While only the sys admin can create the user, an organization administrator can trigger the workflow by adding a new user to an organization in the Edge management UI. ||||
| **Manage sys admin roles** | List sys admin roles | sys admin | API |
| **Manage sys admin roles** | Add user to sys admin role | sys admin | API |
| **Manage sys admin roles** | List users in sys admin role | sys admin | API |
| **Manage sys admin roles** | Remove user from sys admin role | sys admin | API |
| **Manage organization roles** | [List Roles of Organization](https://docs.apigee.com/management/apis/get/organizations/{org_name}/userroles) | sys admin org admin | API/UI |
| **Manage organization roles** | [Add a user to a role](https://docs.apigee.com/management/apis/post/organizations/{org_name}/userroles/{role_name}/users-0) | sys admin org admin | API/UI |
| **Manage organization roles** | [Get users for a role](https://docs.apigee.com/management/apis/get/organizations/{org_name}/userroles/{role_name}/users) | sys admin org admin | API/UI |
| **Manage organization roles** | List users in an organization**\*\*** | sys admin org admin | UI |
| **Manage organization roles** | [Remove user membership in role](https://docs.apigee.com/management/apis/delete/organizations/{org_name}/userroles/{role_name}/users/{user_email}) | sys admin org admin | API/UI |
| **Manage organization roles** | For additional operations, see [User roles](https://docs.apigee.com/api/user-roles) | sys admin org admin | API/UI |
| **\*\*** There is no single API call that lists all users in an organization. Instead, you make one call to get all roles in the organization. Then you iterate through the list of roles to get all users in each role. ||||