Create an end-user

POST https://rest.haasapi.com/v1/partner/users

Provisions a white-label end-user - an exchange account you own, addressed by an opaque user_id. For a real account the api_key/api_secret are VALIDATED against the exchange before anything is created; keys the exchange rejects answer 422. For a paper account set simulated: true and omit the credentials. Answers 201 with the created end-user (the same shape the reads serve). The credentials are write-only - no read ever returns them.

Requires the partner scope.

Request body

{
  "exchange": "BINANCE",
  "external_id": "customer-4471",
  "simulated": false,
  "api_key": "AKIAEXAMPLEKEY0001",
  "api_secret": "exampleSecretDoNotUse",
  "api_passphrase": null
}

CreatePartnerUserRequest

Field	Type	Description
`exchange`	string	Exchange code the end-user’s account trades on (e.g. BINANCE). Must be one the partner is enabled for.
`external_id`	string, nullable	Your own reference for this end-user (stored and echoed back on reads). Optional; not required to be unique.
`simulated`	boolean	Provision a paper (simulated) account with no real exchange keys. Defaults to false.
`api_key`	string, nullable	Exchange API key. Required unless `simulated` is true. Write-only - never returned.
`api_secret`	string, nullable	Exchange API secret. Required unless `simulated` is true. Write-only - never returned.
`api_passphrase`	string, nullable	Exchange API passphrase/extra key, where the exchange requires one (e.g. KuCoin). Write-only - never returned.

Example request

curl "https://rest.haasapi.com/v1/partner/users" \
  -X POST \
  -H "Authorization: Bearer hk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"exchange":"BINANCE","external_id":"customer-4471","simulated":false,"api_key":"AKIAEXAMPLEKEY0001","api_secret":"exampleSecretDoNotUse","api_passphrase":null}'

Response

201 Created. Returns a PartnerUser.

{
  "user_id": "8f14e45f-ceea-467a-9c9a-2b0f1d6a3c77",
  "exchange": "BINANCE",
  "external_id": "customer-4471",
  "created_at": "2026-08-28T19:04:11Z",
  "bots_started": 12,
  "bots_active": 3,
  "backtests": 40
}

Fields

PartnerUser

Field	Type	Description
`user_id`	string	The end-user identifier - the id every /v1/partner/users/{user_id} path takes. Copy it from this endpoint; never construct one.
`exchange`	string	Exchange code the end-user’s account trades on.
`external_id`	string, nullable	Your own reference for this end-user, if you set one when provisioning it. null otherwise.
`created_at`	string	When the end-user was provisioned. RFC 3339 UTC.
`bots_started`	integer (int32)	Total bots ever started for this end-user.
`bots_active`	integer (int32)	Bots currently running for this end-user.
`backtests`	integer (int32)	Total backtests run for this end-user.

Errors

All errors are RFC 9457 problem documents.

Status	Description
`400`	The request is malformed (invalid limit, unusable cursor, …). (`code: invalid_request`) exchange is required; api_key and api_secret are required unless simulated is true. (`code: invalid_request`)
`401`	Missing, malformed, disabled, or revoked API key. (`code: invalid_api_key`)
`409`	The exchange is not enabled for your partner account. (`code: exchange_not_enabled`) A request with this Idempotency-Key is still being processed. (`code: idempotency_in_progress`)
`422`	The exchange rejected the supplied API keys. (`code: invalid_api_credentials`) The Idempotency-Key was already used with a different request. (`code: idempotency_key_reuse`)
`500`	An unexpected error inside the API. Nothing about the request caused it; retry, and quote the instance value if it persists. (`code: internal_error`)
`502`	An internal service answered in a way the API could not serve. Retry. (`code: upstream_error`)
`503`	The request could not be served right now. Retry with the same key - do not discard it. (`code: temporarily_unavailable`)
`504`	An internal service did not answer within the deadline. Retry with backoff. (`code: upstream_timeout`)

{
  "type": "https://docs.haasapi.com/errors/invalid_request",
  "title": "Invalid request",
  "status": 400,
  "detail": "The request is malformed (invalid limit, unusable cursor, …).",
  "code": "invalid_request"
}