> ## Documentation Index > Fetch the complete documentation index at: https://nevermined.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Provision an account for the organization (member or customer) > Provisions a Nevermined identity (and Privy-managed wallet) for the given email under the caller's organization. The `as` field selects the outcome: - `member` (default): adds a seat-consuming `OrganizationMember` with the requested role (defaults to Member), starting inactive pending an email-challenge confirmation. Returns 201 when the membership was created, or 200 when the user is already a member. - `customer`: **white-label onboarding** — no seat is consumed. `role` is ignored. The behaviour depends on whether the email already has a Nevermined identity: - **new account**: recorded into the organization Customers CRM immediately (before any purchase) and the response returns a usable, scoped NVM API key (`walletResult.nvmApiKey`, 201) so the organization can transparently act for its own customer. The key is tagged to the caller's organization, so the customer's requests resolve to that workspace and their activity/purchases are attributed to it. - **existing account**: no key is issued (account-takeover guard). An email challenge is sent to the owner and the response is `202` with `walletResult.consentRequired = true`; the organization cannot obtain a credential for an account it does not own without the owner’s consent. Requires a Nevermined API key and organization admin privileges. ## OpenAPI ````yaml /api-reference/organizations-openapi.json post /organizations/account openapi: 3.0.0 info: title: Nevermined Organizations API description: >- Manage a Nevermined organization programmatically — members, tiers, groups & budgets, treasury wallets, customers, webhooks, analytics, and agent-discovery surfaces. version: 1.0.0 contact: {} servers: - url: https://api.sandbox.nevermined.app/api/v1 description: Sandbox - url: https://api.live.nevermined.app/api/v1 description: Live security: [] tags: - name: Organizations x-group: General description: Organization settings, members & roles, and workspace context. - name: Organizations - Billing x-group: Billing description: Tiers, subscriptions, invoices, checkout, and the public tier catalog. - name: Groups x-group: Groups & Budgets description: Organization groups, per-group budgets, and shared payment methods. - name: Organizations - Wallets x-group: Wallets description: Custodial stablecoin treasury wallets. - name: Organizations - Customers x-group: Customers description: The white-label customer CRM (Enterprise). - name: Organizations - Analytics x-group: Analytics description: Revenue, MRR, usage, conversion, and per-member metrics. - name: Organizations - Webhooks x-group: Webhooks description: Outbound webhook subscriptions and deliveries. - name: Organizations - Activity x-group: Activity description: The organization activity feed. - name: Organizations - Realtime x-group: Realtime description: Realtime WebSocket secret management (Enterprise). - name: Invitations x-group: Invitations description: Invite people to an organization. - name: Organizations - Integration x-group: Agent Discovery description: >- Public agent-discovery surfaces (llms.txt, agentic-instructions.md, ai-catalog.json). paths: /organizations/account: post: tags: - Organizations summary: Provision an account for the organization (member or customer) description: >- Provisions a Nevermined identity (and Privy-managed wallet) for the given email under the caller's organization. The `as` field selects the outcome: - `member` (default): adds a seat-consuming `OrganizationMember` with the requested role (defaults to Member), starting inactive pending an email-challenge confirmation. Returns 201 when the membership was created, or 200 when the user is already a member. - `customer`: **white-label onboarding** — no seat is consumed. `role` is ignored. The behaviour depends on whether the email already has a Nevermined identity: - **new account**: recorded into the organization Customers CRM immediately (before any purchase) and the response returns a usable, scoped NVM API key (`walletResult.nvmApiKey`, 201) so the organization can transparently act for its own customer. The key is tagged to the caller's organization, so the customer's requests resolve to that workspace and their activity/purchases are attributed to it. - **existing account**: no key is issued (account-takeover guard). An email challenge is sent to the owner and the response is `202` with `walletResult.consentRequired = true`; the organization cannot obtain a credential for an account it does not own without the owner’s consent. Requires a Nevermined API key and organization admin privileges. operationId: OrganizationsController_createUserByOrganization parameters: [] requestBody: required: true description: Email to provision, and the onboarding outcome (`as`). content: application/json: schema: $ref: '#/components/schemas/GenerateTokenDto' examples: member: summary: Member enrolment (default) value: email: user@example.com role: Member customer: summary: White-label customer onboarding value: email: customer@example.com as: customer responses: '200': description: >- User was already a member of the organization; returns the existing wallet info. content: application/json: schema: type: object properties: success: type: boolean example: true message: type: string example: User already a member of the organization walletResult: type: object properties: hash: type: string userId: type: string userWallet: type: string alreadyMember: type: boolean example: true '201': description: >- Account provisioned. For `as=member`: added as an inactive member. For `as=customer` with a NEW account: recorded into the Customers CRM (no seat) with a usable scoped `nvmApiKey` returned. content: application/json: schema: type: object properties: success: type: boolean example: true message: type: string example: User created and login successful walletResult: type: object properties: hash: type: string userId: type: string userWallet: type: string alreadyMember: type: boolean example: false nvmApiKey: type: string description: >- Usable, scoped NVM API key (Bearer credential). Present only for a NEW-account `as=customer`. isCustomer: type: boolean description: >- True when provisioned via the white-label customer outcome (new account). customerRecorded: type: boolean description: >- Whether the customer was written to the Customers CRM. False signals a best-effort write failed (the customer is still provisioned and keyed). '202': description: >- `as=customer` for an EXISTING account the caller does not own: no credential issued and the account's identity is deliberately NOT disclosed (opaque). An email challenge was sent to the owner; `walletResult.consentRequired = true`. Onboarding completes once the owner consents. content: application/json: schema: type: object properties: success: type: boolean example: true message: type: string walletResult: type: object properties: alreadyMember: type: boolean example: false consentRequired: type: boolean example: true '400': description: >- Validation error — e.g. BCK.ACCOUNT_PROVISIONING.0001 when `email` is missing. content: application/json: schema: $ref: '#/components/schemas/ErrorResponseDto' '403': description: Caller is not an active admin of the organization. content: application/json: schema: $ref: '#/components/schemas/ErrorResponseDto' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponseDto' security: - Authorization: [] components: schemas: GenerateTokenDto: type: object properties: {} ErrorResponseDto: type: object properties: code: type: string description: >- Error code identifier (e.g., BCK.PROTOCOL.0001, BCK.X402.0005). NOTE: any endpoint may also return a framework-level `BCK.HTTP.` code (e.g. `BCK.HTTP.400` from request validation, `BCK.HTTP.429` from throttling, `BCK.HTTP.404`) — these are emitted by the global fallback filter for HTTP errors that carry no domain-specific code. Clients must tolerate them. example: BCK.COMMON.0001 httpStatus: type: number description: HTTP status code example: 500 message: type: string description: Human-readable error message describing what went wrong example: Unable to initialize Nevermined instance details: type: string description: >- Throw-site detail string supplementing the canonical message. Only set when the call site supplied an opts.message; absent otherwise. example: Hash JWT is not signed by the node account hint: type: string description: >- Actionable remediation hint, sourced from the catalogue or supplied at the throw site. Tells the caller what to fix or where to look. example: >- Verify the wallet has sufficient balance and that the plan is active. docsUrl: type: string description: Permalink to the docs page describing this error code. example: >- https://nevermined.ai/docs/development-guide/api-errors/codes#bck-x402-0008 category: type: string description: >- Coarse classification of the failure, useful for client-side branching without parsing the message. enum: - validation - auth - business - integration - internal example: integration retryable: type: boolean description: >- Whether the failure is transient and the same call can be retried with identical inputs. Absent when the catalogue does not assert either way. example: true correlationId: type: string description: >- Request-scoped correlation id stamped by the global filter. Echoed in the x-correlation-id response header. Quote this when reporting issues. example: a3f6b1c4-7d2e-4a9b-8e0c-12f4d8e6c5b9 uuid: type: string description: >- Per-error UUID generated at construction. Useful for log correlation. example: e-550e8400-e29b-41d4-a716-446655440000 date: type: string description: ISO timestamp at which the error was constructed. example: '2026-05-09T12:34:56.789Z' format: date-time params: type: string description: >- JSON-stringified contextual parameters supplied at the throw site (e.g. IDs, state). Always a string in the wire format — parse with JSON.parse if needed. example: '{"planId":"43298432984329","reason":"Invalid configuration"}' required: - code - httpStatus - message securitySchemes: Authorization: scheme: bearer bearerFormat: JWT type: http ```` ## Related topics - [White-label Customer Onboarding](/docs/solutions/organizations/white-label-onboarding.md) - [Programmatic & Agentic Access](/docs/solutions/organizations/programmatic-access.md) - [Organizations](/docs/solutions/organizations/overview.md) - [Customers](/docs/solutions/organizations/customers.md) - [Workspaces & Members](/docs/solutions/organizations/workspaces-and-members.md)