It depends on where the users live:
- Internal BPM users (the built-in file registry / tw_admin style users) can be created with the Process Admin console and, on BPM 8.5.7 / BAW, with the JavaScript API from a service: IBM never published a create-user REST API for the internal registry. What exists is attribute and preference management: PUT /rest/bpm/wle/v1/user/{name}?action=setPreference&key=...&value=... and ?action=update for e-mail / full name.
- LDAP / federated repository users (every real installation): create them in the LDAP (or in WebSphere's federated repository with the wsadmin AdminTask.createUser command, which has a REST-like scripting front end) and then make BPM see them: GET /rest/bpm/wle/v1/user/{name}?refreshUser=true or the Operations REST POST /ops/system/users_sync (BAW 20+). New users are also synchronised automatically the first time they log in.
- On CP4BA: users come from the LDAP configured in the IAM / Zen layer; onboarding to a Workflow role is done in the Zen "Access control" UI or its API (POST /usermgmt/v1/user of the Zen platform for service users, ZenApiKey authentication).
# wsadmin (Jython): create a user in the federated repository, then let BPM pick it up
AdminTask.createUser('[-uid jdoe -password Passw0rd -cn John -sn Doe -mail jdoe@example.com]')
AdminConfig.save()
# BPM side
curl -u admin:pw "https://host:9443/rest/bpm/wle/v1/user/jdoe?refreshUser=true"
curl -u admin:pw -X POST -H "BPMCSRFToken: $TOKEN" "https://host:9443/ops/system/users_sync" -d '{"user_names":["jdoe"]}'Group membership for internal groups can be changed by REST: POST /rest/bpm/wle/v1/group/{group}?action=addMember&user=jdoe.
References