Error "Forbidden attribute in app_metadata: username" when Creating a User via API Call

Knowledge Articles
,
1

Overview

When creating a user via Management API call and sending this profile:

{

"email": "someuser@somemail.com",

"user_id": "xyz123",

"username": "someusername",

"given_name": "Some",

"family_name": "Name",

"name": "Some Name",

"password": "P@ssw0RdH@r@",

"app_metadata":

{

"foo": "bar",

"username": "someOtherName"

}

}

the request fails with:

“message”: “Forbidden attribute in app_metadata: username”,

However, the attribute name “username” is not listed among the documented restrictions.

This article details why this error is encountered.

Applies To

  • User profile
  • User schema
  • app_metadata

Cause

The app_metadata field is merged onto the root profile in both Rules and Actions, which may override root profile fields.

Solution

Avoid using the same name for app_metadata fields and root profile fields.

Related References