# User creation via API is a mess!
**URL:** https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053
**Category:** Support
**Tags:** rest-api
**Created:** [January 14, 2025, 12:52pm UTC](https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053 "2025-01-14T12:52:12Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Nikki\_Locke](https://meta.discourse.org/u/Nikki_Locke)
#### Post date: [January 14, 2025, 12:52pm UTC](https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053/1 "2025-01-14T12:52:12Z")
Recent changes to default settings have completely messed up user creation.
1. normalize\_emails setting is on by default, which means it is no longer possible to create a user with a + address (e.g. [nikki+testuser@example.com](mailto:nikki+testuser@example.com)).
2. hide\_email\_address\_taken is on by default, which means it is no longer possible to determine the user id from the return of the create user API call.
3. The create user API call returns success even if the specified user already exists, or the email address is duplicate (so the user didn’t get created)
4. The create user API call lies about whether the user is active or not (the active flag does not agree with the message)
5. The Get User By Email call no longer works (admin/users/list/all with email=the user’s email). It returns null for an address containing +, even if normalize\_emails and hide\_email\_address\_taken are both off
Can this be fixed so it works consistently and correctly, please?
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [January 14, 2025, 1:07pm UTC](https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053/2 "2025-01-14T13:07:42Z")
For the record, some of those were discussed here:
> [@User creation API: ‘active’ attribute set to True but returns False in response](https://meta.discourse.org/t/user-creation-api-active-attribute-set-to-true-but-returns-false-in-response/344908/10):
>
> Yes, it seems that the reason for the failure was the flag normalize\_email:true it’s true by default. As I turned it off the users got created… However, the API is not considering the normalize\_emails flag and is returning success eventhough the user never got created or activated for that matter confused Should I report this in discourse github ?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 14, 2025, 2:53pm UTC](https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053/3 "2025-01-14T14:53:37Z")
> [@Nikki\_Locke](#):
>
> normalize\_emails setting is on by default
So change it back?
> [@Nikki\_Locke](#):
>
> hide\_email\_address\_taken is on by default,
So change it back.
> [@Nikki\_Locke](#):
>
> The create user API call returns success even if the specified user already exists
That’s the problem with security; it inconveniences mostly the Good People.
> [@Nikki\_Locke](#):
>
> The Get User By Email call no longer works (admin/users/list/all with email=the user’s email). It returns null for an address containing +, even if normalize\_emails and hide\_email\_address\_taken are both off
That (and maybe number 4) sounds like a bug, regression, or unexpected edge case.
---
### Author:  [@Nikki\_Locke](https://meta.discourse.org/u/Nikki_Locke)
#### Post date: [April 14, 2025, 11:27am UTC](https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053/4 "2025-04-14T11:27:55Z")
Thanks, but how do I find out if someone is looking at these bugs?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 14, 2025, 11:32am UTC](https://meta.discourse.org/t/user-creation-via-api-is-a-mess/347053/5 "2025-04-14T11:32:02Z")
The only one that is likely to be a bug is the lookup. That feature works in the front end, though, so it’s also unlikely that it’s a bug.
For someone to treat anything as a big it’ll need to be documented as such.