---
title: "Create subaccount"
source_url: https://dev.digicert.com/certcentral-apis/services-api/subaccount/create-subaccount.html
api_method: POST
api_endpoint: "/services/v2/account"
api_url: "https://www.digicert.com/services/v2/account"
---

**POST** `https://www.digicert.com/services/v2/account`

Use this endpoint to create a new subaccount.

**Items to note**

If subaccounts have not been enabled by your account representative, you will receive `access_denied|missing_permission` error.


> **Warning**
>
> When creating a managed account, the API key is shown only this one time in the `api_key` parameter of the response body. It will never be shown again. If it is lost, you must contact support at <a href="https://www.digicert.com/contact-us/" target="_blank" rel="noopener noreferrer">https://www.digicert.com/contact-us/</a> to get a new one.


## Example requests and responses

**cURL**

```bash
curl -X POST \
  https://www.digicert.com/services/v2/account \
  -H 'Content-Type: application/json' \
  -H 'X-DC-DEVKEY: {{api_key}}' \
  -d '{
  "account_type": "retail",
  "allowed_grandchildren": [
    "retail",
    "enterprise",
    "reseller"
  ],
  "account_manager_user_id": 12345,
  "user": {
    "first_name": "John",
    "last_name": "Smith",
    "email": "john.smith@example.com",
    "username": "john.smith@example.com",
    "job_title": "Statistician",
    "telephone": "111-222-333-4444",
    "disable_renewal_notifications": true
  },
  "organization": {
    "name": "Example Company, LLC",
    "address": "123 Fake Street",
    "address2": "Suite 321",
    "zip": "93090",
    "city": "Toledo",
    "state": "Ohio",
    "country": "US",
    "telephone": "111-222-333-4445"
  }
}'
```

**Python**

```python
import requests

url = "https://www.digicert.com/services/v2/account"

payload = "{\n  \"account_type\": \"retail\",\n  \"allowed_grandchildren\": [\n    \"retail\",\n    \"enterprise\",\n    \"reseller\"\n  ],\n  \"account_manager_user_id\": 12345,\n  \"user\": {\n    \"first_name\": \"John\",\n    \"last_name\": \"Smith\",\n    \"email\": \"john.smith@example.com\",\n    \"username\": \"john.smith@example.com\",\n    \"job_title\": \"Statistician\",\n    \"telephone\": \"111-222-333-4444\"\n  },\n  \"organization\": {\n    \"name\": \"Example Company, LLC\",\n    \"address\": \"123 Fake Street\",\n    \"address2\": \"Suite 321\",\n    \"zip\": \"93090\",\n    \"city\": \"Toledo\",\n    \"state\": \"Ohio\",\n    \"country\": \"US\",\n    \"telephone\": \"111-222-333-4445\"\n  }\n}"
headers = {
    'X-DC-DEVKEY': "{{api_key}}",
    'Content-Type': "application/json"
    }

response = requests.request("POST", url, data=payload, headers=headers)

print(response.text)
```

**Go**

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io/ioutil"
)

func main() {

	url := "https://www.digicert.com/services/v2/account"

	payload := strings.NewReader("{\n  \"account_type\": \"retail\",\n  \"allowed_grandchildren\": [\n    \"retail\",\n    \"enterprise\",\n    \"reseller\"\n  ],\n  \"account_manager_user_id\": 12345,\n  \"user\": {\n    \"first_name\": \"John\",\n    \"last_name\": \"Smith\",\n    \"email\": \"john.smith@example.com\",\n    \"username\": \"john.smith@example.com\",\n    \"job_title\": \"Statistician\",\n    \"telephone\": \"111-222-333-4444\"\n  },\n  \"organization\": {\n    \"name\": \"Example Company, LLC\",\n    \"address\": \"123 Fake Street\",\n    \"address2\": \"Suite 321\",\n    \"zip\": \"93090\",\n    \"city\": \"Toledo\",\n    \"state\": \"Ohio\",\n    \"country\": \"US\",\n    \"telephone\": \"111-222-333-4445\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-DC-DEVKEY", "{{api_key}}")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := ioutil.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

**NodeJS**

```javascript
var request = require("request");

var options = { method: 'POST',
  url: 'https://www.digicert.com/services/v2/account',
  headers: 
   { 'Content-Type': 'application/json',
     'X-DC-DEVKEY': '{{api_key}}' },
  body: 
   { account_type: 'retail',
     allowed_grandchildren: [ 'retail', 'enterprise', 'reseller' ],
     account_manager_user_id: 12345,
     user: 
      { first_name: 'John',
        last_name: 'Smith',
        email: 'john.smith@example.com',
        username: 'john.smith@example.com',
        job_title: 'Statistician',
        telephone: '111-222-333-4444' },
     organization: 
      { name: 'Example Company, LLC',
        address: '123 Fake Street',
        address2: 'Suite 321',
        zip: '93090',
        city: 'Toledo',
        state: 'Ohio',
        country: 'US',
        telephone: '111-222-333-4445' } },
  json: true };

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(body);
});
```


**201 Created**

```json
{
  "id": 1122334,
  "account_type": "retail",
  "account_manager_user_id": 12345,
  "organization": {
    "id": 3344556,
    "status": "active",
    "name": "Example Company, LLC",
    "display_name": "Example Company, LLC",
    "is_active": true,
    "address": "123 Fake Street",
    "zip": "93090",
    "city": "Toledo",
    "state": "Ohio",
    "country": "us",
    "telephone": "111-222-333-4445",
    "container": {
      "id": 112234,
      "parent_id": 0,
      "name": "Example Company, LLC",
      "is_active": true
    }
  },
  "user": {
    "id": 45321,
    "username": "john.smith@example.com",
    "account_id": 12121,
    "first_name": "John",
    "last_name": "Smith",
    "email": "john.smith@example.com",
    "job_title": "Statistician",
    "telephone": "111-222-333-4444",
    "type": "standard"
  }
}
```

**201 Created (Managed subaccount)**

```
{
  "id": 1122334,
  "account_type": "managed",
  "account_manager_user_id": 12345,
  "organization": {
    "id": 3344556,
    "status": "active",
    "name": "Example Company, LLC",
    "display_name": "Example Company, LLC",
    "is_active": true,
    "address": "123 Fake Street",
    "zip": "93090",
    "city": "Toledo",
    "state": "Ohio",
    "country": "us",
    "telephone": "111-222-333-4445",
    "container": {
      "id": 112234,
      "parent_id": 0,
      "name": "Example Company, LLC",
      "is_active": true
    }
  },
  "user": {
    "id": 45321,
    "username": "john.smith@example.com",
    "account_id": 12121,
    "first_name": "John",
    "last_name": "Smith",
    "email": "john.smith@example.com",
    "job_title": "Statistician",
    "telephone": "111-222-333-4444",
    "type": "standard"
  },
  "api_key": "{{api_key}}"
}
```


## Request parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>account_type</td>
<td>required</td>
<td>string</td>
<td>Specify type of subaccount to create. See <a href="https://dev.digicert.com/md/certcentral-apis/services-api/glossary.md#subaccount-types">Glossary – Subaccount types</a>.<br>Allowed values: retail, enterprise, reseller, managed</td>
</tr>
<tr>
<td>allowed_grandchildren</td>
<td>required</td>
<td>array</td>
<td>List of account types that can be created under the account. See <a href="https://dev.digicert.com/md/certcentral-apis/services-api/glossary.md#subaccount-types">Glossary – Subaccount types</a>.<br>Allowed values: retail, enterprise, reseller</td>
</tr>
<tr>
<td>account_manager_user_id</td>
<td>optional</td>
<td>integer</td>
<td>ID of an existing user that will manage the subaccount.</td>
</tr>
<tr>
<td>bill_parent</td>
<td>optional</td>
<td>boolean</td>
<td>If <code>true</code>, DigiCert bills the <em>parent</em> account (your account) for orders from the subaccount. If <code>false</code>, DigiCert bills the subaccount directly.<br>Default: false</td>
</tr>
<tr>
<td>enforce_bill_parent</td>
<td>optional</td>
<td>boolean</td>
<td>If <code>true</code>, the subaccount can only create <em>bill-to-parent</em> child accounts. If <code>false</code>, the subaccount can create subaccounts with either billing configuration: <em>bill self</em> or <em>bill-to-parent</em>.<br>Default: false<br>Note: When bill_parent is true, we ignore this parameter.</td>
</tr>
<tr>
<td>child_name</td>
<td>optional</td>
<td>string</td>
<td>Friendly name to help identify subaccounts with identical or similar names. This name is only visible to the parent account.<br>Maximum length: 64 characters</td>
</tr>
<tr>
<td>user</td>
<td>required</td>
<td>object</td>
<td>Details about the new subaccount user to create.</td>
</tr>
<tr>
<td>.. first_name</td>
<td>required</td>
<td>string</td>
<td>First name of the subaccount user.</td>
</tr>
<tr>
<td>.. last_name</td>
<td>required</td>
<td>string</td>
<td>Last name of the subaccount user.</td>
</tr>
<tr>
<td>.. email</td>
<td>required</td>
<td>string</td>
<td>Email address of the subaccount user. The account creation email will be sent to this address.</td>
</tr>
<tr>
<td>.. username</td>
<td>optional</td>
<td>string</td>
<td>Username used to sign in to the subaccount. If omitted, the email value will be used as the username.</td>
</tr>
<tr>
<td>.. job_title</td>
<td>optional</td>
<td>string</td>
<td>Job title of the subaccount user.</td>
</tr>
<tr>
<td>.. telephone</td>
<td>optional</td>
<td>string</td>
<td>Telephone number of the subaccount user.</td>
</tr>
<tr>
<td>.. disable_renewal_notifications</td>
<td>optional</td>
<td>boolean</td>
<td>Specify if this account will receive renewal notifications.<br>Default:
false</td>
</tr>
<tr>
<td>organization</td>
<td>required</td>
<td>object</td>
<td>Details about the subaccount's primary organization</td>
</tr>
<tr>
<td>.. name</td>
<td>required</td>
<td>string</td>
<td>Legal name of the organization.</td>
</tr>
<tr>
<td>.. assumed_name</td>
<td>optional</td>
<td>string</td>
<td>Public name of the organization. Also called DBA name.</td>
</tr>
<tr>
<td>.. address</td>
<td>required</td>
<td>string</td>
<td>Address of the organization.</td>
</tr>
<tr>
<td>.. address2</td>
<td>optional</td>
<td>string</td>
<td></td>
</tr>
<tr>
<td>.. zip</td>
<td>required</td>
<td>string</td>
<td>Postal code of the organization.</td>
</tr>
<tr>
<td>.. city</td>
<td>required</td>
<td>string</td>
<td>City where the organization is located.</td>
</tr>
<tr>
<td>.. state</td>
<td>required</td>
<td>string</td>
<td>State where the organization is located.</td>
</tr>
<tr>
<td>.. country</td>
<td>required</td>
<td>string</td>
<td>Country where the organization is located.</td>
</tr>
<tr>
<td>.. telephone</td>
<td>optional</td>
<td>string</td>
<td>Organization telephone number.</td>
</tr>
<tr>
<td>max_allowed_multi_year_plan_length</td>
<td>optional</td>
<td>integer</td>
<td>Maximum Multi-year Plan length for orders the subaccount creates.<br>Range: 1-3 years. Cannot exceed the maximum Multi-year Plan length of the parent account.<br>Default: If not provided, the subaccount inherits the maximum length from the parent account.<br>* Note: Enterprise License Agreement (ELA) and Flat Fee contracts only support 1- and 2-year Multi-year Plans. When you provide a value greater than the length allowed for your account, we return an error.</td>
</tr>
<tr>
<td>allow_parent_order_renewal</td>
<td>optional</td>
<td>boolean</td>
<td>If <code>true</code>, subaccount can renew orders created by the parent account.<br>Default:
false</td>
</tr>
<tr>
<td>enable_ica_selection</td>
<td>optional</td>
<td>boolean</td>
<td>If <code>true</code>, intermediate CA selection is enabled for the subaccount.<br>Default:
false<br><a href="https://docs.digicert.com/en/certcentral/manage-certificates/ica-certificate-chain-selection-feature-for-public-tls-certificates/configure-the-ica-certificate-chain-feature-for-your-public-tls-certificates.html" target="_blank" rel="noopener noreferrer">Learn more about configuring the ICA certificate chain feature for your public certificates</a>.</td>
</tr>
<tr>
<td>custom_order_validity</td>
<td>optional</td>
<td>string</td>
<td>Set to <code>1</code> to enable custom order validity or <code>0</code> to disable it. If enabled, you can specify a custom validity period for orders. If disabled, the default validity options will be available.<br>Default:0</td>
</tr>
</tbody>
</table>

## Response parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>id</td>
<td>integer</td>
<td>Account ID of the subaccount.</td>
</tr>
<tr>
<td>account_type</td>
<td>string</td>
<td>Account type of the subaccount.</td>
</tr>
<tr>
<td>account_manager_user_id</td>
<td>integer</td>
<td>User ID of the subaccount manager.</td>
</tr>
<tr>
<td>bill_parent</td>
<td>boolean</td>
<td>Specifies if parent account is billed for certificate orders.</td>
</tr>
<tr>
<td>organization</td>
<td>object</td>
<td>Details about the subaccount's primary organization.</td>
</tr>
<tr>
<td>.. id</td>
<td>integer</td>
<td>Organization ID.</td>
</tr>
<tr>
<td>.. status</td>
<td>string</td>
<td>Organization status.<br>Possible values: active, inactive</td>
</tr>
<tr>
<td>.. name</td>
<td>string</td>
<td>Legal name of the organization.</td>
</tr>
<tr>
<td>.. assumed_name</td>
<td>string</td>
<td>Public name of the organization. Also called DBA name.</td>
</tr>
<tr>
<td>.. display_name</td>
<td>string</td>
<td>Full name of the organization. Constructed using name + assumed_name.</td>
</tr>
<tr>
<td>.. is_active</td>
<td>boolean</td>
<td>Active status of the organization.</td>
</tr>
<tr>
<td>.. address</td>
<td>string</td>
<td>Address of the organization.</td>
</tr>
<tr>
<td>.. address2</td>
<td>string</td>
<td></td>
</tr>
<tr>
<td>.. zip</td>
<td>string</td>
<td>Postal code of the organization.</td>
</tr>
<tr>
<td>.. city</td>
<td>string</td>
<td>City where the organization is located.</td>
</tr>
<tr>
<td>.. state</td>
<td>string</td>
<td>State where the organization is located.</td>
</tr>
<tr>
<td>.. country</td>
<td>string</td>
<td>Country where the organization is located.</td>
</tr>
<tr>
<td>.. telephone</td>
<td>string</td>
<td>Organization telephone number.</td>
</tr>
<tr>
<td>.. container</td>
<td>object</td>
<td>Primary container the organization is attached to.</td>
</tr>
<tr>
<td>.. .. id</td>
<td>integer</td>
<td>Container ID.</td>
</tr>
<tr>
<td>.. .. parent_id</td>
<td>integer</td>
<td>ID of the container's parent.</td>
</tr>
<tr>
<td>.. .. name</td>
<td>string</td>
<td>Name of the container.</td>
</tr>
<tr>
<td>.. .. is_active</td>
<td>boolean</td>
<td>Active status of the organization.</td>
</tr>
<tr>
<td>user</td>
<td>object</td>
<td>Details about the new subaccount user.</td>
</tr>
<tr>
<td>.. id</td>
<td>integer</td>
<td>User ID.</td>
</tr>
<tr>
<td>.. username</td>
<td>string</td>
<td>Username used to sign in to the subaccount.</td>
</tr>
<tr>
<td>.. account_id</td>
<td>integer</td>
<td>Account ID of the new subaccount.</td>
</tr>
<tr>
<td>.. first_name</td>
<td>string</td>
<td>First name of the user.</td>
</tr>
<tr>
<td>.. last_name</td>
<td>string</td>
<td>Last name of the user.</td>
</tr>
<tr>
<td>.. email</td>
<td>string</td>
<td>Email address of the user.</td>
</tr>
<tr>
<td>.. job_title</td>
<td>string</td>
<td>Job title of the user.</td>
</tr>
<tr>
<td>.. telephone</td>
<td>string</td>
<td>Telephone number of the user.</td>
</tr>
<tr>
<td>.. type</td>
<td>string</td>
<td>User type. Possible values: standard</td>
</tr>
<tr>
<td>api_key</td>
<td>string</td>
<td>Generated API key for the subaccount. Only returned if subaccount_type is managed.</td>
</tr>
<tr>
<td>child_name</td>
<td>string</td>
<td>Friendly name to help identify subaccounts with identical or similar names. Only returned if the subaccount has a child_name.</td>
</tr>
<tr>
<td>max_allowed_multi_year_plan_length</td>
<td>integer</td>
<td>Maximum Multi-year Plan length (in years) for orders the subaccount creates.</td>
</tr>
<tr>
<td>allow_parent_order_renewal</td>
<td>boolean</td>
<td>If <code>true</code>, subaccount can renew orders created by the parent account. Otherwise, <code>false</code>.</td>
</tr>
<tr>
<td>enable_ica_selection</td>
<td>boolean</td>
<td>If <code>true</code>, intermediate CA selection is enabled for the subaccount. Otherwise, <code>false</code>.</td>
</tr>
</tbody>
</table>