Person Create

BOSS or a tenant administrator creates a person directly inside one active tenant. person_type defaults to customer; staff is accepted only from a platform-level caller (a product-level caller gets ACCESS_DENIED) and only into the platform tenant (any other tenant returns IDENTITY_STATE_INVALID); a staff member's role_id may be a Control role or a product role in the platform tenant. The person, every supplied address (stored unverified), the tenant membership and the optional role assignment commit in one transaction. Nothing is sent: login starts with a following credential.issue of purpose initial_login, which may reach an unverified address. An address that already belongs to any person returns CHANNEL_IDENTITY_BOUND and creates nothing; use membership.create to add an existing person to another tenant. Assigning a role requires the caller to also hold control.role_assignment.assign. project_id is only given together with a project-scoped role_id. Replay of the same request_ref returns the original identifiers.

POST /internal/control/v1/people