Create child tenant service account

POST 
/mt/config/v1/user

Provisions an IAM service account for the authenticated child tenant and assigns the msp_superuser role. The call is idempotent - if a service account already exists for this tenant, it returns the existing record.

The caller's TSG ID is resolved from the Bearer token; no request body or query parameters are required.

Responses

201

Service account created or already exists

401

Authentication credentials are missing or invalid

500

Internal error (service account list / create / role-assign failed)