# Create API user

**URL:** <https://community.fireblocks.com/t/create-api-user/826>\
**Category:** Support\
**Created:** [March 24, 2024, 11:52am UTC](https://community.fireblocks.com/t/create-api-user/826 "2024-03-24T11:52:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![drhanlondon](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@drhanlondon](https://community.fireblocks.com/u/drhanlondon)\
**Post date:** [March 24, 2024, 11:52am UTC](https://community.fireblocks.com/t/create-api-user/826/1 "2024-03-24T11:52:10Z")

</div>

Hello support team,

I am now using Developer Sandbox.

I have a question about [Creates an API user (Beta)](https://developers.fireblocks.com/reference/post_management-api-users)

data: {  
role: ‘string’,  
name: ‘string’,  
csrPem: ‘string’,  
coSignerSetupType: ‘string’,  
coSignerSetupIsFirstUser: true  
}

Questions:

1. what “role” is available in sandbox? it may be either VIEWER, NON\_SIGNING\_ADMIN, EDITOR, NON\_CUSTODIAL\_WALLET\_ADMIN, or NON\_CUSTODIAL\_WALLET\_SIGNER

2. what information do I need to provide for “csrPem”?  
By using CLI, I created csr file  
$openssl req -new -newkey rsa:4096 -nodes -keyout fireblocks\_secret.key -out fireblocks.csr -subj “/CN=My Fireblocks Certificate”

Do I have to copy and paste below ?  
-----BEGIN CERTIFICATE REQUEST-----  
MIIEaTCCAlECAQAwJDEiMCAGA1UEAwwZTXkgRmlyZWJsb2NrcyBDZXJ0aWZpY2F0  
ZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOU+add/a3QEahAAdFff  
HJOx90dgGBvwYnmR5TxOxbdJ3UZASQOniLb4pAF0jEHOpJXLDSL4asHRXdcsRS+I  
var6cQuZF6KFK3/75u1zDoxQK6v/CkbQnEnS3PHQmC6roO+QSFVR8RFSl8F0rTBp  
l0AraFjQTZYsfftGlnmtksLGw+l5lYUUA5P5xt11Pd72zy0iB1jqfnjcTXR/Z9dQ  
GP5fQr8jzXDArAal12AVtfVc075xmHcMc8UJ84PF4I5TO4cweb3DRcHYAoqiiQTf  
KO1QvqCiHe48OXm+8wKWtvnS0/5EUmCeFdcv5H+mVS5lSMfidzPFZiJDH3T7/tyi  
V/ZeHslpLCsXWUh0idV8KlxiFFLN5S+HH+OYaHE3aBlbfhBNMU59oRVDyMLdsx9g  
mAMKVV6KaXomPfZF0V2bAT3qUjVbTodK6JaSPSm0X7Ug2XoTl9/R34xgncOY0nQw  
DncLNxvkUHj41fGs94hS8Tj4tGjszQU/IVTv0KZF6fa6UC2UwL+ksdQEpCfnG032  
aK7nL5DDRgL9fI92Jux0hLc7m+uu8MLrCQWBCHpWKehiG+2DvKF+w94cDNtl1jYw  
ymPN9MmteYVxPSxB6XNdSZJqNrZ9yVQraGJ2MXuXVwEhGksPS2DqGFJ29A5koO21  
gNE2yB6twaTEl0zzFM5/KPOrAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAgEAYwSd  
5kUHy6JpJ2ZcFg7AUI6jXlrIwLfETmy6p8DPvJPwLRcKDF90GJdb+9Ig8RnWIwFf  
R/fjPF9NVE1eVVatIdWKKqIP94iXT5gLo+f/ZXY1m/vRAlBWFFbUGI3ILn/6Qz9v  
iLOebC6lACRsFNsIMi22UIhCVVtWmCpLtr5W8iYkQbmh4ySczoPRJzPCKUtqNFt2  
CKe/RB5TkuoBszQq/SBFtCWN/xEgcHhP7Yij5jEKbZGQyPbTPAAzoma+ohZuf4KY  
Z10saGXRVHPrmUnJqHg/bBleji6/xdqztdDF1U+anNrYWwmnWyKaYbxa62DhLPpo  
1v/6EUOWPMbgxpqagaCAmiuZ7162eVTuKdqEsekStvvlvaNdhhlbwSlGR10BK97U  
aBQUWpIWYghU7m9fEdoP3GF6KrnG8UsDUzoCUzocav1xUWTv7P3p9cNoND0s02zx  
aZnLY7WvcO0oyJsFuzLjVmhqf385LldQLvWZ657XtQ8IUVD0cWUq/+qLbMZL/CLG  
9iIDImlAF2ZoHcZMyw4qAhsJC5Q7uBgZjRj4gs+A12AuqsFtZbTlgTl+3SH/yyP5  
Ted6AuyqFC2cMWvkwJt/Fu2zjMuSyJzP1+XacHBExlMy99Kd0DRLblHhz6a4GJZB  
HhqBaUNn25yG90rWPVeDgnJILebSKIzHBJ27Ijw=  
-----END CERTIFICATE REQUEST-----

1. what options are available for “coSignerSetupType” ?

Thanks for your help  
S Han

---

<div class="post-metadata">

**Author:** ![SlavaSereb](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@SlavaSereb](https://community.fireblocks.com/u/SlavaSereb)\
**Post date:** [March 24, 2024, 3:24pm UTC](https://community.fireblocks.com/t/create-api-user/826/2 "2024-03-24T15:24:21Z")

</div>

Hey @drhanlondon

1. You can find the available roles for Sandbox over here:  
[Quickstart Guide](https://developers.fireblocks.com/docs/quickstart#creating-an-api-user)

2. Yes that’s what you need to copy/paste

3. The available options are:  
a.`FIREBLOCKS_CCMT` - available for testnet workspaces only  
b.`SGX_MACHINE` - for setting up your own co-signer instance  
Kindly note that `coSignerSetupType` is required in Production workspaces only as Sandbox workspaces are automatically paired with our test in-house co-signer.

Having said all the above, since this endpoint is currently in Beta - it is not available in Sandbox environments hence you won’t be able to use it and would need to create API users manually via the Console.