# Create a sub-account (/docs/api-reference/sub-accounts/create-subaccount)

Creates a sub-account: one of your users, who gets their own domains, suppressions, quotas and reputation. Give it a `uid` (e.g. your user's id) to address it by in every path and send. Sub-accounts belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox ones, a `coss_live_…` key only production ones.

`POST https://api.coss.com/v1/subaccounts`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Request body

- `name` (string, required, 1-256 characters): A name for your own reference.
- `uid` (string): Your own id for it, to address it by instead of its `id`.
- `metadata` (map of string): Your own key-value pairs (at most 16; keys up to 40 characters, values up to 500).
- `quotas` (object): Fields left out keep their value; `null` removes a quota.
  - `recipients_per_day` (integer | null, 1-100000000)
  - `recipients_per_second` (integer | null, 1-100000000)
  - `burst` (integer | null, 1-100000000)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.email.subaccounts.create({
  name: "Acme Bakery",
  uid: "user_8812",
  quotas: {
    recipients_per_day: 5000,
  },
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/subaccounts" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Acme Bakery",
  "uid": "user_8812",
  "quotas": {
    "recipients_per_day": 5000
  }
}'
```

Python:

```python
from coss import Coss
from coss.email.subaccounts import CreateSubaccountRequestQuotas

client = Coss()  # api_key= or COSS_API_KEY

client.email.subaccounts.create(
    name="Acme Bakery",
    uid="user_8812",
    quotas=CreateSubaccountRequestQuotas(
        recipients_per_day=5000,
    ),
)
```

Go:

```go
import (
	"context"

	coss "github.com/cosscom/coss-go"
	cossclient "github.com/cosscom/coss-go/client"
	email "github.com/cosscom/coss-go/email"
)

client := cossclient.NewClient() // option.WithAPIKey(…) or COSS_API_KEY

request := &email.CreateSubaccountRequest{
    Name: "Acme Bakery",
    UID: coss.String(
        "user_8812",
    ),
    Quotas: &email.CreateSubaccountRequestQuotas{
        RecipientsPerDay: coss.Int(
            5000,
        ),
    },
}
client.Email.Subaccounts.Create(
    context.TODO(),
    request,
)
```

Ruby:

```ruby
require "coss"

client = Coss::Client.new # api_key: or COSS_API_KEY

client.email.subaccounts.create(
  name: "Acme Bakery",
  uid: "user_8812",
  quotas: {
    recipients_per_day: 5000
  }
)
```

PHP:

```php
<?php

use Coss\Coss;
use Coss\Email\Subaccounts\Requests\CreateSubaccountRequest;
use Coss\Email\Subaccounts\Types\CreateSubaccountRequestQuotas;

$client = new Coss(); // apiKey: or COSS_API_KEY

$client->email->subaccounts->create(
    new CreateSubaccountRequest([
        'name' => 'Acme Bakery',
        'uid' => 'user_8812',
        'quotas' => new CreateSubaccountRequestQuotas([
            'recipientsPerDay' => 5000,
        ]),
    ]),
);
```

Java:

```java
import com.coss.Coss;
import com.coss.resources.email.subaccounts.requests.CreateSubaccountRequest;
import com.coss.resources.email.subaccounts.types.CreateSubaccountRequestQuotas;

Coss client = Coss.builder().build(); // .apiKey(…) or COSS_API_KEY

client.email().subaccounts().create(
    CreateSubaccountRequest
        .builder()
        .name("Acme Bakery")
        .uid("user_8812")
        .quotas(
            CreateSubaccountRequestQuotas
                .builder()
                .recipientsPerDay(
                    OptionalNullable.of(5000)
                )
                .build()
        )
        .build()
);
```

.NET:

```csharp
using Coss;
using Coss.Email;

var client = new CossClient(); // apiKey: or COSS_API_KEY

await client.Email.Subaccounts.CreateAsync(
    new CreateSubaccountRequest
    {
        Name = "Acme Bakery",
        Uid = "user_8812",
        Quotas = new CreateSubaccountRequestQuotas { RecipientsPerDay = 5000 },
    }
);
```

## Response 200

The sub-account.

- `object` ("subaccount", required)
- `id` (string, required)
- `uid` (string | null, required): Your own id for it (e.g. your user's id), unique in the environment. Every path and send that takes a sub-account accepts its `id` or its `uid`.
- `name` (string, required)
- `metadata` (map of string, required)
- `status` ("active" | "disabled" | "deleting", required): `disabled`: you turned it off (its sends are refused). `deleting`: its domains are being released.
- `quotas` (object, required)
  - `recipients_per_day` (integer | null, required, 1-100000000): Recipients it may send to per day; `null`: only your organization's quota.
  - `recipients_per_second` (integer | null, required, 1-100000000): Recipients it may send to per second; `null`: only your organization's quota.
  - `burst` (integer | null, required, 1-100000000): How many recipients a moment may take before the per-second rate applies; `null`: the per-second rate.
- `reputation` (object, required)
  - `status` ("good" | "warning" | "paused", required): `warning`: a rate is close to its limit. `paused`: its live sends are refused (`subaccount_paused`) until you reinstate it.
  - `trigger` (string | null, required): What last changed it, e.g. `bounce_rate`, `complaint_rate`, `content_screening`.
  - `changed_at` (string | null, required, date-time)
  - `reinstated_at` (string | null, required, date-time)
- `created_at` (string, required, date-time)
- `updated_at` (string, required, date-time)

Example:

```json
{
  "object": "subaccount",
  "id": "sub_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "uid": "user_8812",
  "name": "Acme Bakery",
  "metadata": {
    "plan": "pro"
  },
  "status": "active",
  "quotas": {
    "recipients_per_day": 5000,
    "recipients_per_second": 5,
    "burst": 50
  },
  "reputation": {
    "status": "good",
    "trigger": null,
    "changed_at": null,
    "reinstated_at": null
  },
  "created_at": "2026-01-15T09:30:00.000Z",
  "updated_at": "2026-01-15T09:30:00.000Z"
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `402`: Live sub-accounts need a plan with sub-accounts (`plan_feature_unavailable`), up to its limit (`plan_limit_reached`). (`billing_error`). Never retried: it needs a plan change or a payment.
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `413`: The request body is larger than 5 MB (`payload_too_large`).
- `415`: The body is not sent as `application/json` (`unsupported_media_type`).
- `422`: The body failed validation (`validation_error`), the `uid` is taken (`uid_taken`), the quotas don't fit together (`invalid_quotas`), or the sandbox environment has the most sub-accounts it can (100: `too_many_subaccounts`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).