[HELP] Can anyone explain how to use this API -- I've already read everything and still don't understand

I spent three hours reading every single page of documentation, scouring the forum for examples, and parsing through two years worth of GitHub issues just to find out that your "simple

okay so i am literally staring at the auth endpoint right now and every doc says 'get your api key from the dashboard' which is fine but then it shows a code sample with this bearer token thing that looks nothing like my key and also does anyone actually know if you call this in one request or do you have to make two calls first? because i tried both and got 403 on everything. sorry for asking such a basic question im genuinely lost

Okay, let me try to unpack this because honestly even reading through all of it a couple times I had to stop and sketch things out on paper before any of it clicked for myself -- which is probably fair warning that you're not alone in the confusion, but if you can bear with me I want to walk through it step by step since it helps immensely once you see how all the layers stack.

First thing worth establishing -- because this gets glossed over in almost every reference document and then everyone wonders why their calls are failing silently or returning 403s they didn't expect -- is that the API does not actually have one single endpoint for a 'create user' operation. The concept of creating a user is decomposed into three distinct operations each with its own authentication context, which I know sounds like overkill but there's a specific architectural reason and understanding it will save you hours of debugging later.

The first layer is the Identity Provider (IDP) registration -- this is where the core credential object lives. You POST to /v1/identity/register with a payload containing an email, hashed password, and optional MFA flags. The response gives you an identity_id which is internally 64 characters of SHA256 hash but externally looks like a UUID for readability purposes. Crucial detail: this operation requires the 'ADMIN' scope on your bearer token, not 'WRITE'. I see people try to use their regular user tokens here and then wonder why they keep getting rejected with code E-1094 -- that is specifically an insufficient privilege error wrapped in a generic 403.

Second layer is the Resource Profile link -- this is where most of your confusion probably comes from because it's not mentioned as part of 'creating a user.' The identity_id you got back doesn't actually have any permissions, profile fields, or anything useful attached to it yet. You need to make a separate POST to /v1/

That endpoint is weirdly documented. You gotta pass auth in a custom header, not as a