# (NEW!) Bulk Create Security User Groups

Create multiple security user groups for the authenticated customer in a single all-or-nothing batch. Either every name in the batch is created, or none are — there is no partial success.

Business Rules:
- names must be a non-empty array of strings, maximum 50 entries per request. A batch over 50 names is rejected outright with a plain 400 ("maximum 50 user groups are allowed in a request") without itemizing individual names — this structural check runs before any per-name validation.
- Each name follows the same rules as single-create (1-255 characters after trim).
- A name repeated within the same request (case-insensitively, after trimming) is rejected — it is not silently de-duplicated.
- All entries in one batch share the same createdEpoch/createdBy (one request, one actor, one timestamp), and each gets its own id.
- There is no Location response header on this endpoint, since it creates multiple resources.

The user submitting the request must have the User Management privilege.

Endpoint: POST /security/user-groups/bulk
Version: 1.5
Security: ApiKeyAuth, BasicAuth

## Header parameters:

  - `X-API-Key` (string, required)
    Customer-specific API key required to invoke API.

  - `Authorization` (string, required)
    Provided by Authentication Token creation operation.

  - `Content-Type` (string, required)
    Enum: "application/json"

## Request fields (application/json):

  - `names` (array, required)
    Non-empty array of group names to create. Maximum 50 entries per request. Each name follows the same rules as single-create (1-255 characters after trimming). A name repeated within the same request (case-insensitively, after trimming) is rejected — it is not silently de-duplicated.
    Example: ["Hooli Corporate","Hooli EMEA","Hooli APAC"]

## Response 201 fields (application/json):

  - `created` (array)

  - `created.id` (string, required)
    Unique ID of the group. Opaque string — ids are generated as UUIDs, but this isn't a format guarantee.
    Example: "group-hooli-corporate"

  - `created.name` (string, required)
    Display name of the group.
    Example: "Hooli Corporate"

  - `created.type` (string, required)
    Always security for a group returned by this API. Response-only — never an accepted input field on create or update.
    Enum: "security"

  - `created.userCount` (integer)
    Number of users currently in this group.
    Example: 24

  - `created.usedIn` (object)
    Everywhere the group is currently referenced.

  - `created.usedIn.securityTemplates` (array)
    Security templates that still reference this group.

  - `created.usedIn.securityTemplates.id` (string)
    Example: "tmpl-hooli-apac-viewers"

  - `created.usedIn.securityTemplates.name` (string)
    Example: "Hooli APAC Viewers"

  - `created.createdBy` (string,null)
    User-profile id of the group's creator. null if the row has no recorded author.
    Example: "dc63db1b-1e63-43bc-877e-418931b6895c"

  - `created.createdEpoch` (integer)
    Unix timestamp (ms) of creation.
    Example: 1734000000000

  - `created.createdDate` (string,null)
    ISO 8601 creation date, derived from createdEpoch.
    Example: "2024-12-12T12:00:00.000Z"

  - `created.lastUpdatedBy` (string,null)
    User-profile id of the last user to update the group. null if the row has no recorded author.
    Example: "a5ae4577-8940-4ca9-bf2c-b1b65b4306ec"

  - `created.lastUpdatedEpoch` (integer)
    Unix timestamp (ms) of the last update.
    Example: 1755600000000

  - `created.lastUpdatedDate` (string,null)
    ISO 8601 last-updated date, derived from lastUpdatedEpoch.
    Example: "2025-08-19T12:00:00.000Z"

## Response 400 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

  - `code` (string)
    Enum: "VALIDATION_ERROR"

  - `details` (object)

  - `details.errors` (array)

  - `details.errors.name` (string)
    The offending name as submitted.

  - `details.errors.reason` (string)
    invalid (missing/blank/not a string), too_long, or duplicate repeated within the request. A name that duplicates an existing group is reported as a 409 instead — see below.
    Enum: "invalid", "too_long", "duplicate"

## Response 401 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

## Response 403 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

## Response 409 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

  - `code` (string)
    Enum: "DUPLICATE_GROUP_NAME"

  - `details` (object)

  - `details.errors` (array)

  - `details.errors.name` (string)

  - `details.errors.reason` (string)
    Enum: "duplicate"