# (NEW!) Create Security User Group

Create a security user group for the authenticated customer. name is the only accepted field.

Business Rules:
- name must be 1-255 characters after trimming, and unique per customer, case-insensitively — enforced by a database constraint, so a race between two concurrent creates for the same name always resolves to exactly one winner and a 409 for the loser.
- type is not an accepted input field at all. Sending it, with any value, is rejected with 400 — the created group is always type: security; this is reflected in the response but can never be set by the caller.

The user submitting the request must have the User Management privilege.

Endpoint: POST /security/user-groups
Version: 1.5
Security: ApiKeyAuth, BasicAuth

## Header parameters:

  - `X-API-Key` (string, required)
    Customer-specific API key required to invoke API.

  - `Authorization` (string, required)
    Provided by Authentication Token creation operation.

  - `Content-Type` (string, required)
    Enum: "application/json"

## Request fields (application/json):

  - `name` (string, required)
    Display name of the group. 1-255 characters after trimming. Must be unique per customer, case-insensitively. type is not an accepted input field — the created group is always type: security.
    Example: "Pied Piper Engineering"

## Response 201 fields (application/json):

  - `id` (string, required)
    Unique ID of the group. Opaque string — ids are generated as UUIDs, but this isn't a format guarantee.
    Example: "group-hooli-corporate"

  - `name` (string, required)
    Display name of the group.
    Example: "Hooli Corporate"

  - `type` (string, required)
    Always security for a group returned by this API. Response-only — never an accepted input field on create or update.
    Enum: "security"

  - `userCount` (integer)
    Number of users currently in this group.
    Example: 24

  - `usedIn` (object)
    Everywhere the group is currently referenced.

  - `usedIn.securityTemplates` (array)
    Security templates that still reference this group.

  - `usedIn.securityTemplates.id` (string)
    Example: "tmpl-hooli-apac-viewers"

  - `usedIn.securityTemplates.name` (string)
    Example: "Hooli APAC Viewers"

  - `createdBy` (string,null)
    User-profile id of the group's creator. null if the row has no recorded author.
    Example: "dc63db1b-1e63-43bc-877e-418931b6895c"

  - `createdEpoch` (integer)
    Unix timestamp (ms) of creation.
    Example: 1734000000000

  - `createdDate` (string,null)
    ISO 8601 creation date, derived from createdEpoch.
    Example: "2024-12-12T12:00:00.000Z"

  - `lastUpdatedBy` (string,null)
    User-profile id of the last user to update the group. null if the row has no recorded author.
    Example: "a5ae4577-8940-4ca9-bf2c-b1b65b4306ec"

  - `lastUpdatedEpoch` (integer)
    Unix timestamp (ms) of the last update.
    Example: 1755600000000

  - `lastUpdatedDate` (string,null)
    ISO 8601 last-updated date, derived from lastUpdatedEpoch.
    Example: "2025-08-19T12:00:00.000Z"

## Response 400 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

## Response 401 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

## Response 403 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

## Response 409 fields (application/json):

  - `status` (string)
    Example: "error"

  - `message` (string)

  - `code` (string)
    Enum: "DUPLICATE_GROUP_NAME"

  - `details` (object)

  - `details.existingGroupId` (string)