# POST /repository/create

Section: [Repository](https://appengine.appmint.io/documentation/tag/repository.md) · Full index: https://appengine.appmint.io/documentation.md
## POST /repository/create

**Create a record**

`operationId: RepositoryController_createHandler`

Creates a record of any datatype. `datatype` names the collection and `data` carries the domain fields.

The same handler is mounted on both `POST` and `PUT` — they behave identically.

#### Signature

```http
POST /repository/create (body) -> The created record
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`). Required role(s): `content:create`.

#### Notes

- `isNew: true` is mandatory. Without it the request is rejected with 400 — the record is only accepted as a creation when it says it is new.
- Author is taken from the authenticated user, not the body.
- Field validation depends on the datatype's schema — an unknown datatype is created without one.
- A top-level `name` is truncated at 100 characters; the full title belongs in `data`.

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `PUT /repository/create`
- `POST /repository/update/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The record to create.

```json
{
  "datatype": "sf_product",
  "isNew": true,
  "data": {
    "sku": "DRK-COLA-330",
    "title": "Cola 330ml",
    "price": 12
  }
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result of the create operation |
| `201` | The created record |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |