Function create_account 

pub(crate) async fn create_account(
    __arg0: State<AppState>,
    peer: Peer,
    headers: HeaderMap,
    __arg3: XrpcBody,
) -> Response

POST /xrpc/bot.did.createAccount

One of the e-stop’s two issuance gates alongside session creation: a Pause or a Revoke refuses a new account the same way it refuses a new session. The e-stop, the lifecycle and the account cap each close the route to every caller at once, and AppState::provision_rate_limiter closes it to one caller address at a time, all before the credential is read: a server that will not provision has no business spending a resolution on it.

An operator session cookie makes the caller the operator, and the session must be live and carry its CSRF token. Otherwise the bearer credential identifies a hosted creator — see prove — which becomes the parent, and which parent names. The operator’s create also needs the record this server reads from their repository.