Create a principal

API key required. Creates one identity-directory entry. Names are unique per tenant, case-insensitively: 1–64 characters; letters, digits, spaces, hyphens, underscores, and periods; at least one letter or digit. Every key issued with principal_id set to this id is checked against the principal on every call — a disabled or deleted principal gets DENY. Writes a PRINCIPAL_CREATE receipt.