You need to set externallyDefined along with enabled. Also if role or user is in an org, that should be specified. e.g. curl -u superuser:superuser -X PUT -H "Content-Type: text/plain" -d @ops_user.xml "http://localhost:8080/jasperserver-pro/rest/user/" where ops_user.xml is.. <user> <enabled>true</enabled> <externallyDefined>false</externallyDefined> <username>johndoe</username> <password>myPassword</password> <fullName>John Doe</fullName> <tenantId>organization_1</tenantId> <emailAddress>john.doe@mail.com</emailAddress> <roles> <externallyDefined>false</externallyDefined> <roleName>ROLE_OPS</roleName> <tenantId>organization_1</tenantId> </roles> </user>