Create a new SSO user. The organization must have SSO configured. A deleted
user is reactivated when recreated by the same identity provider, whether
under the previous subject identifier or a new one. Recreation from a
different identity provider is rejected. Returns the Digits-assigned ID and
caller-assigned ID mapping. This operation is synchronous.

Requires scope: user:sync.