diff --git a/cmd/rbac/flags.go b/cmd/rbac/flags.go
index 6ff5dcc5..6af86422 100644
--- a/cmd/rbac/flags.go
+++ b/cmd/rbac/flags.go
@@ -5,6 +5,7 @@ const (
 	Permission = "permission"
 	Resource   = "resource"
 	Scope      = "scope"
+	CreateOnly = "create-only"
 
 	SubjectUsage            = "The handle of the subject of the permissions. If you're using LDAP, please use the usernameKey configured in StackState"
 	PermissionRevokeUsage   = "The permission to revoke"
@@ -16,6 +17,7 @@ const (
 	ScopeUsage              = "The query in STQL that will be prepended to every topology element retrieved in StackState. " +
 		"For example, if your scope is \"label = 'A'\", then all STQL executed in StackState" +
 		" (e.g. Retrieving topology) will only return elements that have the label A"
+	CreateOnlyUsage = "Fail when a subject with the same name already exists"
 
 	DefaultResource = "system"
 )
diff --git a/cmd/rbac/rbac_create_subject.go b/cmd/rbac/rbac_create_subject.go
index d54590ca..ea6b6cb5 100644
--- a/cmd/rbac/rbac_create_subject.go
+++ b/cmd/rbac/rbac_create_subject.go
@@ -9,8 +9,9 @@ import (
 )
 
 type CreateSubjectArgs struct {
-	Subject string
-	Scope   string
+	Subject    string
+	Scope      string
+	CreateOnly bool
 }
 
 func CreateSubjectCommand(deps *di.Deps) *cobra.Command {
@@ -26,6 +27,7 @@ func CreateSubjectCommand(deps *di.Deps) *cobra.Command {
 	cmd.MarkFlagRequired(Subject) //nolint:errcheck
 
 	cmd.Flags().StringVar(&args.Scope, Scope, "", ScopeUsage)
+	cmd.Flags().BoolVar(&args.CreateOnly, CreateOnly, false, CreateOnlyUsage)
 
 	return cmd
 }
@@ -45,6 +47,7 @@ func RunCreateSubjectCommand(args *CreateSubjectArgs) di.CmdWithApiFn {
 
 		resp, err := api.SubjectApi.CreateSubject(cli.Context, args.Subject).
 			CreateSubject(*subject).
+			CreateOnly(args.CreateOnly).
 			Execute()
 
 		if err != nil {
diff --git a/generated/stackstate_api/api/openapi.yaml b/generated/stackstate_api/api/openapi.yaml
index 69067369..fac6b272 100644
--- a/generated/stackstate_api/api/openapi.yaml
+++ b/generated/stackstate_api/api/openapi.yaml
@@ -3860,6 +3860,11 @@ paths:
         required: true
         schema:
           $ref: '#/components/schemas/Subject'
+      - in: query
+        name: createOnly
+        required: false
+        schema:
+          type: boolean
       requestBody:
         content:
           application/json:
diff --git a/generated/stackstate_api/api_subject.go b/generated/stackstate_api/api_subject.go
index ee34ea9e..51ef9e8c 100644
--- a/generated/stackstate_api/api_subject.go
+++ b/generated/stackstate_api/api_subject.go
@@ -88,6 +88,7 @@ type ApiCreateSubjectRequest struct {
 	ApiService    SubjectApi
 	subject       string
 	createSubject *CreateSubject
+	createOnly    *bool
 }
 
 func (r ApiCreateSubjectRequest) CreateSubject(createSubject CreateSubject) ApiCreateSubjectRequest {
@@ -95,6 +96,11 @@ func (r ApiCreateSubjectRequest) CreateSubject(createSubject CreateSubject) ApiC
 	return r
 }
 
+func (r ApiCreateSubjectRequest) CreateOnly(createOnly bool) ApiCreateSubjectRequest {
+	r.createOnly = &createOnly
+	return r
+}
+
 func (r ApiCreateSubjectRequest) Execute() (*http.Response, error) {
 	return r.ApiService.CreateSubjectExecute(r)
 }
@@ -139,6 +145,9 @@ func (a *SubjectApiService) CreateSubjectExecute(r ApiCreateSubjectRequest) (*ht
 		return nil, reportError("createSubject is required and must be specified")
 	}
 
+	if r.createOnly != nil {
+		localVarQueryParams.Add("createOnly", parameterToString(*r.createOnly, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{"application/json"}
 
@@ -750,6 +759,7 @@ type CreateSubjectMockResponse struct {
 type CreateSubjectCall struct {
 	Psubject       string
 	PcreateSubject *CreateSubject
+	PcreateOnly    *bool
 }
 
 func (mock SubjectApiMock) CreateSubject(ctx context.Context, subject string) ApiCreateSubjectRequest {
@@ -764,6 +774,7 @@ func (mock SubjectApiMock) CreateSubjectExecute(r ApiCreateSubjectRequest) (*htt
 	p := CreateSubjectCall{
 		Psubject:       r.subject,
 		PcreateSubject: r.createSubject,
+		PcreateOnly:    r.createOnly,
 	}
 	*mock.CreateSubjectCalls = append(*mock.CreateSubjectCalls, p)
 	return mock.CreateSubjectResponse.Response, mock.CreateSubjectResponse.Error
diff --git a/generated/stackstate_api/docs/SubjectApi.md b/generated/stackstate_api/docs/SubjectApi.md
index 09b92a50..d0c803d5 100644
--- a/generated/stackstate_api/docs/SubjectApi.md
+++ b/generated/stackstate_api/docs/SubjectApi.md
@@ -13,7 +13,7 @@ Method | HTTP request | Description
 
 ## CreateSubject
 
-> CreateSubject(ctx, subject).CreateSubject(createSubject).Execute()
+> CreateSubject(ctx, subject).CreateSubject(createSubject).CreateOnly(createOnly).Execute()
 
 Create a subject
 
@@ -34,10 +34,11 @@ import (
 func main() {
     subject := "subject_example" // string | 
     createSubject := *openapiclient.NewCreateSubject() // CreateSubject | 
+    createOnly := true // bool |  (optional)
 
     configuration := openapiclient.NewConfiguration()
     apiClient := openapiclient.NewAPIClient(configuration)
-    resp, r, err := apiClient.SubjectApi.CreateSubject(context.Background(), subject).CreateSubject(createSubject).Execute()
+    resp, r, err := apiClient.SubjectApi.CreateSubject(context.Background(), subject).CreateSubject(createSubject).CreateOnly(createOnly).Execute()
     if err != nil {
         fmt.Fprintf(os.Stderr, "Error when calling `SubjectApi.CreateSubject``: %v\n", err)
         fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
@@ -62,6 +63,7 @@ Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
 
  **createSubject** | [**CreateSubject**](CreateSubject.md) |  | 
+ **createOnly** | **bool** |  | 
 
 ### Return type
 
diff --git a/stackstate_openapi/openapi_version b/stackstate_openapi/openapi_version
index 7f83b942..59c271cc 100644
--- a/stackstate_openapi/openapi_version
+++ b/stackstate_openapi/openapi_version
@@ -1 +1 @@
-d8fc5194c51017c8e938a1b54f94bdb8a857d6c8
+674af5775997226a77151f9ef90cc9d6ef95c7eb