use the child user endpoint

pass in the accountName as the username - intern the service hashes
this name when creating the child user account