We are designing a local, non-login service account provisioning process on macOS using the public Open Directory API. The documentation for ODNodeCreateRecord() states that if setting an initial attribute fails, the record is deleted and an error is returned. We need to ensure that a failed creation attempt cannot delete or modify a pre-existing record, including during concurrent record creation or replacement. Questions: When attribute initialization fails, is the internal cleanup guaranteed to target only the record instance created by that specific API call, rather than another record with the same name? Is this cleanup bound to a unique record identity or UUID, including if another process concurrently creates, removes, or replaces a record with the same name? Does the public API provide an atomic create-only guarantee that prevents changes to an existing record? If these guarantees are not provided, what supported API or provisioning approach should be used to avoid affecting pre-existing local Directory Services records? Our current plan uses the local /Local/Default Directory Services node for a dedicated service account, administrative change serialization, pre-creation collision checks, and post-operation identity verification. We understand that these checks do not themselves prove atomicity or race-free cleanup. We would appreciate clarification of the supported API guarantees, specifically for macOS 15. Thank you.

macOS Open Directory: Does ODNodeCreateRecord cleanup preserve concurrent records?

We are designing a local, non-login service account provisioning process on macOS using the public Open Directory API.

The documentation for ODNodeCreateRecord() states that if setting an initial attribute fails, the record is deleted and an error is returned.

We need to ensure that a failed creation attempt cannot delete or modify a pre-existing record, including during concurrent record creation or replacement.

Questions:

When attribute initialization fails, is the internal cleanup guaranteed to target only the record instance created by that specific API call, rather than another record with the same name?
Is this cleanup bound to a unique record identity or UUID, including if another process concurrently creates, removes, or replaces a record with the same name?
Does the public API provide an atomic create-only guarantee that prevents changes to an existing record?
If these guarantees are not provided, what supported API or provisioning approach should be used to avoid affecting pre-existing local Directory Services records?

Our current plan uses the local /Local/Default Directory Services node for a dedicated service account, administrative change serialization, pre-creation collision checks, and post-operation identity verification.
We understand that these checks do not themselves prove atomicity or race-free cleanup.

We would appreciate clarification of the supported API guarantees, specifically for macOS 15.

Thank you.