Symptoms
Login mask settings (from Provider control panel > Settings > Security > Login settings) are ignored when creating a user under account #1 (provider) using API method UserAdd_API.
For example, the system can allow to create a user with the capital letters in the login even though the capital letters are prohibited in the login mask.
Cause
The issue is reported to the development team in a bug #PBA-56708 ("UserAdd_API does not verify Login Settings when user is created under provider"), will be fixed in one of the PBA updates.