Create Role

Beta
POST/v1/identity/roles

Idempotent with Idempotency-Key header. Learn more

Creates a custom role with the specified permissions.

Roles created through the API always have type user.

Permissions requiredValues:roles:create
The role behind your API key or agent must grant every one of these permissions.
include[]optional arrayenumValues:ownerowner.accountpermissions

Sub-objects to expand in the response. When omitted, sub-objects are returned as null.

namestring

Display name for the role, unique within the account.

permissionsoptional array of string

Permissions to grant, in {domain}:{action} format, such as customers:read.

The action must be one of create, read, update, or delete. Omit to create a role with no permissions.

idstring

Role ID.

objectstringenumValues:role

Resource type identifier.

namestring

Display name, unique within the account.

typestringenumValues:adminuserscanner

The kind of role.

The role's type is sometimes used to gate special behaviors and to restrict some actions to only certain types of roles. For example, only roles with the type admin can create and manage API keys.

  • admin: full administrative access, including managing API keys.
  • user: a custom role tailored to a specific need (its permissions are defined explicitly). Roles created through the API always have this type.
  • scanner: a role for scanning-station operators.
  • sales_rep: a role for sales representatives.
  • agent: a role assigned to an automated agent rather than a person.
ownerownerExpandablenullable

Provenance of this role.

System-owned roles are global defaults shared across all accounts and cannot be modified or deleted; account-owned roles are custom roles created by that account.

objectstringenumValues:owner

Resource type identifier.

typestringenumValues:systemaccount

Where this resource came from.

  • system: a platform-provided default shared across all accounts; not editable.
  • account: created and owned by a specific account; the account field identifies which.
accountaccountExpandablenullable

The account that owns this resource.

Present only when type is account; system-owned resources have no owning account.

idstring

Account ID.

objectstringenumValues:account

Resource type identifier.

namestring

The account's display name.

default_billing_addressaddressnullable

Default billing address.

Always returned as null in this endpoint.
default_shipping_addressaddressnullable

Default shipping address.

Always returned as null in this endpoint.
brandingaccount_brandingnullable

Customer-facing branding for the account, such as the logo, support contacts, and social links.

Always returned as null in this endpoint.
portalaccount_portalnullable

The account's customer portal settings, including the portal URL slug.

Always returned as null in this endpoint.
created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

permissionsarray of stringExpandablenullable

Permissions granted by this role, in {domain}:{action} format, such as customers:read.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

Responses

201

Successful response for Create Role