Create Custom Role
POST /roles
POST /rolesInteractive request editor loads with JavaScript.
Authorization
BearerAdminToken Organization-scoped admin token. Read operations require a valid token, and write operations require a token with write permission.
In: header
Request Body
application/json
Custom role create body.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "$AISIX_CP/roles" \ -H "Authorization: Bearer $AISIX_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "permissions": [ { "action": "read", "resource": "environments" } ] }'Created
{
"role": {
"id": "string",
"display_name": "string",
"description": "string",
"permissions": [
{
"action": "string",
"resource": "string",
"description": "string"
}
],
"is_builtin": true
}
}Request body or parameters failed validation.
{
"error": {
"code": "string",
"message": "string"
}
}Missing or invalid bearer.
{
"error": {
"code": "UNAUTHENTICATED",
"message": "no org context"
}
}Authenticated request is not permitted.
{
"error": {
"code": "CUSTOM_KEY_DISABLED",
"message": "custom API key values are disabled for this organization"
}
}Request conflicts with current resource state.
{
"error": {
"code": "CREDENTIAL_IN_USE",
"message": "models still reference this provider_key"
}
}Complete operation details and schema variants
POST /roles
Create Custom Role
Create an organization-scoped custom role. Its name is permanent because member and directory-sync assignments reference it by name. A custom role can grant only permission pairs available to the built-in admin role and cannot grant role management.
Parameters
Request body
Content type: application/json
-
name(string, required): Immutable lowercase role name. It must start with a letter and may contain letters, digits, hyphens, and underscores. -
description(string, optional): Human-readable purpose of the role. -
permissions(array, required): -
oneOf variant 1
-
permissions[].action(string, required): -
permissions[].resource(string, required): Resource family a custom role may read. -
oneOf variant 2
-
permissions[].action(string, required): -
permissions[].resource(string, required): Resource family a custom role may manage.
Responses
-
201: Created -
role(object, required): Built-in or organization-defined control-plane role. -
role.id(string, required): Built-in role ID or immutable custom role name. -
role.display_name(string, required): Role label displayed in the dashboard. -
role.description(string, required): Human-readable purpose of the role. -
role.permissions(array, required): -
role.permissions[].action(string, required): Permission action. The owner role uses*. -
role.permissions[].resource(string, required): Resource family. The owner role uses*. -
role.permissions[].description(string, required): Human-readable effect of the permission. -
role.is_builtin(boolean, required): Whether AISIX Cloud defines and protects the role. -
400: Request body or parameters failed validation. -
error(object, required): Error details. -
error.code(string, required): Machine-readable identifier. Examples:UNAUTHENTICATED,INVALID_REQUEST,MASTER_KEY_UNSET,INTERNAL. -
error.message(string, required): Human-readable explanation; safe to surface to operators. -
401: Missing or invalid bearer. Response fields (application/json): identical toPOST /roles, response 400 above. -
403: Authenticated request is not permitted. Response fields (application/json): identical toPOST /roles, response 400 above. -
409: Request conflicts with current resource state. Response fields (application/json): identical toPOST /roles, response 400 above.
cURL
curl -X POST '$AISIX_CP/roles' -H 'Authorization: Bearer $AISIX_TOKEN'