Groups

Create a group

POST/groups
groups:writecreate_group

Creates a group led by a user of your organisations and returns it with a Location. members is an optional starting membership; each entry names a user, an optional role (editor or viewer, default viewer) and an optional signatory. The lead is left out of the members. A user can lead only one group, so a lead who already leads one returns 409 conflict. A lead, member or parent that is not yours returns 422 validation_failed. Callers using a personal token need super admin, multi-accounts or manage-groups (a token that acts as its own service identity needs only the groups:write scope), advisors cannot create groups and get 403 missing_permission with only the permissions they lack, and putting the group under a parent needs the same rights on the parent; otherwise 403 missing_permission. If the editor and viewer group roles are not set up, 409 conflict. dry_run shows the result without saving it. Emits group.created and sends no email. A parent with automatic classification gives the lead and members its classification. DELETE /groups/{id} undoes it.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · GroupCreate

  • namestringRequired#

    The group's name.

  • descriptionstring | null#

    The group's description.

  • lead_user_idstring (uuid)Required#

    The group's lead. A user of your organisations who leads no other group.

  • parent_idstring | null#

    The group to put this one under. You need update rights on it.

  • membersobject[]#

    The starting members. The lead is left out.

{
  "name": "Acme Holdings Ltd",
  "description": "Corporate entity for the Acme group.",
  "lead_user_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
  "members": [
    {
      "user_id": "1b2c3d4e-5f60-4172-8394-a5b6c7d8e9f0",
      "role": "editor",
      "signatory": true
    }
  ]
}

Responses

201

The group was created.

Group
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "name": "string",
    "description": "string",
    "lead_user_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "parent_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "member_count": 1,
    "features": {
      "users_can_create_new_sub_groups": true,
      "can_be_invited_directly_to_group": true,
      "can_be_shown_in_sidebar": true,
      "user_auto_assign_to_classification": true,
      "can_invite_direct_investors": true
    },
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is missing_permission when the caller may not change the group, with the permissions that would allow it in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/groups\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "name": "Acme Holdings Ltd",
  "description": "Corporate entity for the Acme group.",
  "lead_user_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
  "members": [
    {
      "user_id": "1b2c3d4e-5f60-4172-8394-a5b6c7d8e9f0",
      "role": "editor",
      "signatory": true
    }
  ]
}'