Internal Users

Give an internal user a role

POST/internal-users/{id}/roles
internal-users:writeadd_internal_user_rolesIdempotent

Grants one role to the internal user and returns the set. One already held changes nothing. A role that is not your own or global, or is a service role, returns 422 exists; a super-admin role not already held needs a super-admin caller, else 403 missing_permission. A SCIM-managed user returns 409 scim_managed. Emits internal_user.updated with roles as the changed field when it changed, and the legacy user.* events; sends no email. DELETE /internal-users/{id}/roles/{member_id} undoes it.

Path parameters

  • idstring (uuid)Required#

    The internal user's id, a uuid. An unknown user, or one outside the token's organisation, returns 404.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · InternalUserRoleInput

  • idintegerRequired#

    The role: your own organisation's or a global role, never a service role. A role carrying the super-admin permission needs a super-admin caller unless the user already holds it.

{
  "id": 12
}

Responses

200

Every role the internal user holds.

InternalUserRole[]
{
  "data": [
    {
      "id": 7,
      "name": "admin",
      "label": "Administrator"
    },
    {
      "id": 12,
      "name": "compliance",
      "label": "Compliance Officer"
    }
  ]
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/internal-users/{id}/roles\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "id": 12
}'