Organisation Permissions

Set user-creation permission defaults

PUT/roles/permissions/creation-defaults
roles:writereplace_creation_defaultsDestructiveIdempotent

Makes the ids you send your organisation's default permission set for new users and returns the resulting permissions; [] clears it. An unknown id returns 422 exists on permissions.N. With a personal token the permissions you add and the permissions you take away must all be ones you hold yourself, and super admin needs a super admin caller, else 403 missing_permission; a service identity is refused only for super admin and super-admin-level permissions. Read the set back with GET /permissions?filter[creation_default]=true. dry_run shows the result without saving it. Sends no webhook and no email. Sending the previous ids undoes it.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · CreationDefaultsInput

  • permissionsinteger[]Required#

    Every permission that should be in the default set, distinct ids. Send an empty list to clear it.

{
  "permissions": [
    12,
    18
  ]
}

Responses

200

The permissions in the new default set.

Permission[]
{
  "data": [
    {
      "id": 1,
      "key": "string",
      "name": "string",
      "label": "string",
      "description": "string",
      "category": "string",
      "level": 1,
      "creation_default": true,
      "created_at": "2026-06-12T10:00:00+00:00",
      "updated_at": "2026-06-12T10:00:00+00:00"
    }
  ]
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is forbidden when the role is global and so read-only, missing_permission when the caller may not grant, take away or delete what the call touches, with the permissions in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X PUT https://your-org-domain/kong/core/api/v2/roles/permissions/creation-defaults\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "permissions": [
    12,
    18
  ]
}'