Add a permission to a role
/roles/{id}/permissionsAdds one permission and returns the set; one the role already has changes nothing. An unknown id returns 422 exists on id. With a personal token you may add only a permission you hold yourself and super admin needs a super admin caller, else 403 missing_permission; a service identity is refused only for super admin and super-admin-level permissions. A global role returns 403 forbidden. Adding super admin to a role a SCIM group maps makes the role unassignable by SCIM, and the next SCIM sync takes it from the group's members. Emits role.updated with permissions as the changed field when it changed; sends no email. DELETE /roles/{id}/permissions/{member_id} undoes it.
Path parameters
The role's id, a whole number from 1 to 2147483647. An unknown role, another organisation's role and a service role return 404.
Query parameters
Validate and run the call without committing it, returning what the real call would return with
meta.dry_runset.
Headers
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.
Request body
application/json, required · RolePermissionInput
The permission, from GET /permissions. You must hold it yourself.
{
"id": 12
}Responses
{
"data": [
{
"id": 1,
"key": "string",
"label": "string"
}
]
}Authorization failed. error.code is forbidden when the role is global and so read-only, missing_permission when the caller may not grant, take away or delete what the call touches, with the permissions in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.
The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per
problem, or a code documented on the operation.
Examples
curl -X POST https://your-org-domain/kong/core/api/v2/roles/{id}/permissions\
-H "Authorization: Bearer $HELM_API_KEY"\
-H "Content-Type: application/json"\
-d '{
"id": 12
}'