Create a role

POST/roles

Creates a role of your organisation and returns it with a Location. permission_ids seeds the role's permissions in the same transaction: an unknown id returns 422 exists on permission_ids.N and no role is created. label defaults to name, so a name over 128 characters needs its own label (422 max on label otherwise). A name ending in -scim_provisioning is reserved (422 reserved). A name that any role, even a deleted one, already has, or a label another role of your organisation has (ignoring case), returns 422 unique. With a personal token you may grant only permissions you hold yourself, and anything touching super admin needs a super admin; otherwise 403 missing_permission naming the permissions. A token that acts as its own service identity may grant any permission except super admin and permissions at super-admin level or above, which return 403 missing_permission. dry_run shows the result without saving it. Emits role.created and sends no email. DELETE /roles/{id} undoes it.

Query parameters

dry_runboolean#
Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

Idempotency-Keystring#
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · RoleCreate

namestringRequired#
The role's unique name. No other role, even a deleted one, can have it.
labelstring | null#
The display label (at most 128 characters), unique among your organisation's roles ignoring case. Defaults to the name.
descriptionstring | null#
What the role is for.
permission_idsinteger[]#
The permissions to start with, distinct ids. You may grant only permissions you hold yourself.

{
  "name": "deal_manager",
  "label": "Deal Manager",
  "description": "Can manage deals and participants.",
  "permission_ids": [
    12,
    18,
    23
  ]
}

Responses

201

The role was created.

Role

{
  "data": {
    "id": 1,
    "name": "string",
    "label": "string",
    "description": "string",
    "global": true,
    "permission_ids": [
      1
    ],
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is forbidden when the role is global and so read-only, missing_permission when the caller may not grant, take away or delete what the call touches, with the permissions in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error

422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/roles\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "name": "deal_manager",
  "label": "Deal Manager",
  "description": "Can manage deals and participants.",
  "permission_ids": [
    12,
    18,
    23
  ]
}'