Assign a role to a user (create grant)
POST/rbac/grants
Assigns roleIdentifier to userIdentifier in the selected entity,
optionally scoped to a set of sub-accounts.
Idempotent on the (entity, recipient, role, exact scope set) tuple:
a duplicate POST returns 200 with the existing grant rather than
creating a second one. A different scope set = a different grant
(returns 201).
Requires GRANT_CREATE permission. Only Admins may assign the Admin
role; the caller must itself hold an Admin grant in the entity.
Response is a flat RbacGrantForDisplay (identifiers only, no embedded
role detail). Use GET /rbac/grants/{identifier} for the enriched view.
Request
Responses
- 200
- 201
- 400
- 401
- 403
- 404
- 409
Identical grant already exists (idempotent)
Grant created
Validation error (invalid UUID, scope exceeds 500)
Missing/invalid JWT or entity selection
GRANT_CREATE permission missing, or caller is not an Admin when
trying to assign the Admin role (RBAC_PERMISSION_DENIED)
User or role not found (RBAC_USER_NOT_FOUND / RBAC_ROLE_NOT_FOUND)
RBAC_SCOPED_OWNER_FORBIDDEN — Admin role cannot be given a non-empty scope; RBAC_SUB_ACCOUNT_NOT_IN_ENTITY — a publicId does not belong to the entity