---
title: "Grant a role to a user"
method: POST
path: "/api/v1/roles/{roleid}/users/{userId}"
tags: ["Roles"]
---

# Grant a role to a user

`POST /api/v1/roles/{roleid}/users/{userId}`

## Request

- Base URL: `https://docs.anzworldline-solutions.com.au`
- URL: `https://docs.anzworldline-solutions.com.au/api/v1/roles/{roleid}/users/{userId}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/docs/api/v1/roles/:roleid/users/:userId/post.ts> (a function with typed inputs; its response is checked against the schema)

Grants the role to the user as a DIRECT membership. The operation is IDEMPOTENT: granting a role the user already holds returns 200 and changes nothing — no duplicate membership is created and retries are safe, even when the role's editUsers flag has since been turned off. Note the inherited-membership behavior (legacy parity): role membership is inherited DOWN the role tree, so a user holding a parent role implicitly holds every child role. Granting a role the user already INHERITS this way also returns 200 but does NOT create a direct membership — the user will not appear in the role's direct-users list afterwards. Roles whose editUsers flag is false cannot be granted (403); workflow and system roles are non-grantable because that flag is false on them.

## Path parameters

- `roleid` string, required
- `userId` string, required

## Response `200`

User holds the role after the call; the response carries the granted roleId and a minimal user payload

- ResponseEntityRoleUserGrantView
  - `errors` ErrorEntity[]
    - `errorCode` string
    - `message` string
    - `fieldName` string
  - `entity` RoleUserGrantView
    - `granted` boolean, required: Whether the user holds the role after the call. The grant is idempotent, so this is also true when the user already held the role and nothing changed
    - `roleId` string, required: Id of the granted role
    - `user` RoleMemberUserView, required: The user the role was granted to
      - `userId` string, required: Id of the user
      - `email` string, required: Email address of the user
      - `fullName` string, required: Full name of the user
  - `messages` MessageEntity[]
    - `message` string
  - `i18nMessagesMap` object
  - `permissions` string[]
  - `pagination` Pagination
    - `currentPage` integer
    - `perPage` integer
    - `totalEntries` integer

## Other responses

- `401`: Unauthorized - authentication required
- `403`: Forbidden - admin permissions required, or the role's editUsers flag is false
- `404`: Role or user not found

## Changes

- **2026-10-30** `4fd8e917d458`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/changes/api/v1/roles/:roleid/users/:userId/post.md)

---

[API](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api.md) - [All operations](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/revisions/4fd8e917d458?raw)