Create a new role binding that assigns a role to a user on a resource.

Payload Requirements

• role_id, user_id, resource_type, and resource_id are required.
• resource_type must be SPACE or PROJECT.
• resource_id must be a unique identifier for the selected resource_type.
• user_id is the ID of the user to bind the role to. For a service key, this is the ID of the key's bot user — not the ID of the person who created the key. Read it from bot_user.id on the POST /v2/api-keys response, or from bot_user.id on the matching service key entry returned by GET /v2/api-keys.
• Only one binding per user and resource is allowed. If the target user already has any binding on the resource, the request returns 409 Conflict.
• System-managed fields (id, created_at, updated_at) are returned by the server and are rejected on input.

Valid example

{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjoxOmxQZzI=",
  "resource_type": "PROJECT",
  "resource_id": "TW9kZWw6MTpGdmxM"
}

Valid example — binding a service key's bot user

{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjo0MzpiT3RV",
  "resource_type": "PROJECT",
  "resource_id": "TW9kZWw6MTpGdmxM"
}

user_id here is the bot user's ID from the service key's creation response, not the caller's own ID.

Invalid example

{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjoxOmxQZzI=",
  "resource_type": "PROJECT",
  "resource_id": "U3BhY2U6MTp1Rk4x"
}

This fails because resource_id must encode a PROJECT ID when resource_type is PROJECT.

Authorization Requires ROLE_BINDING_CREATE permission on the resource. This grants administrator-level authority on the resource, including the ability to assign any role visible in the account. If authorization fails, the endpoint returns 403, including when the resource is nonexistent or outside the caller's account. If the target user or role is outside the caller's account, the endpoint returns 404 after store validation.

Use PATCH /v2/role-bindings/{binding_id} to change the assigned role for an existing binding.

{
  "role_id": "RW50aXR5OjEyMzQ1",
  "user_id": "RW50aXR5OjEyMzQ1",
  "resource_id": "RW50aXR5OjEyMzQ1"
}

{
  "role_id": "RW50aXR5OjEyMzQ1",
  "user_id": "RW50aXR5OjEyMzQ1",
  "resource_id": "RW50aXR5OjEyMzQ1"
}