Create a role binding

Create a new role binding that assigns a role to a user on a resource.

Payload Requirements

• role_id, user_id, resource_type, and resource_id are required.
• resource_type must be SPACE or PROJECT.
• resource_id must be a unique identifier for the selected resource_type.
• Only one binding per user and resource is allowed. If the target user already has any binding on the resource, the request returns 409 Conflict.
• System-managed fields (id, created_at, updated_at) are returned by the server and are rejected on input.

Valid example

{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjoxOmxQZzI=",
  "resource_type": "PROJECT",
  "resource_id": "TW9kZWw6MTpGdmxM"
}

Invalid example

{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjoxOmxQZzI=",
  "resource_type": "PROJECT",
  "resource_id": "U3BhY2U6MTp1Rk4x"
}

This fails because resource_id must encode a PROJECT ID when resource_type is PROJECT.

Authorization Requires ROLE_BINDING_CREATE permission on the resource. This grants administrator-level authority on the resource, including the ability to assign any role visible in the account. If authorization fails, the endpoint returns 403, including when the resource is nonexistent or outside the caller's account. If the target user or role is outside the caller's account, the endpoint returns 404 after store validation.

Use PATCH /v2/role-bindings/{binding_id} to change the assigned role for an existing binding.

<Note>This endpoint is in beta, read more here.</Note>