---
title: "Create a group → role mapping"
method: POST
path: "/group-mapping"
tags: ["Group mapping"]
---

# Create a group → role mapping

`POST /group-mapping`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/group-mapping`
- Auth: HTTP bearer

Every member of the SCIM group receives these roles. The model is a UNION: mapped roles merge onto roles assigned manually through `PATCH /member/{userId}`, they do not replace them. Roles are recomputed for affected members immediately, and again on every SCIM membership change. Requires `sso:manage`. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers `428 step_up_required`). An organization API token is not challenged.

## Headers

- `X-Organization-Id` string

## Request body

- object
  - `scim_group_id` string, required: Group id from `GET /scim-group`.
  - `role_ids` string[]: At most one role (`role_…`). Defaults to empty (no mapping).

## Response `201`

Created

- object
  - `id` string: Group mapping id (`gmap_…`).
  - `scim_group_id` string: SCIM group from `GET /scim-group`.
  - `role_ids` string[]: The single role (`role_…`) every member of that group receives.
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)