---
title: "Create a group in an app"
method: POST
path: "/apps/{id}/groups"
tags: ["Apps"]
---

# Create a group in an app

`POST /apps/{id}/groups`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/apps/{id}/groups`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `sites:write`)

Groups (teams) in an app with auth.groups: true. A group has a key (like team-north), a name, and optionally a role and an entitlement that everyone in it gets on top of their own: the app's code sees env.HYPAMOON.user.groups and inGroup(key), and the extra role and entitlement in is() and has(). A group never gives the admin role (the first role). At most 100 groups per app and 20 groups per person. Admins of the app manage groups on /_hypamoon/admin too.

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `key` string, required: The key the code checks with inGroup(key): lowercase letters, digits, - and _, starting with a letter, like team-north. It cannot change later.
  - `name` string: A name for people, like Team North. Defaults to the key.
  - `role` string: Optional: one of the app's roles that everyone in the group gets too. Never the admin role (the first role).
  - `entitlement` string: Optional: an entitlement everyone in the group gets too, checked with env.HYPAMOON.user.has(entitlement).

## Response `201`

The new group.

- object
  - `key` string, required
  - `name` string, required
  - `role` string, nullable, required
  - `entitlement` string, nullable, required
  - `member_count` integer, required
  - `created_at` string, required
  - `members` object[]: Who is in the group (at most 200 shown; member_count is always the full number).
    - `id` string, uuid, required
    - `email` string, required
    - `name` string, nullable, required
    - `added_at` string, required

## Other responses

- `400`: Bad Request: invalid_json.
- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required.
- `404`: Not Found: not_found.
- `409`: Conflict: conflict.
- `422`: Unprocessable Content: validation_failed.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)