---
title: "Set Role"
method: PUT
path: "/service-accounts/{id}/role"
tags: ["service-accounts"]
---

# Set Role

`PUT /service-accounts/{id}/role`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/service-accounts/{id}/role`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Changes the service account's role. Fenced exactly like create: the new role may never exceed the caller's own Permissions.

## Path parameters

- `id` string, required

## Request body

- InternalDeliveryHttpHandlerSetServiceAccountRoleRequest
  - `role_id` string, uuid

## Response `200`

OK

- InternalDeliveryHttpHandlerServiceAccountResponse
  - `data` InternalDeliveryHttpHandlerServiceAccountView
    - `active` boolean
    - `agent_id` string: AgentID is nil on this branch (see serviceaccounts.AgentBinding) — agents.service_account_id lands with v3-agents-schema.
    - `created_at` string
    - `created_by` string
    - `description` string
    - `email` string
    - `groups` InternalDeliveryHttpHandlerServiceAccountGroupRef[]: Groups is populated on GET /service-accounts/{id} only — a list page decorating every row with its group memberships is an N+1 this type does not force; use GET /service-accounts/{id}/groups for the full list on any one account.
      - `id` string
      - `name` string
      - `slug` string
    - `id` string
    - `key_count` integer
    - `kind` string
    - `last_used_at` string
    - `name` string
    - `role` InternalDeliveryHttpHandlerServiceAccountRoleView
      - `id` string
      - `permissions` InternalDeliveryHttpHandlerServiceAccountPermsView
        - `admin_managed` boolean
        - `cross_tenant` boolean
        - `tenant_manage` boolean
        - `tenant_read` boolean
        - `tenant_write` boolean
      - `slug` string
    - `slug` string
    - `tenant_id` string
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: unknown_role
- `401`: Unauthorized
- `403`: role_exceeds_caller
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)