---
title: "Add Role Members"
method: POST
path: "/management/v1/role/{role_id}/members"
tags: ["role"]
---

# Add Role Members

`POST /management/v1/role/{role_id}/members`

## Request

- Base URL: `https://localhost`
- URL: `https://localhost/management/v1/role/{role_id}/members`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/docs/management/v1/role/:role_id/members/post.ts> (a function with typed inputs; its response is checked against the schema)

Adds one or more members (users and/or roles) to a role in a single atomic
(all-or-nothing) batch. Idempotent — already-present members are accepted.
Returns the requested members confirmed present.

Handling of a not-yet-provisioned member depends on the configured
authorization backend: a backend that stores assignments itself accepts the
member by id, whereas catalog-backed authorization requires the member to
exist first and otherwise returns `404` — provision the user (via
`POST /user`) or create the role before assigning. Behavior is consistent
within a deployment.

## Path parameters

- `role_id` string, uuid, required

## Headers

- `x-project-id` string, nullable

## Request body

- AddRoleMembersRequest: Request body for `POST /role/{id}/members`. Batch: adds every listed member to the role atomically (all-or-nothing).
  - `members` RoleMemberRef[], required
    - union: An identity reference to a role member — a `user` or a `role`, by typed id. Sent in `POST /role/{id}/members` requests and echoed by the add confirmation (remove returns `204` with no body). Unlike [`RoleMember`] it is never hydrated (no display name): it names *which* principal, not its display identity.
      - object: A user, by `IdP` subject id.
        - `id` string, required
        - `type` 'user', required
      - object: A role, by id.
        - `id` string, uuid, required
        - `type` 'role', required

## Response `200`

Members added

- AddRoleMembersResponse: Response for `POST /role/{id}/members`: the requested members confirmed present (idempotent — already-present members are included). Echoes identity [`RoleMemberRef`]s, not hydrated [`RoleMember`]s — use `GET /role/{id}/members` for display names.
  - `members` RoleMemberRef[], required
    - union: An identity reference to a role member — a `user` or a `role`, by typed id. Sent in `POST /role/{id}/members` requests and echoed by the add confirmation (remove returns `204` with no body). Unlike [`RoleMember`] it is never hydrated (no display name): it names *which* principal, not its display identity.
      - object: A user, by `IdP` subject id.
        - `id` string, required
        - `type` 'user', required
      - object: A role, by id.
        - `id` string, uuid, required
        - `type` 'role', required

## Other responses

- `4XX`

---

[API](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api.md) - [All operations](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/revisions/c5cb9a12a98c?raw)