---
title: "Create a role"
method: POST
path: "/v1/roles"
tags: ["Roles"]
---

# Create a role

`POST /v1/roles`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/roles`
- Auth: HTTP bearer

```bash
curl -X POST https://api.subscriby.net/v1/roles \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
        "team_id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86",
        "code": "support-agent",
        "name": "Support Agent",
        "description": "Answers tickets, cannot touch billing",
        "permissions": ["support-conversation:view-any", "support-conversation:update"]
      }'
```

> **Choose the code deliberately.** `code` is the stable identifier permissions are addressed by. It must be unique within the team and **cannot be changed afterwards**: renaming one would detach every assignment that referenced it. Only `name`, `description` and the permission set are mutable.

`permissions` accepts codes from the permission catalog in `entity:action` form. An unknown code is refused rather than silently dropped, so a typo fails loudly instead of creating a role that grants less than you think. Omit the field for a role that grants nothing yet.

Answers `201` with the role and emits `role.created`.

## Headers

- `Idempotency-Key` string, uuid, required

## Request body

- StoreRoleRequest: A role's team, code, name, description and permissions. On create `team_id`, `code` and `name` are required; on update `team_id` and `code` are prohibited (a role is neither moved nor renamed by code) and every other field is optional.
  - `team_id` string, uuid, required: The team to create the role in; the caller must belong to it, and a team outside their account answers 404. Prohibited on update: a role cannot be moved between teams.
  - `code` string, required: The stable identifier permissions are addressed by, up to 255 letters, numbers, dashes and underscores, unique within the team and immutable afterwards: renaming one would detach every assignment that referenced it. Prohibited on update.
  - `name` string, required: The display name, up to 255 characters.
  - `description` string, nullable: What the role is for, up to 255 characters; null clears it.
  - `permissions` string[]: The permission codes the role grants, in `entity:action` form. Sending it sets the role's permissions to exactly this list; omit the key to leave the existing set untouched. Omit it on create for a role that grants nothing yet.

## Response `201`

The role resource as a 201.

- object
  - `data` RoleResource, required: A role: the permission set one collaborator holds on a team. Every team seeds `admin`, `manager` and `viewer`, and creators add their own.
    - `id` string, required: The role's id.
    - `team_id` string, required: The team the role belongs to.
    - `code` string, required: The stable identifier permissions are addressed by, unique within the team and immutable after creation.
    - `name` string, nullable, required: The display name.
    - `description` string, nullable, required: What the role is for; null when none was given.
    - `owner_user_id` string, nullable, required: The user who created the role, the only one besides the team owner who may delete it.
    - `permissions` string[], required: The exact ability strings the role grants, the same strings used as token abilities, so roles can be matched against tokens without a second round-trip.
    - `created_at` string, nullable, required: When the role was created, ISO 8601.

## Other responses

- `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation.
- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description. On this endpoint: `TEAM_TIER_REQUIRED`: below the Growth tier; nothing changes.
- `404`: `RESOURCE_NOT_FOUND`: when `team_id` is not one of the caller's teams.
- `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when a role with that code already exists in the team (`error.context.code` names it), or a permission code is unknown.
- `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)