---
title: "Create a role for a company"
method: POST
path: "/api/roles"
tags: ["Permissions"]
---

# Create a role for a company

`POST /api/roles`

Create a company-owned role.

The company is REQUIRED and comes from the body — never from the session,
which on a `system_admin` route is whichever tenant the admin last switched
into (docs/claude/02-security.md §10).

Validated against `get_company_universe()`, NOT `Empresas`: two active users
carry `IDempresa = 2` with no `Empresas` row, and that company owns six live
role copies. Refusing it would refuse a real tenant.

Deliberately cannot create a TEMPLATE. A template minted from a dialog has
an empty `Z_RolePermissions`: fanned out it gives every company a role that
grants nothing, not fanned out it gives a template nobody can hold (both
assignment paths reject templates). The six real templates are versioned
artefacts of two SQL scripts that would not know about a seventh.
`template_key` is not accepted either — stamping one on a hand-made role
disguises it as a system copy, which locks the tenant out of editing it
(`_assert_role_is_company_authored`) and stops
`ensure_company_role_copies` from ever re-creating it.

## Headers

- `x-api-token` string, nullable

## Request body

- RoleCreate
  - `name` string, required
  - `description` string, nullable
  - `idcompany` integer, required

## Response `201`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/multigest/apis/multigest-protected-api.md) · [All operations](https://skmtc.dev/multigest/apis/multigest-protected-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/multigest/multigest-protected-api/revisions/4b44eb76b3ee/schema)