---
title: "POST /resources/{resource_id}/custom-access-levels"
method: POST
path: "/resources/{resource_id}/custom-access-levels"
tags: ["resources"]
---

# POST /resources/{resource_id}/custom-access-levels

`POST /resources/{resource_id}/custom-access-levels`

## Request

- Base URL: `https://api.opal.dev/v1`
- URL: `https://api.opal.dev/v1/resources/{resource_id}/custom-access-levels`
- Auth: HTTP bearer

Creates a custom access level on a resource. If the resource is a parent type, the role is created on all child resources.

## Path parameters

- `resource_id` string, uuid, required

## Request body

- CreateResourceCustomAccessLevelInfo: Info for creating a custom access level.
  - `access_level` ResourceAccessLevel, required: # Access Level Object ### Description The `AccessLevel` object is used to represent the level of access that a principal has. The "default" access level is a `AccessLevel` object whose fields are all empty strings. ### Usage Example View the `AccessLevel` of a resource/user or resource/group pair to see the level of access granted to the resource.
    - `access_level_name` string, required: The human-readable name of the access level.
    - `access_level_remote_id` string, required: The machine-readable identifier of the access level.
  - `policy` string, nullable: The policy document.
  - `requestable_by_default` boolean: Whether the role is requestable. Defaults to false.
  - `stackable_sensitivity_index` integer, nullable: The sensitivity index. Null to leave unranked.

## Response `200`

The created custom access level.

- ResourceCustomAccessLevelResponse: A custom access level for a resource.
  - `resource_custom_access_level_id` string, uuid, required: The unique ID of the custom access level.
  - `resource_id` string, uuid, required: The resource this access level belongs to.
  - `access_level` ResourceAccessLevel, required: # Access Level Object ### Description The `AccessLevel` object is used to represent the level of access that a principal has. The "default" access level is a `AccessLevel` object whose fields are all empty strings. ### Usage Example View the `AccessLevel` of a resource/user or resource/group pair to see the level of access granted to the resource.
    - `access_level_name` string, required: The human-readable name of the access level.
    - `access_level_remote_id` string, required: The machine-readable identifier of the access level.
  - `policy` string, nullable: The policy document for this access level.
  - `requestable_by_default` boolean, required: Whether this role is requestable.
  - `stackable_sensitivity_index` integer, nullable: The sensitivity index in the access hierarchy. Null if unranked.
  - `member_resource_ids` string[], nullable: When addressed via a parent resource, lists the child resource IDs that back this aggregated entry.
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Unsupported resource type.
- `404`: Resource not found or access denied.
- `409`: A custom access level with this remote ID already exists.

## Changes

- **2026-09-03** `6fb509a33bf8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/opal/apis/opal-api/changes/resources/:resource_id/custom-access-levels/post.md)

---

[API](https://skmtc.dev/opal/apis/opal-api.md) - [All operations](https://skmtc.dev/opal/apis/opal-api/llms.txt) - [OpenAPI document](https://skmtc.dev/opal/apis/opal-api/revisions/e7877ea96eab?raw)