---
title: "Assign Role"
method: POST
path: "/v2/facts/{proj_id}/{env_id}/role_assignments"
tags: ["Role Assignments"]
---

# Assign Role

`POST /v2/facts/{proj_id}/{env_id}/role_assignments`

## Request

- Base URL: `https://api.permit.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.permit.io/v2/facts/{proj_id}/{env_id}/role_assignments`
- Auth: HTTP bearer

Assigns a role to a user within a tenant.

The tenant defines the scope of the assignment. In other words, the role is effective only within the tenant.

## Path parameters

- `proj_id` string, required: Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").
- `env_id` string, required: Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").

## Request body

- RoleAssignmentCreate
  - `role` string, required: the role that will be assigned (accepts either the role id or the role key)
  - `tenant` string: the tenant the role is associated with (accepts either the tenant id or the tenant key)
  - `resource_instance` string: the resource instance the role is associated with (accepts either the resource instance id or key using this format resource_type:resource_instance)The resource instance will be implicitly created if the tenant parameter is specified and the resource instance does not exist.
  - `user` string, required: the user the role will be assigned to (accepts either the user id or the user key)

## Response `200`

Successful Response

- RoleAssignmentRead
  - `id` string, uuid, required: Unique id of the role assignment
  - `user` string, required: the user the role is assigned to
  - `role` string, required: the role that is assigned
  - `tenant` string: the tenant the role is associated with
  - `resource_instance` string: the resource instance the role is associated with
  - `resource_instance_id` string, uuid: Unique id of the resource instance
  - `user_id` string, uuid, required: Unique id of the user
  - `role_id` string, uuid, required: Unique id of the role
  - `tenant_id` string, uuid, required: Unique id of the tenant
  - `organization_id` string, uuid, required: Unique id of the organization that the role assignment belongs to.
  - `project_id` string, uuid, required: Unique id of the project that the role assignment belongs to.
  - `environment_id` string, uuid, required: Unique id of the environment that the role assignment belongs to.
  - `created_at` string, date-time, required: Date and time when the role assignment was created (ISO_8601 format).

## Other responses

- `409`: Conflict - including a request whose tenant differs from the tenant the named resource instance already exists in.
- `422`: Validation Error

## Changes

- **2026-09-30** `b83a93e22587`: 1 info
  - added the non-success response with the status `409`

[Operation history](https://skmtc.dev/permit/apis/permit-io-api/changes/v2/facts/:proj_id/:env_id/role_assignments/post.md)

---

[API](https://skmtc.dev/permit/apis/permit-io-api.md) - [All operations](https://skmtc.dev/permit/apis/permit-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/permit/apis/permit-io-api/revisions/fa0edf4238b3?raw)