---
title: "Create role credentials"
method: POST
path: "/organizations/{organization}/databases/{database}/branches/{branch}/roles"
tags: ["Roles"]
---

# Create role credentials

`POST /organizations/{organization}/databases/{database}/branches/{branch}/roles`

### Authorization
A service token or OAuth token must have at least one of the following access or scopes in order to use this API endpoint:

**Service Token Accesses**
 `create_production_branch_password`, `create_production_read_only_branch_password`, `create_branch_password`

**OAuth Scopes**

 | Resource | Scopes |
| :------- | :---------- |
| Organization | `manage_passwords`, `manage_production_branch_passwords`, `manage_read_only_passwords`, `manage_production_read_only_passwords` |
| Database | `manage_passwords`, `manage_production_branch_passwords`, `manage_read_only_passwords`, `manage_production_read_only_passwords` |
| Branch | `manage_passwords`, `manage_read_only_passwords` |

## Path parameters

- `organization` string, required
- `database` string, required
- `branch` string, required

## Request body

- object
  - `name` string — The name of the role
  - `ttl` integer — Time to live in seconds
  - `inherited_roles` string[] — Roles to inherit from
  - `with_replication` boolean — Whether the role should have the REPLICATION attribute
  - `require_where_on_delete` string — Require WHERE clause on DELETE statements
  - `require_where_on_update` string — Require WHERE clause on UPDATE statements

## Response `200`

Returns the new credentials

- object
  - `id` string, required — The ID of the role
  - `name` string, required — The name of the role
  - `access_host_url` string, required — The database connection string
  - `private_access_host_url` string, required — The database connection string for private connections
  - `private_connection_service_name` string, required — The service name to set up private connectivity
  - `username` string, required — The database user name
  - `base_username` string, required — The base username without branch routing suffix
  - `password` string, required — The plaintext password, available only after create
  - `database_name` string, required — The database name
  - `created_at` string, required — When the role was created
  - `updated_at` string, required — When the role was updated
  - `deleted_at` string, nullable, required — When the role was deleted
  - `expires_at` string, nullable, required — When the role expires
  - `dropped_at` string, nullable, required — When the role was dropped
  - `disabled_at` string, nullable, required — When the role was disabled
  - `drop_failed` string, required — Error message available when dropping the role fails
  - `ready` boolean, required — Whether the role is ready to accept connections
  - `expired` boolean, required — True if the credentials are expired
  - `default` boolean, required — Whether the role is the default postgres user
  - `ttl` integer, required — Number of seconds before the credentials expire
  - `inherited_roles` string[], required — Database roles these credentials inherit
  - `with_replication` boolean, required — Whether the role has the REPLICATION attribute
  - `branch` object, required
    - `id` string, required — The ID for the resource
    - `name` string, required — The name for the resource
    - `created_at` string, required — When the resource was created
    - `updated_at` string, required — When the resource was last updated
    - `deleted_at` string, nullable, required — When the resource was deleted, if deleted
  - `actor` object, required
    - `id` string, required — The ID of the actor
    - `display_name` string, required — The name of the actor
    - `avatar_url` string, required — The URL of the actor's avatar
  - `query_safety_settings` object, required
    - `require_where_on_delete` 'off' | 'warn' | 'on', required — Require WHERE clause on DELETE statements
    - `require_where_on_update` 'off' | 'warn' | 'on', required — Require WHERE clause on UPDATE statements

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-08-18** `249942995489` — 1 info
  - added the required property `ready` to the response with the `200` status
- **2026-08-12** `fd4480152110` — 1 breaking, 1 info
  - removed the enum value `pscale_managed` of the request property `inherited_roles/items/`
  - removed the `pscale_managed` enum value from the `inherited_roles/items/` response property for the response status `200`
- **2026-07-08** `fa19f3305241` — 2 info
  - added the new optional request property `with_replication`
  - added the required property `with_replication` to the response with the `200` status
- **2026-06-01** `72506953f367` — 5 breaking, 1 info
  - the response property `branch/deleted_at` became nullable for the status `200`
  - the response property `deleted_at` became nullable for the status `200`
  - the response property `disabled_at` became nullable for the status `200`
  - the response property `dropped_at` became nullable for the status `200`
  - …2 more
- **2026-02-10** `ed1825db11c6` — 3 info
  - added the new optional request property `require_where_on_delete`
  - added the new optional request property `require_where_on_update`
  - added the required property `query_safety_settings` to the response with the `200` status

[Full history](https://skmtc.dev/planetscale/apis/planetscale-api/changes/organizations/:organization/databases/:database/branches/:branch/roles/post.md)

---

[API](https://skmtc.dev/planetscale/apis/planetscale-api.md) · [All operations](https://skmtc.dev/planetscale/apis/planetscale-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/planetscale/planetscale-api/revisions/6d28c038c4fd/schema)