Organizations

CreateRole

Creates a new custom role for an organization. Custom roles define fine-grained permission sets that can be assigned to organization members and teams, enabling precise access control beyond the built-in admin and member roles. Optionally, an associated policy and role binding can be created alongside the role. Role definitions are subject to two limits: a permission descriptor group may contain at most 2000 entries (each directly-specified entity counts as one entry), and the total serialized size of the role definition may not exceed 1 MB. Exceeding either limit returns a 400 error. If you need to grant access to more than 2000 individually listed resources, use tag-based (ABAC) rules instead.

post/api/orgs/{orgName}/roles

Request

  • Base URL: https://api.pulumi.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.pulumi.com/api/orgs/{orgName}/roles
  • Auth: none declared

Path parameters

orgNamestring required

The organization name

Query parameters

createPolicyAndRoleboolean

Also create an associated policy and role binding alongside the role

Request body

descriptionstring

A human-readable description of the permission descriptor.

namestring

The name of the permission descriptor.

resourceTypestring

The resource type this permission descriptor applies to.

uxPurpose'role' | 'role_private' | 'role_temporary' | 'policy' | 'set'

The UX purpose of this permission descriptor (e.g. role, policy, set).

Response

OK

descriptionstring

A human-readable description of the permission descriptor.

namestring

The name of the permission descriptor.

resourceTypestring

The resource type this permission descriptor applies to.

uxPurpose'role' | 'role_private' | 'role_temporary' | 'policy' | 'set'

The UX purpose of this permission descriptor (e.g. role, policy, set).

createdstring date-time required

When the role was created.

defaultIdentifierstring

The identifier for default roles. Empty for custom roles.

idstring required

The unique identifier for this role.

isOrgDefaultboolean required

Whether this role is the organization default.

modifiedstring date-time required

When the role was last modified.

orgIdstring required

The ID of the organization this role belongs to.

versioninteger required

The version of this role.

Changes

No recorded changes to this operation across all 1 revision of this API.