---
title: "Create Assignment"
method: POST
path: "/rbac/assignments"
tags: ["rbac"]
---

# Create Assignment

`POST /rbac/assignments`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/rbac/assignments`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Create a group assignment.

Assigns a role to a group. If workspace_id is None, creates an org-wide
assignment that applies to all workspaces. Each group can have at most
one assignment per workspace (or one org-wide assignment).

Requires: org:rbac:create scope

## Request body

- GroupRoleAssignmentCreate: Create schema for a group assignment.
  - `group_id` string, uuid, required: Group ID to assign
  - `role_id` string, uuid, required: Role ID to assign to the group
  - `workspace_id` string, uuid, nullable: Workspace ID for workspace-level assignment. If None, creates org-wide assignment.

## Response `201`

Successful Response

- GroupRoleAssignmentReadWithDetails: Read schema for a group assignment with group and role details.
  - `id` string, uuid, required
  - `organization_id` string, uuid, required
  - `group_id` string, uuid, required
  - `workspace_id` string, uuid, nullable
  - `role_id` string, uuid, required
  - `assigned_at` string, date-time, required
  - `assigned_by` string, uuid, nullable
  - `group_name` string, required
  - `role_name` string, required
  - `workspace_name` string, nullable

## Other responses

- `400`: Organization role assigned on a workspace.
- `404`: Group, role, or workspace not found.
- `409`: Group already has an assignment for this workspace.
- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)