Create RBAC Client
POST
/v1/endpoints/{id}/rbac/clients
Provision a new RBAC client (end user) for an endpoint. The client can then authenticate using whichever credential type you supply: username + password, bearer token, or OAuth identity (matched on the next OAuth login). Default roles configured on the endpoint are auto-assigned to the new client.
Credential methods are gated by the endpoint's enabled auth methods: passing a password when password auth is disabled returns 400. Set auto_generate_token: true instead of supplying a token to have the platform mint a secure random token — returned once in the response.
Plan-gated: requires the endpoint RBAC entitlement on your plan. Identifier collisions across email, username, or OAuth identity return 409.
Path parameters
Request body
Stable identifier (canonicalised lowercase). Often the user's email.
Human-readable name and contact email. Optional.
Username for password auth. Set together with password.
Plaintext password. bcrypt-hashed before storage. Requires the endpoint's UsernamePassword auth method to be enabled.
Mint a secure random bearer token. Returned only once in the response. Mutually exclusive with token.
Pre-set bearer token. Hashed before storage; never retrievable.
OAuth identities to pre-link, each {provider, subject}. Requires the endpoint's OAuth/SSO auth method to be enabled. Use when migrating an existing OAuth user from another system.
active (default when empty) | invited | disabled | revoked.
Free-form JSON tags. Useful for grouping by team/department.
Defaults to admin. Internal callers can set self, invite, or sso.
Response (200 OK)
The created client (same shape as a list entry) plus, when auto_generate_token: true:
The freshly-minted bearer token. Show once, store securely; not retrievable later. Only present when a token was auto-generated.
Endpoint-default roles, if any, are auto-assigned to the new client; query /rbac/memberships to see them (they are not embedded in this response).
Errors
Unknown body fields (strict decoding), missing/invalid identifier, invalid status, or trying to use a credential method that isn't enabled on the endpoint.
Caller lacks endpoints:write, or the plan doesn't include the rbac entitlement ("RBAC is not available on your current plan").
Endpoint doesn't exist or doesn't belong to the calling account.
Identifier collision (email, username, or OAuth identity already exists on this endpoint).
bcrypt or database error.
curl -X POST "https://api.ngris.com/v1/endpoints/<uuid>/rbac/clients" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"identifier": "alice@example.com",
"display_name": "Alice",
"email": "alice@example.com",
"username": "alice",
"password": "S3cr3tP@ss!",
"metadata": {"team": "platform"}
}'
curl -X POST "https://api.ngris.com/v1/endpoints/<uuid>/rbac/clients" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{"identifier": "service-bot", "auto_generate_token": true}'
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
created = client.endpoint_rbac.create_client("<endpoint_uuid>", {
"identifier": "service-bot",
"auto_generate_token": True,
})
print("Token (save now):", created["generated_token"])
{
"id": 11,
"identifier": "service-bot",
"status": "active",
"has_password": false,
"has_token": true,
"has_oauth": false,
"registration_source": "admin",
"created_at": "2026-04-29T11:00:00Z",
"updated_at": "2026-04-29T11:00:00Z",
"generated_token": "a1b2c3d4..."
}