Create RBAC Role
Create a new role on this endpoint. A role bundles a structured allow/deny policy (HTTP methods + paths) and an optional per-role rate limit that the platform enforces for authenticated clients holding the role.
Set is_default: true to have new clients automatically receive this role at creation time. Multiple defaults can coexist (a new client gets all of them). Plan-gated: requires the rbac entitlement on your plan.
Path parameters
id string (uuid) Req
Endpoint UUID.
Request body
name string Req
Role name. Must be unique within this endpoint.
description string
Free-form description shown in the dashboard.
priority int
Ordering weight when a client holds multiple roles. Default
0.permissions object
Structured allow/deny policy:
allowed_methods, denied_methods, allowed_paths, denied_paths (string arrays), rate_limit_rps (int64), headers, metadata (string maps). All optional; an omitted/empty object grants nothing extra.is_default boolean
true = auto-assigned to new clients. Default false.Response (200 OK)
The newly-created role with assigned id. Same shape as list entries. (Returns 200, not 201.)
Errors
400 Bad Request
Missing or empty
name, invalid JSON, or a duplicate role name (surfaced as a creation failure, not a dedicated 409).401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks
endpoints:write, or the plan doesn't include the rbac entitlement.404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account.
Request
curl -X POST "https://api.ngris.com/v1/endpoints/<uuid>/rbac/roles" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"name": "readonly",
"description": "GET-only access",
"priority": 10,
"permissions": {
"allowed_methods": ["GET", "HEAD"],
"denied_paths": ["/admin"],
"rate_limit_rps": 20
},
"is_default": false
}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
role = client.endpoint_rbac.create_role("<endpoint_uuid>", {
"name": "readonly",
"description": "GET-only access",
"permissions": {"allowed_methods": ["GET", "HEAD"]},
})
Response — 200 OK
{
"id": 3,
"name": "readonly",
"description": "GET-only access",
"priority": 10,
"is_default": false,
"permissions": {
"allowed_methods": ["GET", "HEAD"],
"denied_paths": ["/admin"],
"rate_limit_rps": 20
},
"created_at": "2026-04-29T13:00:00Z",
"updated_at": "2026-04-29T13:00:00Z"
}