Create RBAC Role
Create a new role on this endpoint. A role bundles a structured allow/deny policy (HTTP methods + paths) and an optional per-role rate limit that the platform enforces for authenticated clients holding the role.
Set is_default: true to have new clients automatically receive this role at creation time. Multiple defaults can coexist (a new client gets all of them). Plan-gated: requires the rbac entitlement on your plan.
Path parameters
uuid string (uuid) Req
The endpoint's
uuid from /endpoints.Request body
name string Req
Role name. Must be unique within this endpoint.
description string
Free-form description shown in the dashboard.
priority int
Ordering weight when a client holds multiple roles. Default
0.permissions object
Structured allow/deny policy:
allowed_methods, denied_methods, allowed_paths, denied_paths (string arrays), rate_limit_rps (int64), headers, metadata (string maps). All optional; an omitted/empty object grants nothing extra.is_default boolean
true = auto-assigned to new clients. Default false.Response (200 OK)
The newly-created role with its assigned uuid. Same shape as list entries. (Returns 200, not 201.)
Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
400 Bad Request
Missing or empty
name, invalid JSON, or a duplicate role name (surfaced as a creation failure, not a dedicated 409).401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks
endpoints:write, or the plan doesn't include the rbac entitlement.404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account.
Request
curl -X POST "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/roles" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"name": "readonly",
"description": "GET-only access",
"priority": 10,
"permissions": {
"allowed_methods": ["GET", "HEAD"],
"denied_paths": ["/admin"],
"rate_limit_rps": 20
},
"is_default": false
}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
role = client.endpoint_rbac.create_role("019bb1e4-e785-77d2-9966-c3cff31d0a0e", {
"name": "readonly",
"description": "GET-only access",
"permissions": {"allowed_methods": ["GET", "HEAD"]},
})
Response — 200 OK
{
"uuid": "019b6243-8510-7cbb-a69c-6e29c89b0d65",
"name": "readonly",
"description": "GET-only access",
"priority": 10,
"is_default": false,
"permissions": {
"allowed_methods": ["GET", "HEAD"],
"denied_paths": ["/admin"],
"rate_limit_rps": 20
},
"created_at": "2026-04-29T13:00:00Z",
"updated_at": "2026-04-29T13:00:00Z"
}
Was this helpful?