Assign Role to Client
Grant a role to an RBAC client. Memberships are the join table between clients and roles — one client can have many roles, one role can be held by many clients.
To remove a membership, use DELETE /v1/memberships. To list all memberships use GET /v1/memberships.
Not idempotent — granting a role the client already holds returns 409 Conflict. Plan-gated: requires the rbac entitlement on your plan.
Path parameters
id string (uuid) Req
Endpoint UUID.
Request body
client_id int64 Req
RBAC client ID.
role_id int64 Req
Role ID to assign.
Response (200 OK)
Returns the full updated memberships array for the endpoint (same shape as List Role Memberships), not just the new pairing.
Errors
400 Bad Request
Missing/non-positive
client_id or role_id, unknown fields, or invalid JSON.401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks
endpoints:write, or the plan doesn't include the rbac entitlement.404 Not Found
Endpoint doesn't belong to the calling account, or the referenced client/role doesn't exist on this endpoint.
409 Conflict
The client already holds this role.
Request
curl -X POST "https://api.ngris.com/v1/endpoints/<uuid>/rbac/memberships" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{"client_id": 11, "role_id": 3}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
client.endpoint_rbac.create_membership("<endpoint_uuid>", {
"client_id": 11,
"role_id": 3,
})
Response — 200 OK
[
{"id": 41, "client_id": 11, "role_id": 1, "assigned_by": 1024, "created_at": "2026-04-01T00:00:00Z", "updated_at": "2026-04-01T00:00:00Z"},
{"id": 44, "client_id": 11, "role_id": 3, "assigned_by": 1024, "created_at": "2026-04-29T13:00:00Z", "updated_at": "2026-04-29T13:00:00Z"}
]