Assign Role to Client
Grant a role to an RBAC client. Memberships are the join table between clients and roles — one client can have many roles, one role can be held by many clients.
To remove a membership, use DELETE .../rbac/memberships. To list all memberships use GET .../rbac/memberships.
Not idempotent — granting a role the client already holds returns 409 Conflict. Plan-gated: requires the rbac entitlement on your plan.
Path parameters
uuid from /endpoints.Request body
uuid. Resolved under this endpoint only.uuid of the role to assign. Resolved under this endpoint only.Deprecated: client_id and role_id (integers) are still accepted until the sunset. Send client_uuid and role_uuid; sending both forms for different objects is a 400 id_uuid_mismatch.
Response (200 OK)
Returns the full updated memberships array for the endpoint (same shape as List Role Memberships), not just the new pairing.
Deprecated: until the sunset this response also carries the legacy integer id, client_id, role_id and assigned_by fields. Don't use them; read the *_uuid fields.
Errors
client_uuid or role_uuid (client_uuid and role_uuid are required), a malformed uuid (client_uuid must be a uuid), both forms naming different objects (id_uuid_mismatch), an integer after the sunset (integer_id_unsupported), unknown fields, or invalid JSON.endpoints:write, or the plan doesn't include the rbac entitlement.client_uuid not found / role_uuid not found).