Add role assignments
curl --request POST \
--url https://api.opal.dev/v1/role-assignments \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"role_assignments": [
{
"entity_id": "1b978423-db0a-4037-a4cf-f79c60cb67b3",
"entity_type": "GROUP",
"principal_id": "29827fb8-f2dd-4e80-9576-28e31e9934ac",
"principal_type": "GROUP",
"access_level_remote_id": "<string>",
"duration_minutes": 1
}
]
}
'import requests
url = "https://api.opal.dev/v1/role-assignments"
payload = { "role_assignments": [
{
"entity_id": "1b978423-db0a-4037-a4cf-f79c60cb67b3",
"entity_type": "GROUP",
"principal_id": "29827fb8-f2dd-4e80-9576-28e31e9934ac",
"principal_type": "GROUP",
"access_level_remote_id": "<string>",
"duration_minutes": 1
}
] }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
role_assignments: [
{
entity_id: '1b978423-db0a-4037-a4cf-f79c60cb67b3',
entity_type: 'GROUP',
principal_id: '29827fb8-f2dd-4e80-9576-28e31e9934ac',
principal_type: 'GROUP',
access_level_remote_id: '<string>',
duration_minutes: 1
}
]
})
};
fetch('https://api.opal.dev/v1/role-assignments', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.opal.dev/v1/role-assignments",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'role_assignments' => [
[
'entity_id' => '1b978423-db0a-4037-a4cf-f79c60cb67b3',
'entity_type' => 'GROUP',
'principal_id' => '29827fb8-f2dd-4e80-9576-28e31e9934ac',
'principal_type' => 'GROUP',
'access_level_remote_id' => '<string>',
'duration_minutes' => 1
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.opal.dev/v1/role-assignments"
payload := strings.NewReader("{\n \"role_assignments\": [\n {\n \"entity_id\": \"1b978423-db0a-4037-a4cf-f79c60cb67b3\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"29827fb8-f2dd-4e80-9576-28e31e9934ac\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\",\n \"duration_minutes\": 1\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.opal.dev/v1/role-assignments")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"role_assignments\": [\n {\n \"entity_id\": \"1b978423-db0a-4037-a4cf-f79c60cb67b3\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"29827fb8-f2dd-4e80-9576-28e31e9934ac\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\",\n \"duration_minutes\": 1\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.opal.dev/v1/role-assignments")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"role_assignments\": [\n {\n \"entity_id\": \"1b978423-db0a-4037-a4cf-f79c60cb67b3\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"29827fb8-f2dd-4e80-9576-28e31e9934ac\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\",\n \"duration_minutes\": 1\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"task_ids": [
"<string>"
],
"entries": [
{
"role_assignment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level": {
"access_level_name": "AdminRole",
"access_level_remote_id": "arn:aws:iam::590304332660:role/AdministratorAccess"
},
"expiration": "2023-11-07T05:31:56Z",
"granted_at": "2023-11-07T05:31:56Z"
}
}
]
}Add role assignments
Grants one or more principals (user, group, or resource) access to one or more
entities (resource or group). The request body is batched to match the GraphQL
addRoleAssignments mutation, which this endpoint thin-wraps. The caller must
hold the EDIT_ASSIGNMENTS role permission on every entity in the batch.
Omit access_level_remote_id for entities that have a single default access
level. Omit duration_minutes (or send 0) for an indefinite grant.
Atomicity: the batch is applied as a single transaction. If any entry
fails input validation, authorization, lookup, or creation, no entries
are created and the response identifies the first failing entry’s
entity_id and principal_id (and the request-array index for input
validation errors). Clients should retry with the offending entry
removed; partial-success is intentionally not supported, matching the
semantics of the GraphQL addRoleAssignments mutation that this
endpoint wraps.
Prefer this endpoint for batch or programmatic use (e.g. Terraform). For a
single grant on a specific entity/principal pair, the per-pair endpoints —
/resources/{id}/users/{id}, /groups/{id}/users/{id},
/groups/{id}/resources/{id}, /groups/{id}/containing-groups,
/resources/{id}/non-human-identities/{id} — are often simpler.
POST
/
role-assignments
Add role assignments
curl --request POST \
--url https://api.opal.dev/v1/role-assignments \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"role_assignments": [
{
"entity_id": "1b978423-db0a-4037-a4cf-f79c60cb67b3",
"entity_type": "GROUP",
"principal_id": "29827fb8-f2dd-4e80-9576-28e31e9934ac",
"principal_type": "GROUP",
"access_level_remote_id": "<string>",
"duration_minutes": 1
}
]
}
'import requests
url = "https://api.opal.dev/v1/role-assignments"
payload = { "role_assignments": [
{
"entity_id": "1b978423-db0a-4037-a4cf-f79c60cb67b3",
"entity_type": "GROUP",
"principal_id": "29827fb8-f2dd-4e80-9576-28e31e9934ac",
"principal_type": "GROUP",
"access_level_remote_id": "<string>",
"duration_minutes": 1
}
] }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
role_assignments: [
{
entity_id: '1b978423-db0a-4037-a4cf-f79c60cb67b3',
entity_type: 'GROUP',
principal_id: '29827fb8-f2dd-4e80-9576-28e31e9934ac',
principal_type: 'GROUP',
access_level_remote_id: '<string>',
duration_minutes: 1
}
]
})
};
fetch('https://api.opal.dev/v1/role-assignments', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.opal.dev/v1/role-assignments",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'role_assignments' => [
[
'entity_id' => '1b978423-db0a-4037-a4cf-f79c60cb67b3',
'entity_type' => 'GROUP',
'principal_id' => '29827fb8-f2dd-4e80-9576-28e31e9934ac',
'principal_type' => 'GROUP',
'access_level_remote_id' => '<string>',
'duration_minutes' => 1
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.opal.dev/v1/role-assignments"
payload := strings.NewReader("{\n \"role_assignments\": [\n {\n \"entity_id\": \"1b978423-db0a-4037-a4cf-f79c60cb67b3\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"29827fb8-f2dd-4e80-9576-28e31e9934ac\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\",\n \"duration_minutes\": 1\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.opal.dev/v1/role-assignments")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"role_assignments\": [\n {\n \"entity_id\": \"1b978423-db0a-4037-a4cf-f79c60cb67b3\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"29827fb8-f2dd-4e80-9576-28e31e9934ac\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\",\n \"duration_minutes\": 1\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.opal.dev/v1/role-assignments")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"role_assignments\": [\n {\n \"entity_id\": \"1b978423-db0a-4037-a4cf-f79c60cb67b3\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"29827fb8-f2dd-4e80-9576-28e31e9934ac\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\",\n \"duration_minutes\": 1\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"task_ids": [
"<string>"
],
"entries": [
{
"role_assignment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level": {
"access_level_name": "AdminRole",
"access_level_remote_id": "arn:aws:iam::590304332660:role/AdministratorAccess"
},
"expiration": "2023-11-07T05:31:56Z",
"granted_at": "2023-11-07T05:31:56Z"
}
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Request body for POST /role-assignments.
The list of role assignments to add.
Required array length:
1 - 100 elementsShow child attributes
Show child attributes
Response
The requested role assignments were created.
Response body for POST /role-assignments.
Opaque IDs of push tasks enqueued to propagate the new assignments to end systems. Each ID is a base64-encoded, URL-safe string that mirrors the identifier returned by the GraphQL addRoleAssignments mutation.
One entry per role assignment created, in request order.
Show child attributes
Show child attributes
Was this page helpful?