1. Docs
  2. API Reference
  3. Assign a role to a machine client at a node

Assign a role to a machine client at a node

POST/api/v1/oauth-clients/{id}/assignments

Gives the machine client role_id at node_id, optionally for a window (effective_from, effective_to), through the same grant writer and grant ceiling every assignment passes: the caller must hold rbac.manage_assignments at the node and may only grant roles they are allowed to. A client pinned to an organization holds roles only at or beneath that organization's node (409 oauth.client_outside_organization). Responds 201 Created with the assignment.

Authentication

Bearer TokenAuthorization Option A

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

API KeyX-API-Key Option B

API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.

Path Parameters

idstring Required

Request body

application/json

node_idstring Required

The node the role is held at.

role_idstring Required

The role the client holds there.

effective_fromstring Optional

When the role starts to apply. Omitted, from now.

effective_tostring Optional

When the role stops applying. Omitted, never.

Responses

application/json

  • dataAssignmentResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Idempotency

Idempotency-Key header

Send an Idempotency-Key header to make retries safe. Canopy replays the same response for matching keys within 24 hours, and refuses the same key sent with a different request with 422 idempotency.key_reused_with_different_request.

Returned object

AssignmentResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/api/v1/oauth-clients/value/assignments" \
  -H "X-API-Key: $CANOPY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "node_id": "string",
    "role_id": "string",
    "effective_from": "string",
    "effective_to": "string"
  }'
Response
{
  "data": {
    "id": "string",
    "identity_id": "string",
    "oauth_client_id": "string",
    "application_node_id": "string",
    "role_id": "string",
    "role_name": "string",
    "node_name": "string",
    "effective_from": "2026-04-20T12:00:00.000Z",
    "effective_to": "2026-04-20T12:00:00.000Z",
    "created_at": "2026-04-20T12:00:00.000Z",
    "updated_at": "2026-04-20T12:00:00.000Z",
    "version": 0
  }
}
 Related endpoints
GETList OAuth clients for Application
POSTRegister a new OAuth client
GETActive/inactive OAuth client counts for the environment
GETGet OAuth client details
PATCHUpdate OAuth client
DELETEDelete OAuth client
POSTRotate an OAuth client's secret
GETList a machine client's role assignments
PATCHChange a machine client's assignment
DELETERemove a machine client's assignment
GETGet where a machine client holds each permission
 Was this page helpful?

Tell us how we can improve this guide.

Canopy