Register new permission(s)
/api/v1/permissionsRegisters one or more custom permissions in the active Application's catalog for the current Environment, accepting an array under permissions (each with a required key, name, and category, plus an optional description). All created permissions are marked source: custom; a key that already exists in the Environment returns 409. Requires the rbac.manage_roles permission and emits a permission.created audit event per key.
Authentication
Authorization Option A JWT access token. Never send alongside X-API-Key: a request carrying both is refused.
X-API-Key Option B API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.
Request body
application/json
permissionsPermissionItemDto[] Required One or more permissions to register
Responses
application/json
data *PermissionResponseDto
application/json
error *ApiErrorBodyDto
application/json
error *ApiErrorBodyDto
Returned object
curl -X POST "https://auth.canopy-io.com/api/v1/permissions" \ -H "X-API-Key: $CANOPY_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "permissions": [ { "key": "string", "name": "string", "description": "string", "category": "string" } ] }'
{ "data": { "id": "string", "application_id": "string", "key": "string", "name": "string", "description": "string", "category": "string", "source": "system", "created_at": "2026-04-20T12:00:00.000Z", "version": 0 } }
Tell us how we can improve this guide.