Create a custom role
/api/v1/rolesAuthentication
- Bearer Token
AuthorizationJWT access token
- API Key
X-API-KeyAPI key for management-tier access
Request body
name *stringRole name
descriptionstringRole description
Code samples
curl -X POST "https://api.canopy.dev/api/v1/roles" \
-H "X-API-Key: $CANOPY_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "string",
"description": "string"
}'const response = await fetch("https://api.canopy.dev/api/v1/roles", {
method: "POST",
headers: {
"X-API-Key": "$CANOPY_API_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"name": "string",
"description": "string"
}),
});
const data = await response.json();import requests
response = requests.post(
"https://api.canopy.dev/api/v1/roles",
headers={
"X-API-Key": "$CANOPY_API_KEY",
"Content-Type": "application/json"
},
json={
"name": "string",
"description": "string",
},
)
data = response.json()package main
import (
"bytes"
"encoding/json"
"net/http"
)
func main() {
payload := map[string]interface{}{
"name": "string",
"description": "string",
}
body, _ := json.Marshal(payload)
req, _ := http.NewRequest("POST", "https://api.canopy.dev/api/v1/roles", bytes.NewBuffer(body))
req.Header.Set("X-API-Key", "$CANOPY_API_KEY")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
}Responses
201 Role created
{
"id": "string",
"application_id": "string",
"name": "string",
"description": "string",
"is_system_role": false,
"system_key": "string",
"is_active": false,
"created_at": "2026-04-20T12:00:00.000Z",
"updated_at": "2026-04-20T12:00:00.000Z",
"version": 0,
"permission_count": 0
}application/json
id *stringapplication_id *stringname *stringdescriptionstringis_system_role *booleansystem_keystringis_active *booleancreated_at *string (date-time)updated_at *string (date-time)version *numberOptimistic-lock version. Send back as the `If-Match` header when updating to detect concurrent edits.
permission_countnumberNumber of permissions currently assigned to this role. Populated on list responses; omitted on single-role responses where the join isn't computed.
401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)
409 Role name already exists