1. Docs
  2. API Reference
  3. Bulk-create role assignments. All-or-nothing: any failure rolls back the entire batch

Bulk-create role assignments. All-or-nothing: any failure rolls back the entire batch

POST/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/bulk-create

Creates many role assignments in one request using partial-success semantics: each item is validated, authorized at its node, and saved independently. Successes and failures are returned together in a { summary, results } envelope — 200 when every item succeeds, 207 Multi-Status when some fail. Per-item duplicates (including repeats within the same batch), unauthorized nodes, and inactive/system roles fold into the failures array rather than aborting the request. Emits a single assignment.bulk_created audit summary.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability env_identities.manageDeveloper Console

Create, invite, edit, and remove identities and assign their roles. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Production Environments require production_identities.accessDeveloper Console

Access identities in production Environments. Applies to users only, and only in an Environment marked production: its identities are real end users. API keys and identity principals are exempt.

Request body

application/json

assignmentsBulkCreateAssignmentItemDto[] Required

Responses

application/json

  • summaryobject*
  • resultsobject[]*

application/json

  • summaryobject*
  • results("success" | "error")[]*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on.

403account.capability_requiredForbidden
When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

403environment.production_identities_forbiddenForbidden
When it happens

The Environment is marked production and the caller is a user without production identity access.

Remediation

Manage these people in the Admin Workspace, or ask an administrator to grant the Production Support role, then retry.

Request
curl -X POST "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/bulk-create" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "assignments": [
      {
        "identity_id": "string",
        "node_id": "string",
        "role_id": "string",
        "effective_from": "string",
        "effective_to": "string"
      }
    ]
  }'
Response
{
  "summary": {
    "total": 0,
    "succeeded": 0,
    "failed": 0
  },
  "results": [
    {
      "index": 0,
      "status": "success",
      "code": 0,
      "data": {
        "id": "string",
        "identity_id": "string",
        "application_node_id": "string",
        "role_id": "string",
        "effective_from": "2026-04-20T12:00:00.000Z",
        "effective_to": "2026-04-20T12:00:00.000Z",
        "created_at": "2026-04-20T12:00:00.000Z",
        "updated_at": "2026-04-20T12:00:00.000Z"
      }
    }
  ]
}
 Related endpoints
GETList all assignments across the Application
GETGet App-wide assignment summary
POSTAssign a role to an identity at a node
PATCHUpdate an assignment
DELETERemove an assignment
POSTBulk remove assignments
POSTBulk change role on assignments
 Was this page helpful?

Tell us how we can improve this guide.

Canopy