1. Docs
  2. API Reference
  3. Add resource permissions to existing roles

Add resource permissions to existing roles

POST/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/setup/resource-permissions

Adds more resource.action permissions to the active Environment after initial setup and maps them onto existing roles via role_permissions. Unlike the bootstrap endpoint this runs against an already-configured Environment and has no unconfigured guard; permissions that already exist are skipped and role-permission mappings that already exist are not duplicated. Each referenced role must exist in this Environment (404 otherwise). Returns 201 with counts of permissions created and skipped and roles updated, and emits a resource_permissions.added audit event.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability env_permissions.manageDeveloper Console

Create, edit, and delete permissions. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Request body

application/json

resourcesBootstrapResourceDto[] Required

Resources to generate permissions for

role_permissionsResourcePermissionRoleDto[] Required

Permission assignments for existing roles. Empty array creates the permissions without binding them to any role.

Responses

application/json

  • dataResourcePermissionsResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on.

403account.capability_requiredForbidden
When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

Returned object

ResourcePermissionsResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/setup/resource-permissions" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "resources": [
      {
        "name": "notes",
        "actions": [
          "create",
          "read",
          "update",
          "delete"
        ]
      }
    ],
    "role_permissions": [
      {
        "role_id": "string",
        "permission_keys": [
          "invoices.create",
          "invoices.read"
        ]
      }
    ]
  }'
Response
{
  "data": {
    "permissions_created": 0,
    "skipped_permissions": 0,
    "roles_updated": 0
  }
}
 Related endpoints
POSTBootstrap the Environment's permission catalog and roles
 Was this page helpful?

Tell us how we can improve this guide.

Canopy