1. Docs
  2. API Reference
  3. Bootstrap the Environment's permission catalog and roles

Bootstrap the Environment's permission catalog and roles

POST/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/setup/access-bootstrap

Authentication

  • Bearer Token Authorization

    JWT access token

Request body

  • resourcesBootstrapResourceDto[]*

    Resources to generate permissions for

  • rolesBootstrapRoleDto[]*

    Roles to create with their permission assignments

Code samples

cURLJavaScriptPythonGo
curl -X POST "https://api.canopy.dev/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/setup/access-bootstrap" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "resources": [
      {
        "name": "notes",
        "actions": [
          "create",
          "read",
          "update",
          "delete"
        ]
      }
    ],
    "roles": [
      {
        "name": "Admin",
        "description": "Full access to all resources",
        "permission_keys": [
          "notes.create",
          "notes.read",
          "notes.update",
          "notes.delete"
        ]
      }
    ]
  }'

Responses

201 Permissions, roles, and role-permission joins created in a single transaction. No admin role assignment is seeded — admin users bypass RBAC; role assignments are for end-user identities.
{
  "permissions_created": 0,
  "roles_created": 0,
  "skipped_permissions": 0,
  "skipped_roles": 0
}

application/json

  • permissions_creatednumber*

    Number of permissions created

  • roles_creatednumber*

    Number of roles created

  • skipped_permissionsnumber*

    Number of permissions skipped (already exist)

  • skipped_rolesnumber*

    Number of roles skipped (already exist)

401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)
409 Environment already has custom permissions or roles

Returned object

On this page

Related endpoints

POSTAdd resource permissions to existing roles