# Create Role

Create a custom role with exactly the permissions you choose, then assign it to members. You can grant only permissions you hold yourself.

`POST https://connect.mindcloud.co/v2/roles`

Permissions: `role:manage`.

## Parameters

### Headers

- `X-Company-Id` (string): Optional. The id of the organization to act in. Leave it out to act in the API key's own organization. A key can also act in its child organizations, and, with "Use this key across all of your organizations" on, in every organization its creator can open in the app. List them with GET /v2/companies. Every response's X-Company-Id header names the organization it acted in. See [Organizations](https://mindcloud.co/docs/api/rest/introduction/organizations).

### Body

- `name` (string, required): The role name, up to 255 characters.
- `description` (string): What the role is for, up to 255 characters.
- `permissions` (array): Permission keys to grant. Leave it out to create the role with no permissions.

## Example request

```bash
curl --request POST \
  --url 'https://connect.mindcloud.co/v2/roles' \
  --header 'Authorization: Bearer $MINDCLOUD_API_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Support",
  "description": "Read-only access for the support team",
  "permissions": [
    "workflow:read",
    "workflow:run"
  ]
}'
```

## Response fields

- `id` (string): Unique id of the role.
- `name` (string): The role's name.
- `description` (string): The role's description. Empty when nobody wrote one.
- `isAdmin` (boolean): True if the role grants admin rights.
- `isGlobal` (boolean): True for roles MindCloud provides to every company. Global roles are read-only: writing one answers 404.
- `createdOn` (date): When the role was created.
- `memberCount` (number): How many people in the company hold the role, people whose invite is pending included. A role with members cannot be deleted.
- `permissions` (array of objects): Everything the role allows, as { key, name } pairs.
  - `key` (string): The permission key, such as workflow:run.
  - `name` (string): The permission's display name.

## Errors

- 400 Bad request (INVALID_QUERY, ROLE_PERMISSIONS_UNKNOWN_KEYS): `VALIDATION_FAILED` / `ROLE_PERMISSIONS_UNKNOWN_KEYS` "Unknown permission keys: workflow:teleport."
- 403 Access denied (API_KEY_PERMISSION_DENIED, MEMBER_ACTOR_NOT_RESOLVED, ROLE_PERMISSIONS_ADMIN_FORBIDDEN, ROLE_PERMISSIONS_EXCEED_ACTOR): `FORBIDDEN` / `ROLE_PERMISSIONS_ADMIN_FORBIDDEN` "Company roles cannot grant admin-only permissions."
- 409 Duplicate role name: `CONFLICT` / `ROLE_CREATE_DUPLICATE_NAME` "A role with this name already exists in the company."
- 500 Write failed (ROLE_CREATE_QUERY_FAILED, ROLE_RELOAD_FAILED): `INTERNAL_ERROR` / `ROLE_CREATE_QUERY_FAILED` "Failed to create role."