Skip to content
Docs
Roles
Assign

Assign role to user

API Reference
Zones
Users
Roles

Assign role to user

client.Zones.Users.Roles.Assign(ctx, userID, params) (*RoleAssignment, error)
POST/zones/{zoneId}/users/{userId}/roles

Assigns a role to the user. Provide exactly one of role_id or role_identifier; when role_identifier is used, owner_type is required to disambiguate roles that share an identifier across owner types (and must be omitted with role_id). An optional (scope_type, scope_id) pair scopes the grant; only platform roles on the org zone may carry a scope, and a zone scope must reference a different zone in the same organization.

ParametersExpand Collapse
userID string
params ZoneUserRoleAssignParams
ZoneID param.Field[string]

Path param: Zone ID

RoleAssignmentCreate param.Field[RoleAssignmentCreate]optional

Body param: Schema for assigning a role to a principal. Provide exactly one of role_id or role_identifier. When role_identifier is used, owner_type is required to disambiguate roles that share an identifier across owner types; owner_type must be omitted when role_id is used.

ReturnsExpand Collapse
type RoleAssignment struct{…}

Represents a role assigned to a principal within a zone

ID string

Unique identifier of the role assignment

CreatedAt Time

Entity creation timestamp

formatdate-time
PrincipalID string

ID of the principal the role is assigned to (a user, application, or group ID).

PrincipalType string

The kind of principal the role is assigned to: user, application, or group. A role assigned to a group is inherited by that group's members.

RoleID string

ID of the assigned role

RoleIdentifier string

Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

minLength1
maxLength255
RoleOwnerType RoleAssignmentRoleOwnerType

Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.

Accepts one of the following:
const RoleAssignmentRoleOwnerTypePlatform RoleAssignmentRoleOwnerType = "platform"
const RoleAssignmentRoleOwnerTypeCustomer RoleAssignmentRoleOwnerType = "customer"
UpdatedAt Time

Entity update timestamp

formatdate-time
ZoneID string

Zone this assignment belongs to

ScopeID stringoptional

The ID of the scoped resource. Null when the assignment is unscoped.

ScopeType stringoptional

The kind of resource this grant is scoped to (e.g. zone). Null when the assignment is unscoped (applies to the owning zone itself).

Assign role to user

package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  roleAssignment, err := client.Zones.Users.Roles.Assign(
    context.TODO(),
    "userId",
    keycard.ZoneUserRoleAssignParams{
      ZoneID: "zoneId",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", roleAssignment.ID)
}

{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "principal_id": "principal_id",
  "principal_type": "principal_type",
  "role_id": "role_id",
  "role_identifier": "role_identifier",
  "role_owner_type": "platform",
  "updated_at": "2019-12-27T18:11:19.117Z",
  "zone_id": "zone_id",
  "scope_id": "scope_id",
  "scope_type": "scope_type"
}
Returns Examples
{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "principal_id": "principal_id",
  "principal_type": "principal_type",
  "role_id": "role_id",
  "role_identifier": "role_identifier",
  "role_owner_type": "platform",
  "updated_at": "2019-12-27T18:11:19.117Z",
  "zone_id": "zone_id",
  "scope_id": "scope_id",
  "scope_type": "scope_type"
}