## Create

**post** `/zones/{zoneId}/roles`

Creates a new customer-owned role in the specified zone. The owner_type is always customer; platform roles are managed by Keycard.

### Path Parameters

- `zoneId: string`

### Body Parameters

- `identifier: string`

  Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

- `description: optional string`

  Human-readable description

### Returns

- `Role = object { id, created_at, identifier, 4 more }`

  A role that can be assigned to users within a zone.

  - `id: string`

    Unique identifier of the role

  - `created_at: string`

    Entity creation timestamp

  - `identifier: string`

    Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

  - `owner_type: "platform" or "customer"`

    Who owns this role. Platform-owned roles are managed by Keycard and cannot be modified or deleted via the API; customer-owned roles are user-created.

    - `"platform"`

    - `"customer"`

  - `updated_at: string`

    Entity update timestamp

  - `zone_id: string`

    Zone this role belongs to

  - `description: optional string`

    Human-readable description

### Example

```http
curl https://api.keycard.ai/zones/$ZONE_ID/roles \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $KEYCARD_API_API_KEY" \
    -d '{
          "identifier": "identifier"
        }'
```