Creates a role in the account you are calling as. The account is taken from the caller and cannot be set from the request. The response is the same shape as reading the role, so a follow-up read is not needed.
name, code and permissions are all required; a request missing any of them comes back as a 422 naming the ones at fault. A permissions object granting more than the caller's own role holds is rejected the same way.
options is stored whole. The object you send replaces the stored one rather than merging into it, so send every key you want to keep.
Display name of the role, up to 255 characters. This is what administrators pick from when assigning someone a role.
What the role may do, as an object of permission names against true or false. The set of names is the account's own and is not enumerated here - read an existing role to see the ones available to you, and send the same shape back. A role cannot be given a permission the caller's own role does not hold; attempting it is rejected.
Optional limits on which records the role may act on, as an object keyed by the area being limited. Structure is not part of the contract - build the limits in the admin console and send back what a read returns. Entries naming an area the role has no permission for are dropped rather than rejected, so a role can come back with fewer limits than were sent.
Optional values to fill in automatically on records this role creates. Structure is not part of the contract - build it in the admin console and send back what a read returns. Each attribute may appear only once.
Whether the role is a lite administrator, a reduced role whose permissions are limited to a fixed subset. Setting it discards any permission outside that subset rather than rejecting the request.
Whether accounts below this one may use the role as well as the account that owns it.
Stable identifier for the role, up to 64 characters of letters, digits, hyphens and underscores; anything else is stripped. Use it to map the role to one in your identity provider when signing in through SSO. Must be unique within the account, and one is generated if you leave it empty.
Whether the admin console offers this role the simplified attribute picker instead of the full one.
- Mock serverhttps://developer.rosterfy.com/_mock/api-docs/openapi/api/v2/account/role
- Your Rosterfy accounthttps://example.rosterfy.com/api/v2/account/role
curl -i -X POST \
https://developer.rosterfy.com/_mock/api-docs/openapi/api/v2/account/role \
-H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
-H 'Content-Type: application/json' \
-H 'Rosterfy-Platform: admin' \
-d '{
"name": "Example Role",
"permissions": {
"account": true,
"account:read": true,
"account:update": true,
"event": true,
"event:read": true,
"event:create": true,
"event:update": true,
"user": true,
"user:read": true,
"user:update": true,
"report": true,
"report:read": true
},
"horizontal": "{}",
"prefill": [],
"is_lite_admin": 0,
"is_inheritable": 0,
"code": "example-role",
"is_simple_attribute_selection": 0,
"options": {
"protect_pii": true
}
}'{ "object": { "id": 5, "name": "Example Role", "code": "example-role", "permissions": { … }, "horizontal": null, "prefill": null, "is_system": 1, "is_lite_admin": 0, "is_simple_attribute_selection": 0, "is_restricted": 0, "is_inheritable": 0, "access_required_modules": null, "options": null, "created_at": "2026-06-09T05:33:39.000000Z", "updated_at": "2026-06-09T05:33:39.000000Z", "user_dashboard_id": null }, "nice": { "rrn": "rrn:local:20101:role:5" }, "relations": [], "permissions": { "read": true, "update": false, "delete": false, "update_message": "You cannot update a role you are assigned to.", "copy": true } }