---
title: "Create a temporary permission grant"
method: POST
path: "/v1/{organization}/role/temporary_permission_grant/"
tags: ["Role"]
---

# Create a temporary permission grant

`POST /v1/{organization}/role/temporary_permission_grant/`

Create a new temporary permission grant.

The user that is given the grant will be able to perform actions permitted by the grant for a limited amount of time. Note that any actions that
require comparing the permissions of the user and the permissions of another entity would still use the user and the other entity's role, without
factoring into the temporary permission grants.

#### Permissions
This endpoint requires the following permissions:
* `Role:CreateTemporaryPermissionGrant` for the grant to create.

## Path parameters

- `organization` string, required

## Headers

- `x-mongo-cluster-name` string, nullable — The Mongo cluster name to perform this request in. This is usually not needed unless the organization does not exist yet in the Amigo organization infra config database.
- `Sec-WebSocket-Protocol` string[]

## Request body

- SrcAppEndpointsRoleCreateTemporaryPermissionGrantRequest
  - `user_id` string, required — The ID of the user to grant the temporary permission to.
  - `duration` string, duration, required — In ISO8601 format, the duration that this permission grant will last.
  - `permission_grant` PermissionGrantInstance, required
    - `permission_name` string, required — The name of the permission.
    - `conditions` object, required — A dictionary of attribute name to condition that must be met for this grant to be applicable.
  - `tags` object, required — The tags of the permission grant. Both the key and the value can only contain alphanumeric characters, underscores, or spaces.
  - `justification` string, required

## Response `201`

Succeeded

- SrcAppEndpointsRoleCreateTemporaryPermissionGrantResponse
  - `temporary_permission_grant_id` string, required — The ID of the created temporary permission grant.
  - `expires_at` string, date-time, required — The time in UTC at which the permission grant expires.

## Other responses

- `401` — Invalid authorization credentials.
- `403` — Missing required permissions.
- `404` — Specified organization or user is not found.
- `422` — Invalid request path parameter or request body failed validation.
- `429` — The user has exceeded the rate limit of 100 requests per minute for this endpoint.
- `503` — The service is going through temporary maintenance.

---

[API](https://skmtc.net/amigo/apis/amigo-api.md) · [All operations](https://skmtc.net/amigo/apis/amigo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/amigo/amigo-api/revisions/f0f28319e448/schema)