---
title: "Create a role binding"
method: POST
path: "/v2/role-bindings"
tags: ["Role Bindings"]
---

# Create a role binding

`POST /v2/role-bindings`

Create a new role binding that assigns a role to a user on a resource.

**Payload Requirements**
- `role_id`, `user_id`, `resource_type`, and `resource_id` are required.
- `resource_type` must be `SPACE` or `PROJECT`.
- `resource_id` must be a unique identifier for the selected `resource_type`.
- Only one binding per user and resource is allowed. If the target user
  already has any binding on the resource, the request returns
  `409 Conflict`.
- System-managed fields (`id`, `created_at`, `updated_at`) are returned
  by the server and are rejected on input.

**Valid example**
```json
{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjoxOmxQZzI=",
  "resource_type": "PROJECT",
  "resource_id": "TW9kZWw6MTpGdmxM"
}
```

**Invalid example**
```json
{
  "role_id": "Um9sZToxOlY0S2E=",
  "user_id": "VXNlcjoxOmxQZzI=",
  "resource_type": "PROJECT",
  "resource_id": "U3BhY2U6MTp1Rk4x"
}
```
This fails because `resource_id` must encode a `PROJECT` ID when
`resource_type` is `PROJECT`.

Use `PATCH /v2/role-bindings/{binding_id}` to change the assigned role
for an existing binding.

<Note>This endpoint is in beta, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Note>

## Request body

- CreateRoleBindingRequest
  - `role_id` string, required — A universally unique identifier (base64-encoded opaque string).
  - `user_id` string, required — A universally unique identifier (base64-encoded opaque string).
  - `resource_type` 'SPACE' | 'PROJECT', required — Resource type for the binding. Only `SPACE` and `PROJECT` are supported for single-binding CRUD. `resource_id` must encode the same resource type.
  - `resource_id` string, required — A universally unique identifier (base64-encoded opaque string).

## Response `201`

A role binding object.

- RoleBinding
  - `id` string, required — Unique identifier for the role binding.
  - `role_id` string, required — A universally unique identifier (base64-encoded opaque string).
  - `user_id` string, required — A universally unique identifier (base64-encoded opaque string).
  - `resource_type` 'SPACE' | 'PROJECT', required — Resource type for the binding. Only `SPACE` and `PROJECT` are supported for single-binding CRUD. `resource_id` must encode the same resource type.
  - `resource_id` string, required — A universally unique identifier (base64-encoded opaque string).
  - `created_at` string, date-time, required — Timestamp when the binding was created.
  - `updated_at` string, date-time, required — Timestamp when the binding was last updated.

## Other responses

- `400` — Invalid request
- `401` — Authentication is required
- `403` — Insufficient permissions to access this resource
- `404` — Not found
- `409` — Resource conflict
- `422` — Unprocessable entity
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/arize-ai/apis/arize-rest-api.md) · [All operations](https://skmtc.net/arize-ai/apis/arize-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/arize-ai/arize-rest-api/versions/2ce448f1de13/schema)