---
title: "Add permissions to a role without removing existing ones"
method: POST
path: "/roles/{roleId}/permissions"
tags: ["Role"]
---

# Add permissions to a role without removing existing ones

`POST /roles/{roleId}/permissions`

Adds one or more permissions to the role identified by `roleId`, leaving any existing permissions intact. Use this when you want to expand a role's permission set without affecting what it already has; to simultaneously add and remove permissions in one call use `PATCH /roles/{roleId}/permissions/bulk`. Requires the `tenant-id` header (returns 400 if absent or blank). The request body must include a `permissionIds` array of permission ID strings; obtain valid permission IDs from the permissions list endpoints. Returns 200 with the complete, updated list of all permissions now assigned to the role — not just the newly added ones. Note: if the role does not exist, the current implementation returns 500 rather than 404 (tracked in CP-36405).

## Path parameters

- `roleId` string, required

## Headers

- `tenant-id` string

## Request body

- RolePermissionAddRequest — Request body for adding permissions to a role without removing existing ones
  - `permissionIds` string[], required — IDs of the permissions to add to the role

## Response `200`

Permissions added successfully

- PermissionResponseDto[]
  - `id` string — Server-assigned unique identifier for the permission.
  - `resource` string — Name of the resource this permission governs (e.g. 'user', 'roster'). Mirrors the resource value supplied when the permission was created or last replaced.
  - `action` string — Name of the action this permission grants on the resource (e.g. 'read', 'create'). Mirrors the action value supplied when the permission was created or last replaced.
  - `description` string — Human-readable explanation of what the permission allows. Optional; may be null if it was not supplied at creation.
  - `createdAt` string, date-time
  - `updatedAt` string, date-time

## Other responses

- `400` — Bad request - Invalid request data or missing required fields
- `401` — Authentication required - Valid authentication token is missing or invalid
- `403` — Forbidden - User does not have the required permissions to update role permissions
- `500` — Internal server error - An unexpected error occurred while processing the request. No response body is returned. Note: a non-existent role ID currently also surfaces here as a 500 rather than a 404, since not-found conditions are not distinguished from other failures (tracked in CP-36405).

---

[API](https://skmtc.net/certifyos/apis/certify-api-layer.md) · [All operations](https://skmtc.net/certifyos/apis/certify-api-layer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/certifyos/certify-api-layer/revisions/563848e0ecc0/schema)