---
title: "Create a directory group role mapping"
method: POST
path: "/directories/{directory_id}/group_role_mappings"
tags: ["Directories"]
---

# Create a directory group role mapping

`POST /directories/{directory_id}/group_role_mappings`

Creates a new directory group to organization role mapping for a directory.
Group role mapping must be enabled on the directory.

## Path parameters

- `directory_id` string, required

## Request body

- object
  - `directory_group_id` string — The group ID from the identity provider. Exactly one of `directory_group_id` or `scim_group_id` is required.
  - `scim_group_id` string — The legacy name for `directory_group_id`. Send either one, or both with the same value; sending both with different values is rejected.
  - `role_id` string, required — The ID of the organization role to assign to members of the group.
  - `precedence` integer — The precedence for this mapping. Lower values take priority when a user belongs to multiple mapped groups. If omitted, the mapping is appended with the next-highest precedence.

## Response `200`

A directory group role mapping

- DirectoryGroupRoleMapping — A mapping from a directory group to an organization role. Members of the group are assigned the role; the lowest-precedence match wins when a user belongs to multiple mapped groups.
  - `object` 'directory_group_role_mapping', required — String representing the object's type. Always "directory_group_role_mapping".
  - `id` string, required — Unique identifier for the directory group role mapping.
  - `directory_id` string, required — The ID of the directory this mapping belongs to.
  - `scim_directory_id` string, required — The legacy name for `directory_id`. Carries the same value.
  - `directory_group_id` string, required — The group ID from the identity provider.
  - `scim_group_id` string, required — The legacy name for `directory_group_id`. Carries the same value.
  - `directory_group_display_name` string, required — The display name of the group, as reported by the identity provider.
  - `scim_group_display_name` string, required — The legacy name for `directory_group_display_name`. Carries the same value.
  - `role` Role
    - `object` 'role', required
    - `id` string, required
    - `name` string, required
    - `key` string, required
    - `description` string, nullable, required
    - `is_creator_eligible` boolean, required — Whether this role is eligible to be an organization creator role
    - `permissions` Permission[], required
      - `object` 'permission', required
      - `id` string, required
      - `name` string, required
      - `key` string, required
      - `description` string, required
      - `type` string, required
      - `created_at` integer, required — Unix timestamp of creation.
      - `updated_at` integer, required — Unix timestamp of last update.
    - `created_at` integer, required — Unix timestamp of creation.
    - `updated_at` integer, required — Unix timestamp of last update.
  - `precedence` integer, required — Mapping precedence, starting at 1. Lower values take priority when a user belongs to multiple mapped groups.
  - `created_at` integer, required — Unix timestamp (milliseconds) of when the mapping was created.
  - `updated_at` integer, required — Unix timestamp (milliseconds) of when the mapping was last updated.

## Other responses

- `400` — Request was not successful
- `401` — Authentication invalid
- `403` — Authorization invalid
- `404` — Resource not found
- `422` — Invalid request parameters

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/revisions/75df3a43fcb2/schema)