---
title: "Replace directory group role mappings"
method: PUT
path: "/directories/{directory_id}/group_role_mappings"
tags: ["Directories"]
---

# Replace directory group role mappings

`PUT /directories/{directory_id}/group_role_mappings`

Replaces the entire set of directory group role mappings for a directory. The position of
each item in the `mappings` array determines its precedence (the first item gets
precedence 1). Passing an empty array removes all mappings. Group role mapping must be
enabled on the directory.

## Path parameters

- `directory_id` string, required

## Request body

- object
  - `mappings` object[], required — The desired set of mappings. Array order sets precedence (1-indexed). An empty array clears all mappings.
    - `directory_group_id` string — The group ID from the identity provider. Exactly one of `directory_group_id` or `scim_group_id` is required.
    - `scim_group_id` string — The legacy name for `directory_group_id`. Send either one, or both with the same value; sending both with different values is rejected.
    - `role_id` string, required — The ID of the organization role to assign to members of the group.

## Response `200`

A list of directory group role mappings, ordered by precedence.

- object
  - `data` DirectoryGroupRoleMapping[], required
    - `object` 'directory_group_role_mapping', required — String representing the object's type. Always "directory_group_role_mapping".
    - `id` string, required — Unique identifier for the directory group role mapping.
    - `directory_id` string, required — The ID of the directory this mapping belongs to.
    - `scim_directory_id` string, required — The legacy name for `directory_id`. Carries the same value.
    - `directory_group_id` string, required — The group ID from the identity provider.
    - `scim_group_id` string, required — The legacy name for `directory_group_id`. Carries the same value.
    - `directory_group_display_name` string, required — The display name of the group, as reported by the identity provider.
    - `scim_group_display_name` string, required — The legacy name for `directory_group_display_name`. Carries the same value.
    - `role` Role
      - `object` 'role', required
      - `id` string, required
      - `name` string, required
      - `key` string, required
      - `description` string, nullable, required
      - `is_creator_eligible` boolean, required — Whether this role is eligible to be an organization creator role
      - `permissions` Permission[], required
        - `object` 'permission', required
        - `id` string, required
        - `name` string, required
        - `key` string, required
        - `description` string, required
        - `type` string, required
        - `created_at` integer, required — Unix timestamp of creation.
        - `updated_at` integer, required — Unix timestamp of last update.
      - `created_at` integer, required — Unix timestamp of creation.
      - `updated_at` integer, required — Unix timestamp of last update.
    - `precedence` integer, required — Mapping precedence, starting at 1. Lower values take priority when a user belongs to multiple mapped groups.
    - `created_at` integer, required — Unix timestamp (milliseconds) of when the mapping was created.
    - `updated_at` integer, required — Unix timestamp (milliseconds) of when the mapping was last updated.
  - `total_count` integer, required — Total number of directory group role mappings in the directory.

## Other responses

- `400` — Request was not successful
- `401` — Authentication invalid
- `403` — Authorization invalid
- `404` — Resource not found
- `422` — Invalid request parameters

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/revisions/75df3a43fcb2/schema)