---
title: "Grants a role to a user (accessible to Secretariat or Org Admin)"
method: POST
path: "/registry/org/{shortname}/user/{username}/grant-role"
tags: ["Registry User"]
---

# Grants a role to a user (accessible to Secretariat or Org Admin)

`POST /registry/org/{shortname}/user/{username}/grant-role`

<h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the target organization</p>  <h2>Expected Behavior</h2>  <p><b>Admin User:</b> Grants a role to a user in the Admin's organization</p>  <p><b>Secretariat:</b> Grants a role to a user in any organization</p>

## Path parameters

- `shortname` string, required
- `username` string, required

## Headers

- `CVE-API-ORG` string, required
- `CVE-API-USER` string, required
- `CVE-API-KEY` string, required

## Request body

- object
  - `role` 'ADMIN', required

## Response `200`

Role granted successfully

- object
  - `message` string

## Other responses

- `400` — Bad Request
- `401` — Not Authenticated
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.net/cveproject/apis/cve-services-api.md) · [All operations](https://skmtc.net/cveproject/apis/cve-services-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cveproject/cve-services-api/revisions/37d9d2a0b112/schema)