---
title: "Create role"
method: POST
path: "/zones/{zoneId}/roles"
tags: ["Zone Roles"]
---

# Create role

`POST /zones/{zoneId}/roles`

Creates a new customer-owned role in the specified zone. The owner_type is always customer; platform roles are managed by Keycard.

## Path parameters

- `zoneId` string, required

## Request body

- IamRoleCreate — Schema for creating a new role
  - `identifier` string, required — Opaque role identifier. Treated as an opaque identifier by the API and unique within a zone.
  - `description` string — Human-readable description

## Response `201`

A role that can be assigned to users within a zone.

- IamRole — A role that can be assigned to users within a zone.
  - `id` string, required — Unique identifier of the role
  - `zone_id` string, required — Zone this role belongs to
  - `identifier` string, required — Opaque role identifier. Treated as an opaque identifier by the API and unique within a zone.
  - `description` string, nullable — Human-readable description
  - `owner_type` 'platform' | 'customer', required — Who owns this role. Platform-owned roles are managed by Keycard and cannot be modified or deleted via the API; customer-owned roles are user-created.
  - `created_at` string, date-time, required — Entity creation timestamp
  - `updated_at` string, date-time, required — Entity update timestamp

## Other responses

- `default` — Error response

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/versions/2f5033ed4491/schema)