---
title: "User Organization User Role Create"
method: POST
path: "/user/organization-user-role/{id}/"
tags: ["users"]
---

# User Organization User Role Create

`POST /user/organization-user-role/{id}/`

POST handler with superadmin-only field protection.

Strips superadmin-only fields from non-superadmin requests before
delegating to OrganizationInjectionMixin.post() for org injection.

## Path parameters

- `id` integer, required

## Headers

- `Authorization` string, required

## Request body

- OrganizationUserRoleRequest — Serializer for organization user roles. Security Note: Privilege escalation prevention is handled at the VIEW level (OrganizationMemberView), not here. This serializer is used by org admins to update member roles, so fields (role, permissions_override, ...) must remain writable. The view gates all writes on org admin via ``is_requiring_org_admin_for_write = True`` — a member cannot PATCH their own row to escalate. Any new write path using this serializer MUST apply the same admin gate, since the fields here are privilege-defining.
  - `access_level` integer, required
  - `email` string
  - `role` 'member' | 'admin' | 'owner' | 'keywordsai_admin' | 'annotator' — * `member` - member * `admin` - admin * `owner` - owner * `keywordsai_admin` - keywordsai_admin * `annotator` - annotator
  - `pending` boolean
  - `hidden` boolean
  - `permissions_override` string[], nullable
  - `organization` integer, required
  - `project` string, nullable

## Response `200`

- OrganizationUserRole — Serializer for organization user roles. Security Note: Privilege escalation prevention is handled at the VIEW level (OrganizationMemberView), not here. This serializer is used by org admins to update member roles, so fields (role, permissions_override, ...) must remain writable. The view gates all writes on org admin via ``is_requiring_org_admin_for_write = True`` — a member cannot PATCH their own row to escalate. Any new write path using this serializer MUST apply the same admin gate, since the fields here are privilege-defining.
  - `id` integer, required
  - `access_level` integer, required
  - `user` UserRole, required
    - `id` integer, required
    - `email` string, required
    - `name` string, required
    - `username` string
    - `first_name` string
    - `last_name` string
    - `profile_color` string
    - `has_customized_password` boolean, required
  - `organization_name` string, required
  - `user_count` integer, required
  - `email` string
  - `role` 'member' | 'admin' | 'owner' | 'keywordsai_admin' | 'annotator' — * `member` - member * `admin` - admin * `owner` - owner * `keywordsai_admin` - keywordsai_admin * `annotator` - annotator
  - `pending` boolean
  - `hidden` boolean
  - `permissions_override` string[], nullable
  - `organization` integer, required
  - `project` string, nullable

---

[API](https://skmtc.net/keywordsai/apis/api-reference.md) · [All operations](https://skmtc.net/keywordsai/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keywordsai/api-reference/versions/c26d550029f8/schema)