---
title: "Assign new roles to a user"
method: POST
path: "/public/v1/users/{userId}/roles"
tags: ["Users - Roles"]
---

# Assign new roles to a user

`POST /public/v1/users/{userId}/roles`

### Overview
Assign one or more roles to an existing user.

### Use Cases
- **Privilege Escalation**: Grant a user additional management permissions.
- **Onboarding**: Finalize a user's access setup by adding specific functional roles.

### Identification
The `{userId}` is a unique numerical identifier.

### Getting User ID
- To find users and their numerical IDs, use the Users Management API:
  - `GET /public/v1/users` - Retrieve all users with their `id` field.
- The `id` field in the user response is the `{userId}` used in this endpoint's path parameter.

### Behavior
- **Additive**: This operation only adds new roles. It will **not** remove or overwrite existing roles.
- **Validation**: Every role name provided must be valid and assigned to your organization. If even one role name is invalid, the entire request will fail (atomic operation).

### Workflow Tip
Call [List Available Roles](#operations-Users_-_Roles-getAvailableRoles) first to ensure you are using correct role names.

### Related Operations
- **List Current Roles**: [GET /public/v1/users/{userId}/roles](#operations-Users_-_Roles-read)
- **Remove Role**: [DELETE /public/v1/users/{userId}/roles/{roleName}](#operations-Users_-_Roles-delete)

### Required Permission
`manage_public_users`

## Path parameters

- `userId` integer, required

## Request body

- string[]

## Response `201`

Created - Roles successfully added. Returns the full, updated list of user roles.

- PublicUserRoleDTO[]
  - `id` integer, required
  - `name` string, required
  - `description` string, nullable

## Other responses

- `403` — 403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.
- `404` — Not Found - Either the user ID is invalid or one of the role names provided does not exist.
- `429` — 429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.
- `500` — 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.

---

[API](https://skmtc.net/prewave/apis/public-prewave-api.md) · [All operations](https://skmtc.net/prewave/apis/public-prewave-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/prewave/public-prewave-api/revisions/466169815b78/schema)