---
title: "Create Access Profile"
method: POST
path: "/v2/access-profiles"
tags: ["Access Profile API"]
---

# Create Access Profile

`POST /v2/access-profiles`

Create a new access profile for a team.

## Request body

- SvflowPublicapiCreateAccessProfileRequest
  - `teamId` string, required — The ID of the team to create the access profile for.
  - `name` string, required — The name of the access profile.
  - `description` string, nullable — A description of the access profile.
  - `matchingCriteria` SvflowPubapimodelsAccessProfileMatchingCriteria — Rules that determine which users an access profile applies to. When both groups and current_team are set, they combine with OR: a user matches if they pass either the group criteria or the current-team criteria. Excluded groups are hard-deny and short-circuit regardless.
    - `groups` SvflowPubapimodelsAccessProfileGroupCriteria — Criteria for matching users based on group membership.
      - `matchType` 'ACCESS_PROFILE_GROUP_MATCH_TYPE_UNSPECIFIED' | 'ACCESS_PROFILE_GROUP_MATCH_TYPE_ANY' | 'ACCESS_PROFILE_GROUP_MATCH_TYPE_ALL' — The group matching strategy for an access profile.
      - `includedGroupIds` string[] — IDs of groups whose members are included in this profile.
      - `excludedGroupIds` string[] — IDs of groups whose members are excluded from this profile.
    - `currentTeam` SvflowPubapimodelsAccessProfileCurrentTeamCriteria — Criteria for matching users based on membership on the profile's team.
      - `teamRoles` SvauthModelsTeamRole[] — Built-in team roles to match. Empty means any role on the team matches.
  - `grants` SvflowPubapimodelsAccessProfileGrants — The grants (resources and workflows) provided by an access profile.
    - `appResourceRoles` SvflowPubapimodelsAccessProfileAppResourceRoleGrant[] — App resource roles granted by this profile.
      - `appResourceRoleId` string — The ID of the app resource role.
      - `useTeamDefaultAccessProfile` boolean — Whether this grant automatically uses the team's default access profile.
    - `workflows` SvflowPubapimodelsAccessProfileWorkflowGrant[] — Workflows associated with this profile.
      - `workflowId` string — The ID of the workflow.

## Response `200`

Success

- SvflowPublicapiCreateAccessProfileResponse
  - `data` SvflowPubapimodelsAccessProfile — An access profile defines which entitlements are available to which groups of users, and which workflows apply.
    - `id` string — The ID of the access profile.
    - `teamId` string — The ID of the team that the access profile belongs to.
    - `name` string — The name of the access profile.
    - `description` string, nullable — A description of the access profile.
    - `isTeamDefault` boolean — Whether this is the team's default access profile (server-managed).
    - `createdAt` string, date-time — A timestamp in RFC 3339 format (e.g., "2025-01-15T01:30:15Z").
    - `matchingCriteria` SvflowPubapimodelsAccessProfileMatchingCriteria — Rules that determine which users an access profile applies to. When both groups and current_team are set, they combine with OR: a user matches if they pass either the group criteria or the current-team criteria. Excluded groups are hard-deny and short-circuit regardless.
      - `groups` SvflowPubapimodelsAccessProfileGroupCriteria — Criteria for matching users based on group membership.
        - `matchType` 'ACCESS_PROFILE_GROUP_MATCH_TYPE_UNSPECIFIED' | 'ACCESS_PROFILE_GROUP_MATCH_TYPE_ANY' | 'ACCESS_PROFILE_GROUP_MATCH_TYPE_ALL' — The group matching strategy for an access profile.
        - `includedGroupIds` string[] — IDs of groups whose members are included in this profile.
        - `excludedGroupIds` string[] — IDs of groups whose members are excluded from this profile.
      - `currentTeam` SvflowPubapimodelsAccessProfileCurrentTeamCriteria — Criteria for matching users based on membership on the profile's team.
        - `teamRoles` SvauthModelsTeamRole[] — Built-in team roles to match. Empty means any role on the team matches.
    - `grants` SvflowPubapimodelsAccessProfileGrants — The grants (resources and workflows) provided by an access profile.
      - `appResourceRoles` SvflowPubapimodelsAccessProfileAppResourceRoleGrant[] — App resource roles granted by this profile.
        - `appResourceRoleId` string — The ID of the app resource role.
        - `useTeamDefaultAccessProfile` boolean — Whether this grant automatically uses the team's default access profile.
      - `workflows` SvflowPubapimodelsAccessProfileWorkflowGrant[] — Workflows associated with this profile.
        - `workflowId` string — The ID of the workflow.
    - `builtinProfileType` string — Built-in profile type, if this is a built-in (system-managed) profile. Empty string for user-created profiles. Possible values track svflow.common.AccessProfileBuiltinProfileType (e.g. "team_members").

## Other responses

- `default` — Error

---

[API](https://skmtc.net/serval/apis/serval-public-api.md) · [All operations](https://skmtc.net/serval/apis/serval-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/serval/serval-public-api/versions/0549515e9384/schema)