---
title: "Create grant"
method: POST
path: "/preview/v2/grants"
tags: ["Grants"]
---

# Create grant

`POST /preview/v2/grants`

> ⚠️ This endpoint is in [public preview](/preview/roadmap).

Grant a role to a principal (user or token) on a workspace, or org-wide when workspace_id is omitted.

## Request body

- union
  - object
    - `principal_id` string, required
    - `principal_type` 'user', required
    - `workspace_id` string
    - `role_id` string, required
  - object
    - `principal_id` string, required
    - `principal_type` 'token', required
    - `workspace_id` string
    - `role_id` string, required

## Response `201`

Grant created.

- union
  - object
    - `principal_id` string, required
    - `principal_type` 'user', required
    - `object` 'grant', required
    - `id` string, required
    - `workspace` SfcApiWorkspaceSummary
      - `id` string, required
      - `name` string, required
    - `role` SfcApiRoleSummary, required
      - `id` string, required
      - `name` string, required
    - `created_at` integer, required — Unix timestamp.
  - object
    - `principal_id` string, required
    - `principal_type` 'token', required
    - `object` 'grant', required
    - `id` string, required
    - `workspace` SfcApiWorkspaceSummary
      - `id` string, required
      - `name` string, required
    - `role` SfcApiRoleSummary, required
      - `id` string, required
      - `name` string, required
    - `created_at` integer, required — Unix timestamp.

## Other responses

- `400` — Invalid request.
- `401` — Unauthorized.
- `403` — Forbidden.
- `409` — Grant already exists.
- `500` — Internal server error.

---

[API](https://skmtc.net/sfcompute/apis/san-francisco-compute-documentation.md) · [All operations](https://skmtc.net/sfcompute/apis/san-francisco-compute-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sfcompute/san-francisco-compute-documentation/versions/93dd7661e9bb/schema)