Create role

Creates a database role, optionally inheriting the privileges of existing roles.

POST /v1/tenants/{tenant}/db/roles

Define reusable database permissionsCreating a role does not assign it to a user.

Choose a role nameSelect a new non-reserved name.
Set existing parent rolesInherit their privileges when needed.
Create the roleUse the returned name in grants and user assignments.

Before you start

Use your database bearer token.

Connection setup

Use an identity authorized to manage access. Create any inherited roles before referencing them.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Request body

application/json

Limits and accepted values

name must be non-empty, free of control characters, and not a reserved system role name (ll_admin, ll_system).
Every role named in inherits must already exist, else 400.

Field	Type	Required
`inherits`	`string[]`	Optional

Fields in inherits

Field	Type	Required
`inherits`	`string`	Optional

Field	Type	Required
`name`	`string`	Required

Read the result

The response returns the role name. An inherited role contributes its permissions through the role relationship; creating a role does not assign it to a user.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
409	Resolve the conflict before retrying.
413	Split or reduce the request body.
415	Send the required Content-Type.
422	Correct the values or unsupported combination.
429	Honor Retry-After when present; back off.
500	Check the outcome before retrying a write.
501	Check deployment support for this operation.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request POST "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/roles" \
  --header "Authorization: Bearer ${OC_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary '{
  "name": "demo_reader"
}'

Response example

Examples use synthetic values to show the response format.

Response status

{
  "name": "demo_reader"
}

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

HeadersCopy Anchor Link

Request bodyCopy Anchor Link