> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant a Role to Groups

> Gives one or more groups a role. Everybody in those groups can do what the role allows, and so can anybody added to them later.

This is the normal way access is granted here: grant to the group once, then manage people by membership. `{id}` is the role's slug; each entry in `groups` is a group's `name`, such as `midaz-viewer-group`.

Granting a role a group already holds is not an error. On success the response has no body (204).

Failures:
- `400` — `groups` is missing or empty.
- `404` — no such role in your organization.
- `422 IDE-1061` — the role is reserved for machine credentials; no group may hold it. Revoking it stays open.
- `422 IDE-1067` — the role is declared by a Lerian product, which alone decides the groups it is granted to; the message names it. Grant the access by adding people to the role itself, or to a group the product already grants it to. Nothing is granted when any of the groups is new.
- `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml post /v1/roles/{id}/groups
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager identity component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Identity API
  version: v1
servers:
  - url: https://identity.sandbox.lerian.net
security: []
tags:
  - description: >-
      M2M-only: each plugin declares its own permissions, roles and M2M
      contract, and the server reconciles them.
    name: Declarations
  - description: >-
      A tenant administrator's customers. Each partner holds what its
      credentials may DO (permissions, per product) and WHERE they may do it
      (scope, per product and dimension); an M2M application attached to one is
      confined to that intersection. Administrator-only: authorized on the
      "partners" resource, and every route resolves the owning organization from
      the caller's token.
    name: Partners
paths:
  /v1/roles/{id}/groups:
    post:
      tags:
        - Roles
      summary: Grant a Role to Groups
      description: >-
        Gives one or more groups a role. Everybody in those groups can do what
        the role allows, and so can anybody added to them later.


        This is the normal way access is granted here: grant to the group once,
        then manage people by membership. `{id}` is the role's slug; each entry
        in `groups` is a group's `name`, such as `midaz-viewer-group`.


        Granting a role a group already holds is not an error. On success the
        response has no body (204).


        Failures:

        - `400` — `groups` is missing or empty.

        - `404` — no such role in your organization.

        - `422 IDE-1061` — the role is reserved for machine credentials; no
        group may hold it. Revoking it stays open.

        - `422 IDE-1067` — the role is declared by a Lerian product, which alone
        decides the groups it is granted to; the message names it. Grant the
        access by adding people to the role itself, or to a group the product
        already grants it to. Nothing is granted when any of the groups is new.

        - `503 IDE-0066` — the identity provider is unavailable (unreachable,
        too slow to answer, or failing). Nothing about the request was wrong;
        retry it later.
      operationId: grantRoleToGroups
      parameters:
        - description: Role ID.
          in: path
          name: id
          required: true
          schema:
            description: Role ID.
            examples:
              - midaz-editor
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssignGroupsInput'
              description: The groups to grant the role to.
        required: true
      responses:
        '204':
          description: No Content
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Bad Request
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Not Found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Unprocessable Entity
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
      security:
        - BearerAuth: []
components:
  schemas:
    AssignGroupsInput:
      additionalProperties: false
      properties:
        groups:
          description: Group identifiers.
          items:
            type: string
          minItems: 1
          type: array
      required:
        - groups
      type: object
    HTTPError:
      additionalProperties: false
      properties:
        code:
          type: string
        entityType:
          type: string
        err: {}
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.