> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Add Permissions to a Role > Widens a role: everyone who already holds it — directly, or through a group — can do the added things. `{id}` is the role's `name`, a slug such as `midaz-editor`; each entry in `permissions` is a permission id. There is no separate step to push the change out to holders; the role IS the grant. Adding a permission the role already carries is not an error, so a partially applied form can safely be submitted again. On success the response has no body (204). Failures: - `400` — `permissions` is missing or empty. - `404` — one of the permissions does not exist. - `422 IDE-1061` — a permission is reserved for machine credentials, so no role a person may hold can carry it; or the role itself is, so it takes no permission here. - `422 IDE-1066` — a permission is declared by a Lerian product, which alone decides the roles that hold it (this includes the M2M permission of a Lerian service's credential); the message names it. Grant the access by adding people to one of the product's roles, or to a group that role is granted to. Permissions earlier in the list are already added. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. ## OpenAPI ````yaml /en/openapi/v3-current/AM-identity.yaml post /v1/roles/{id}/permissions openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager identity component. license: name: Lerian Studio General License title: Plugin Access Manager — Identity API version: v1 servers: - url: https://identity.sandbox.lerian.net security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/roles/{id}/permissions: post: tags: - Roles summary: Add Permissions to a Role description: >- Widens a role: everyone who already holds it — directly, or through a group — can do the added things. `{id}` is the role's `name`, a slug such as `midaz-editor`; each entry in `permissions` is a permission id. There is no separate step to push the change out to holders; the role IS the grant. Adding a permission the role already carries is not an error, so a partially applied form can safely be submitted again. On success the response has no body (204). Failures: - `400` — `permissions` is missing or empty. - `404` — one of the permissions does not exist. - `422 IDE-1061` — a permission is reserved for machine credentials, so no role a person may hold can carry it; or the role itself is, so it takes no permission here. - `422 IDE-1066` — a permission is declared by a Lerian product, which alone decides the roles that hold it (this includes the M2M permission of a Lerian service's credential); the message names it. Grant the access by adding people to one of the product's roles, or to a group that role is granted to. Permissions earlier in the list are already added. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: addRolePermissions parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/AssignPermissionsInput' description: The permissions to add to the role. required: true responses: '204': description: No Content '400': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Bad Request '404': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Not Found '422': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Unprocessable Entity '500': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Internal Server Error '503': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Service Unavailable security: - BearerAuth: [] components: schemas: AssignPermissionsInput: additionalProperties: false properties: permissions: description: Permission identifiers. items: type: string minItems: 1 type: array required: - permissions type: object HTTPError: additionalProperties: false properties: code: type: string entityType: type: string err: {} message: type: string title: type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.