> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant a Role to Users

> Gives one or more people a role directly, without putting them in a group.

This is the exception rather than the rule: the usual path is to grant the role to a group (`POST /v1/roles/{id}/groups`) and put people in it. Use it for a genuinely individual case.

Granting it to somebody who already holds it is not an error. On success the response has no body (204).

Failures:
- `400` — `users` is missing or empty.
- `404` — no such role in your organization, or one of the users does not exist.
- `422 IDE-1061` — the role is reserved for machine credentials; no person may hold it. Revoking it stays open.
- `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml post /v1/roles/{id}/users
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager identity component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Identity API
  version: v1
servers:
  - url: https://identity.sandbox.lerian.net
security: []
tags:
  - description: >-
      M2M-only: each plugin declares its own permissions, roles and M2M
      contract, and the server reconciles them.
    name: Declarations
  - description: >-
      A tenant administrator's customers. Each partner holds what its
      credentials may DO (permissions, per product) and WHERE they may do it
      (scope, per product and dimension); an M2M application attached to one is
      confined to that intersection. Administrator-only: authorized on the
      "partners" resource, and every route resolves the owning organization from
      the caller's token.
    name: Partners
paths:
  /v1/roles/{id}/users:
    post:
      tags:
        - Roles
      summary: Grant a Role to Users
      description: >-
        Gives one or more people a role directly, without putting them in a
        group.


        This is the exception rather than the rule: the usual path is to grant
        the role to a group (`POST /v1/roles/{id}/groups`) and put people in it.
        Use it for a genuinely individual case.


        Granting it to somebody who already holds it is not an error. On success
        the response has no body (204).


        Failures:

        - `400` — `users` is missing or empty.

        - `404` — no such role in your organization, or one of the users does
        not exist.

        - `422 IDE-1061` — the role is reserved for machine credentials; no
        person may hold it. Revoking it stays open.

        - `503 IDE-0066` — the identity provider is unavailable (unreachable,
        too slow to answer, or failing). Nothing about the request was wrong;
        retry it later.
      operationId: grantRoleToUsers
      parameters:
        - description: Role ID.
          in: path
          name: id
          required: true
          schema:
            description: Role ID.
            examples:
              - midaz-editor
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssignUsersInput'
              description: The users to grant the role to.
        required: true
      responses:
        '204':
          description: No Content
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Bad Request
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Not Found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Unprocessable Entity
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
      security:
        - BearerAuth: []
components:
  schemas:
    AssignUsersInput:
      additionalProperties: false
      properties:
        users:
          description: User identifiers.
          items:
            type: string
          minItems: 1
          type: array
      required:
        - users
      type: object
    HTTPError:
      additionalProperties: false
      properties:
        code:
          type: string
        entityType:
          type: string
        err: {}
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.