CreateRole

Create a new role.

Requires access_control.create permission. This command takes no blobs. Assign the resulting role with CreateUser or UpdateUser.

Parameters

Parameter	Type / required	Default and behavior
name	string / required	Unique role name; no default.
objects	object / optional	All permissions false when omitted; applies to data objects and remote credentials.
indexes	object / optional	All permissions false when omitted; applies to property indexes.
access_control	object / optional	All permissions false when omitted; applies to users and roles.

Permission objects

Each permission object accepts create, read, update, and delete. Each field is an optional Boolean defaulting to false. For example, {"read": true} grants read access in that permission category. A role name alone grants nothing; users receive permissions through their assigned roles.

Details

By default, no permissions are granted for a role. Permissions must be explicitly granted.

If a role with the same name already exist, an error is returned.

Response and recovery

Successful creation returns status: 0. A duplicate name returns status: -1 with Cannot create role: Role already exists!. Inspect the existing role with GetRoles, then choose a new name or use UpdateRole. Permission failures also return status: -1.

Role creation happens during response processing. See Responses before retrying a mixed query after a response or connection failure.

Examples

Add a “researcher” role that can create and read objects, but cannot update or delete them:

[{
    "CreateRole": {
        "name": "researcher",
        "objects": {
            "create": true,
            "read": true,
            "update": false,
            "delete": false
        },
        "indexes": {
            "create": false,
            "read": false,
            "update": false,
            "delete": false
        },
        "access_control": {
            "create": false,
            "read": false,
            "update": false,
            "delete": false
        }
    }
}]

Result of successful command:

[{
    "CreateRole": {
        "status": 0
    }
}]

Add a “architect” role using CreateRole command:

[{
    "CreateRole": {
        "name": "architect",
        "objects": {
            "create": true,
            "read": true,
            "update": false,
            "delete": false
        },
        "indexes": {
            "create": true,
            "read": true,
            "update": true,
            "delete": true
        },
        "access_control": {
            "create": false,
            "read": true,
            "update": false,
            "delete": false
        }
    }
}]

Result of successful command:

[{
    "CreateRole": {
        "status": 0
    }
}]