Skip to main content

create-role 

dci create-role [body]

Creates a custom role in the authenticated customer with the given permission IDs. Permission IDs are the permissions values returned by GET /iam/v1/roles. A service account of a parent tenant can create the role in a descendant tenant by setting X-Tenant-Id to that tenant's customer ID. Requires the Idempotency-Key header so a retried request does not create a second role.

Pass the request body as name: value arguments or pipe JSON on stdin — see Command structure.

Only name is required; omit permissions (or send an empty list) to create a role without any. The name must be nonblank, free of leading or trailing whitespace, and unique among the customer's roles, preset roles included (409 otherwise). Duplicate permission IDs, or IDs that do not exist or are not available to the customer, return 400.

The API requires an Idempotency-Key on every call: retrying with the same key and body returns the original response instead of creating a second role, while the same key with a different body returns 422.

Examples​

# Create a custom role from permission IDs (take them from the `permissions` of `dci list-roles`).
dci create-role name: "FinOps Analyst", description: "Read-only access to cost reports and budgets", permissions: [<permission-id>, <permission-id>] --idempotency-key "$(uuidgen)"
# Create it from a JSON file.
dci create-role --idempotency-key "$(uuidgen)" < role.json
# role.json
{"name": "FinOps Analyst", "description": "Read-only access to cost reports and budgets",
 "permissions": ["<permission-id>", "<permission-id>"]}
# Capture the new role's ID for a script, for example to assign it to a user.
dci create-role name: "FinOps Analyst", permissions: [<permission-id>] --idempotency-key "$(uuidgen)" --output json | jq -r .id

Request​

Content-Type: application/json

FieldTypeRequiredDescription
namestringyesThe name of the role. Must be nonblank, contain no leading or trailing whitespace, and be unique among the customer's roles, including preset roles.
descriptionstringThe description of the role.
permissionsarray of stringPermission IDs to assign to the role, as returned in permissions by GET /iam/v1/roles. Duplicate IDs are rejected. Input order is preserved. Omission or an empty array creates a role without permissions.

Example body (JSON)​

{
  "name": "FinOps Analyst",
  "description": "Read-only access to cost reports and budgets",
  "permissions": [
    "oeuwhFPi8UTccU1nYjdl",
    "8zXuFyohNSiiLy2ZQ6Xu"
  ]
}
Raw JSON schema
{
  "type": "object",
  "description": "Request body to create a custom role.",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "not": {
        "type": "string",
        "pattern": "^[\t-\r …   - 

  　]|[\t-\r …   - 

  　]$"
      },
      "description": "The name of the role. Must be nonblank, contain no leading or trailing whitespace, and be unique among the customer's roles, including preset roles."
    },
    "description": {
      "type": "string",
      "description": "The description of the role."
    },
    "permissions": {
      "type": "array",
      "uniqueItems": true,
      "description": "Permission IDs to assign to the role, as returned in `permissions` by `GET /iam/v1/roles`. Duplicate IDs are rejected. Input order is preserved. Omission or an empty array creates a role without permissions.",
      "items": {
        "type": "string"
      }
    }
  }
}

Output​

Created - Role created.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

FieldTypeDescription
idstringThe unique ID of the role.
namestringThe name of the role.
typestringThe type of the role (preset or custom). One of: "preset", "custom".
descriptionstringThe description of the role. An empty string when no description is set.
customerstringThe customer ID if this is a custom role. An empty string for a preset role.
permissionsarray of stringPermission IDs in stored order. An empty array when no permissions are assigned.
childTenantEligiblebooleanWhether the owning tenant made this role available as a child tenant role.
Raw JSON schema
{
  "type": "object",
  "description": "Definition and permissions assigned to a role.",
  "required": [
    "id",
    "name",
    "type",
    "description",
    "customer",
    "permissions",
    "childTenantEligible"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "The unique ID of the role."
    },
    "name": {
      "type": "string",
      "description": "The name of the role."
    },
    "type": {
      "type": "string",
      "enum": [
        "preset",
        "custom"
      ],
      "description": "The type of the role (preset or custom)."
    },
    "description": {
      "type": "string",
      "description": "The description of the role. An empty string when no description is set."
    },
    "customer": {
      "type": "string",
      "description": "The customer ID if this is a custom role. An empty string for a preset role."
    },
    "permissions": {
      "type": "array",
      "description": "Permission IDs in stored order. An empty array when no permissions are assigned.",
      "items": {
        "type": "string"
      }
    },
    "childTenantEligible": {
      "type": "boolean",
      "description": "Whether the owning tenant made this role available as a child tenant role."
    }
  }
}

Errors​

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping
HTTP statusExit codeError codeMeaning
400, 42230VALIDATION_ERRORThe arguments or request body were rejected. Review the command's flags and payload.
40110AUTHENTICATION_FAILEDNot signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
40311PERMISSION_DENIEDThe DoiT user or the active customer context does not have access.
40921RESOURCE_CONFLICTThe operation conflicts with the resource's current state.
50040API_SERVER_ERRORThe API failed to process the request. Retryable; contact DoiT support if it persists.

Aliases: createrole