update-role

dci update-role <id> [body]

Updates the name, description and/or permissions of a custom role. Only the fields present in the body change; permissions replaces the full list when present. Preset roles cannot be modified. A service account of a parent tenant can update a descendant tenant's role by setting X-Tenant-Id to that tenant's customer ID.

• id — The unique ID of the role to update.

Pass the request body as name: value arguments or pipe JSON on stdin — see Command structure.

Request

Content-Type: application/json

Field	Type	Required	Description
name	string		The new name of the role. Must be unique among the customer's roles, including preset roles.
description	string		The new description of the role.
permissions	array of string		Permission IDs that replace the role's current permissions, as returned in permissions by GET /iam/v1/roles. Duplicates are ignored.

Example body (JSON)

{
  "name": "FinOps Analyst",
  "description": "Read-only access to cost reports and budgets",
  "permissions": [
    "oeuwhFPi8UTccU1nYjdl",
    "8zXuFyohNSiiLy2ZQ6Xu"
  ]
}

Raw JSON schema

{
  "type": "object",
  "description": "Fields allowed when updating a custom role. At least one field is required.",
  "minProperties": 1,
  "properties": {
    "name": {
      "type": "string",
      "description": "The new name of the role. Must be unique among the customer's roles, including preset roles."
    },
    "description": {
      "type": "string",
      "description": "The new description of the role."
    },
    "permissions": {
      "type": "array",
      "description": "Permission IDs that replace the role's current permissions, as returned in `permissions` by `GET /iam/v1/roles`. Duplicates are ignored.",
      "items": {
        "type": "string"
      }
    }
  }
}

Output

OK - Role updated.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
role	object	Definition and permissions assigned to a role.
role.id	string	The unique ID of the role.
role.name	string	The name of the role.
role.type	string	The type of the role (preset or custom).
role.description	string	The description of the role.
role.customer	string	The customer ID if this is a custom role.
role.permissions	array of string	List of permission IDs assigned to the role.
role.childTenantEligible	boolean	Whether the owning tenant made this role available as a child tenant role.

Raw JSON schema

{
  "type": "object",
  "description": "Response returned after updating a role.",
  "properties": {
    "role": {
      "type": "object",
      "description": "Definition and permissions assigned to a role.",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique ID of the role."
        },
        "name": {
          "type": "string",
          "description": "The name of the role."
        },
        "type": {
          "type": "string",
          "description": "The type of the role (preset or custom)."
        },
        "description": {
          "type": "string",
          "description": "The description of the role."
        },
        "customer": {
          "type": "string",
          "description": "The customer ID if this is a custom role."
        },
        "permissions": {
          "type": "array",
          "description": "List of permission IDs assigned to the role.",
          "items": {
            "type": "string"
          }
        },
        "childTenantEligible": {
          "type": "boolean",
          "description": "Whether the owning tenant made this role available as a child tenant role."
        }
      }
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping

HTTP status	Exit code	Error code	Meaning
400	30	VALIDATION_ERROR	The arguments or request body were rejected. Review the command's flags and payload.
401	10	AUTHENTICATION_FAILED	Not signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
403	11	PERMISSION_DENIED	The DoiT user or the active customer context does not have access.
404	20	RESOURCE_NOT_FOUND	The requested resource does not exist. Check the identifier argument.
409	21	RESOURCE_CONFLICT	The operation conflicts with the resource's current state.
500	40	API_SERVER_ERROR	The API failed to process the request. Retryable; contact DoiT support if it persists.

Related

• create-role — Create role
• delete-role — Delete role
• get-role — Get role
• list-roles — List roles
• API reference: PATCH /iam/v1/roles/{id}

Aliases: updaterole