Define a role

POST

/provision/databases/{id}/roles

A named scope over this database — which operations, which tables,
and within a table which columns — defined once and granted many
times. Nothing reaches the engine: no CREATE ROLE, no GRANT; the data
plane enforces the scope before a pooled connection is used. The name
is what a holder signs as, so it is an identifier and never changes.

Capability: access:write (area resource, on the database).

Request

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

Defined

Bodyapplication/json

🟠400

🟠409

🟠401KlockUnauthorized

🟠403CapabilityMissing

🟠404NotFound

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/provision/databases//roles' \
--header 'Content-Type: application/json' \
--data '{
    "name": "string",
    "description": "string",
    "scope": {
        "ops": [
            "read"
        ],
        "tables": [
            "string"
        ],
        "columns": {
            "property1": [
                "string"
            ],
            "property2": [
                "string"
            ]
        }
    }
}'

Response Example

201 - Example 1

{
    "role": {
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "name": "string",
        "description": "string",
        "scope": {
            "ops": [
                "read"
            ],
            "tables": [
                "string"
            ],
            "columns": {
                "property1": [
                    "string"
                ],
                "property2": [
                    "string"
                ]
            }
        },
        "createdAt": "2019-08-24T14:15:22.123Z",
        "updatedAt": "2019-08-24T14:15:22.123Z",
        "holders": {
            "grants": 0,
            "keys": 0
        }
    },
    "next": "string"
}

Modified at 2026-10-05 14:01:12

The database's roles

One role