Roles
Create a role
Create a new custom role for the authenticated user’s account.
Payload Requirements
nameis required and must be unique within the account.permissionsis required and must contain at least one valid permission identifier (e.g.PROJECT_READ,DATASET_CREATE).- System-managed fields (
id,created_at,updated_at,is_predefined) are rejected if provided.
Valid example
{
"name": "Data Scientist",
"description": "Can read and create datasets and experiments.",
"permissions": ["PROJECT_READ", "DATASET_READ", "DATASET_CREATE"]
}
Invalid example (missing required permissions)
{
"name": "Data Scientist"
}
This endpoint is in beta, read more here.
POST
Authorizations
Most Arize AI endpoints require authentication. For those endpoints that require authentication, include your API key in the request header using the format
Body
application/json
Body containing role creation parameters.
Human-readable name for the role. Must be unique within the account.
Maximum string length:
255Example:
"AI Engineer"
List of permissions to grant. At least one permission is required. Each value
must be a valid permission identifier (e.g. PROJECT_READ, DATASET_CREATE).
Minimum array length:
1A permission identifier following the pattern {RESOURCE}_{ACTION}. Auto-generated from proto/auth/protocol/permissions.proto.
Available options:
AI_PROVIDER_READ, ALYX_RUN, ANNOTATION_CONFIG_CREATE, ANNOTATION_CONFIG_DELETE, ANNOTATION_CONFIG_READ, ANNOTATION_CONFIG_UPDATE, CUSTOM_METRIC_CREATE, CUSTOM_METRIC_DELETE, CUSTOM_METRIC_READ, CUSTOM_METRIC_UPDATE, DASHBOARD_CREATE, DASHBOARD_DELETE, DASHBOARD_READ, DASHBOARD_UPDATE, DATASET_CREATE, DATASET_DELETE, DATASET_EXAMPLE_ANNOTATE, DATASET_EXAMPLE_CREATE, DATASET_EXAMPLE_DELETE, DATASET_EXAMPLE_READ, DATASET_EXAMPLE_UPDATE, DATASET_READ, DATASET_UPDATE, DATA_FABRIC_CONNECTOR_CREATE, DATA_FABRIC_CONNECTOR_DELETE, DATA_FABRIC_CONNECTOR_READ, DATA_FABRIC_CONNECTOR_UPDATE, EVALUATOR_CREATE, EVALUATOR_DELETE, EVALUATOR_READ, EVALUATOR_UPDATE, EXPERIMENT_CREATE, EXPERIMENT_DELETE, EXPERIMENT_EVAL_TASK_CREATE, EXPERIMENT_EVAL_TASK_DELETE, EXPERIMENT_EVAL_TASK_READ, EXPERIMENT_EVAL_TASK_UPDATE, EXPERIMENT_READ, EXPERIMENT_RUN_ANNOTATE, EXPERIMENT_RUN_READ, EXPERIMENT_UPDATE, FILE_IMPORT_CREATE, FILE_IMPORT_DELETE, FILE_IMPORT_READ, FILE_IMPORT_UPDATE, ML_MODEL_CREATE, ML_MODEL_DELETE, ML_MODEL_READ, ML_MODEL_UPDATE, MONITOR_CREATE, MONITOR_DELETE, MONITOR_READ, MONITOR_TRIGGER, MONITOR_UPDATE, ORGANIZATION_CREATE, ORGANIZATION_DELETE, ORGANIZATION_READ, ORGANIZATION_UPDATE, PLAYGROUND_RUN, PLAYGROUND_VIEW_CREATE, PLAYGROUND_VIEW_DELETE, PLAYGROUND_VIEW_READ, PLAYGROUND_VIEW_UPDATE, PROJECT_CREATE, PROJECT_DELETE, PROJECT_EVAL_TASK_CREATE, PROJECT_EVAL_TASK_DELETE, PROJECT_EVAL_TASK_READ, PROJECT_EVAL_TASK_UPDATE, PROJECT_READ, PROJECT_RESTRICT, PROJECT_SPAN_ANNOTATE, PROJECT_SPAN_CREATE, PROJECT_SPAN_DELETE, PROJECT_SPAN_READ, PROJECT_SPAN_UPDATE, PROJECT_UPDATE, PROMPT_CREATE, PROMPT_DELETE, PROMPT_OPTIMIZE_TASK_CREATE, PROMPT_OPTIMIZE_TASK_DELETE, PROMPT_OPTIMIZE_TASK_READ, PROMPT_OPTIMIZE_TASK_UPDATE, PROMPT_READ, PROMPT_UPDATE, QUEUE_CREATE, QUEUE_DELETE, QUEUE_READ, QUEUE_RECORD_ANNOTATE, QUEUE_RECORD_CREATE, QUEUE_RECORD_DELETE, QUEUE_RECORD_READ, QUEUE_RECORD_UPDATE, QUEUE_UPDATE, REMOTE_ENDPOINT_INTEGRATION_CREATE, REMOTE_ENDPOINT_INTEGRATION_DELETE, REMOTE_ENDPOINT_INTEGRATION_READ, REMOTE_ENDPOINT_INTEGRATION_UPDATE, ROLE_BINDING_CREATE, ROLE_BINDING_DELETE, ROLE_BINDING_READ, SERVICE_KEY_CREATE, SERVICE_KEY_DELETE, SERVICE_KEY_READ, SPACE_CREATE, SPACE_DELETE, SPACE_READ, SPACE_UPDATE, TAG_CREATE, TAG_DELETE, TAG_READ, TAG_UPDATE, TRACE_VIEW_CREATE, TRACE_VIEW_DELETE, TRACE_VIEW_READ, TRACE_VIEW_UPDATE, USER_CREATE, USER_DELETE, USER_PERMISSION_UPDATE, USER_READ, USER_UPDATE Example:
[
"PROJECT_READ",
"DATASET_READ",
"DATASET_CREATE",
"EXPERIMENT_READ",
"EXPERIMENT_CREATE"
]Optional description of the role's purpose. Omitted from the response if empty.
Maximum string length:
1000Example:
"Can read and create datasets and experiments but cannot manage spaces."
Response
Role successfully created.
Unique identifier for the role.
Human-readable name of the role.
List of permissions granted by this role. Each value corresponds to a
permission identifier (e.g. PROJECT_READ, DATASET_CREATE).
A permission identifier following the pattern {RESOURCE}_{ACTION}. Auto-generated from proto/auth/protocol/permissions.proto.
Available options:
AI_PROVIDER_READ, ALYX_RUN, ANNOTATION_CONFIG_CREATE, ANNOTATION_CONFIG_DELETE, ANNOTATION_CONFIG_READ, ANNOTATION_CONFIG_UPDATE, CUSTOM_METRIC_CREATE, CUSTOM_METRIC_DELETE, CUSTOM_METRIC_READ, CUSTOM_METRIC_UPDATE, DASHBOARD_CREATE, DASHBOARD_DELETE, DASHBOARD_READ, DASHBOARD_UPDATE, DATASET_CREATE, DATASET_DELETE, DATASET_EXAMPLE_ANNOTATE, DATASET_EXAMPLE_CREATE, DATASET_EXAMPLE_DELETE, DATASET_EXAMPLE_READ, DATASET_EXAMPLE_UPDATE, DATASET_READ, DATASET_UPDATE, DATA_FABRIC_CONNECTOR_CREATE, DATA_FABRIC_CONNECTOR_DELETE, DATA_FABRIC_CONNECTOR_READ, DATA_FABRIC_CONNECTOR_UPDATE, EVALUATOR_CREATE, EVALUATOR_DELETE, EVALUATOR_READ, EVALUATOR_UPDATE, EXPERIMENT_CREATE, EXPERIMENT_DELETE, EXPERIMENT_EVAL_TASK_CREATE, EXPERIMENT_EVAL_TASK_DELETE, EXPERIMENT_EVAL_TASK_READ, EXPERIMENT_EVAL_TASK_UPDATE, EXPERIMENT_READ, EXPERIMENT_RUN_ANNOTATE, EXPERIMENT_RUN_READ, EXPERIMENT_UPDATE, FILE_IMPORT_CREATE, FILE_IMPORT_DELETE, FILE_IMPORT_READ, FILE_IMPORT_UPDATE, ML_MODEL_CREATE, ML_MODEL_DELETE, ML_MODEL_READ, ML_MODEL_UPDATE, MONITOR_CREATE, MONITOR_DELETE, MONITOR_READ, MONITOR_TRIGGER, MONITOR_UPDATE, ORGANIZATION_CREATE, ORGANIZATION_DELETE, ORGANIZATION_READ, ORGANIZATION_UPDATE, PLAYGROUND_RUN, PLAYGROUND_VIEW_CREATE, PLAYGROUND_VIEW_DELETE, PLAYGROUND_VIEW_READ, PLAYGROUND_VIEW_UPDATE, PROJECT_CREATE, PROJECT_DELETE, PROJECT_EVAL_TASK_CREATE, PROJECT_EVAL_TASK_DELETE, PROJECT_EVAL_TASK_READ, PROJECT_EVAL_TASK_UPDATE, PROJECT_READ, PROJECT_RESTRICT, PROJECT_SPAN_ANNOTATE, PROJECT_SPAN_CREATE, PROJECT_SPAN_DELETE, PROJECT_SPAN_READ, PROJECT_SPAN_UPDATE, PROJECT_UPDATE, PROMPT_CREATE, PROMPT_DELETE, PROMPT_OPTIMIZE_TASK_CREATE, PROMPT_OPTIMIZE_TASK_DELETE, PROMPT_OPTIMIZE_TASK_READ, PROMPT_OPTIMIZE_TASK_UPDATE, PROMPT_READ, PROMPT_UPDATE, QUEUE_CREATE, QUEUE_DELETE, QUEUE_READ, QUEUE_RECORD_ANNOTATE, QUEUE_RECORD_CREATE, QUEUE_RECORD_DELETE, QUEUE_RECORD_READ, QUEUE_RECORD_UPDATE, QUEUE_UPDATE, REMOTE_ENDPOINT_INTEGRATION_CREATE, REMOTE_ENDPOINT_INTEGRATION_DELETE, REMOTE_ENDPOINT_INTEGRATION_READ, REMOTE_ENDPOINT_INTEGRATION_UPDATE, ROLE_BINDING_CREATE, ROLE_BINDING_DELETE, ROLE_BINDING_READ, SERVICE_KEY_CREATE, SERVICE_KEY_DELETE, SERVICE_KEY_READ, SPACE_CREATE, SPACE_DELETE, SPACE_READ, SPACE_UPDATE, TAG_CREATE, TAG_DELETE, TAG_READ, TAG_UPDATE, TRACE_VIEW_CREATE, TRACE_VIEW_DELETE, TRACE_VIEW_READ, TRACE_VIEW_UPDATE, USER_CREATE, USER_DELETE, USER_PERMISSION_UPDATE, USER_READ, USER_UPDATE Whether this role is a system-defined predefined role. Predefined roles cannot be updated or deleted.
Timestamp when the role was created.
Timestamp when the role was last updated.
A brief description of the role's purpose.