Skip to main content
Create a new permission to define specific actions or capabilities in your RBAC system. Permissions can be assigned directly to API keys or included in roles. Use hierarchical naming patterns like documents.read, admin.users.delete, or billing.invoices.create for clear organization. Important: Permission names must be unique within the workspace. Once created, permissions are immediately available for assignment.

​
Required Permissions

Your root key must have the following permission:
  • rbac.*.create_permission

​
Request

​
name
string
required
Creates a permission with this human-readable name that describes its purpose.Names must be unique within your workspace to prevent conflicts during assignment.Use clear, semantic names that developers can easily understand when building authorization logic.Consider using hierarchical naming conventions like ‘resource.action’ for better organization.Length: 1-512 charactersExamples: users.read, billing.write, analytics.view, admin.manage
​
slug
string
required
Creates a URL-safe identifier for this permission that can be used in APIs and integrations.Must start with a letter and contain only letters, numbers, periods, underscores, and hyphens.Slugs are often used in REST endpoints, configuration files, and external integrations.Should closely match the name but in a format suitable for technical usage.Must be unique within your workspace to ensure reliable permission lookups.Keep slugs concise but descriptive for better developer experience.Pattern: ^[a-zA-Z][a-zA-Z0-9._-]*$Length: 1-128 charactersExample: users-read
​
description
string
Provides detailed documentation of what this permission grants access to.Include information about affected resources, allowed actions, and any important limitations.This internal documentation helps team members understand permission scope and security implications.Not visible to end users - designed for development teams and security audits.Consider documenting:
  • What resources can be accessed
  • What operations are permitted
  • Any conditions or limitations
  • Related permissions that might be needed
Max length: 512 charactersExample: Grants read-only access to user profile information, account settings, and subscription status.

​
Response

​
permissionId
string
required
The unique identifier for the newly created permission.Use this ID to reference the permission in other API operations.Example: perm_5678efgh9012wxyz

​
Examples

curl -X POST https://api.unkey.com/v2/permissions.createPermission \
  -H "Authorization: Bearer <UNKEY_ROOT_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "documents.read",
    "slug": "documents-read",
    "description": "Allows reading document resources"
  }'

​
Without Description

curl -X POST https://api.unkey.com/v2/permissions.createPermission \
  -H "Authorization: Bearer <UNKEY_ROOT_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "files.upload",
    "slug": "files-upload"
  }'

​
Response Example

{
  "meta": {
    "requestId": "req_1234abcd"
  },
  "data": {
    "permissionId": "perm_5678efgh9012wxyz"
  }
}

Build docs developers (and LLMs) love

Get started for freeTalk to us