Create a new access role

POST 
/roles

Creates a new access role. The caller automatically becomes a role manager, and every role manager is added to UsersAttached.

The request body is validated against a strict allow-list: any property other than the six documented ones is rejected with IPV-1008. Role names must be unique and must not begin with the reserved prefix "SystemRole". Not idempotent: a duplicate role name is rejected.

Request

Responses

200

Role created. The body carries the new role's identifier.

Response Headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers

400

Input validation or authorization failure. Body is {"Message": " - "}. Codes: IPV-1008 (a required key is missing, or an unrecognised key was sent), IPV-1001 (RoleName is empty), ROLE-1001 (RoleName uses the reserved "SystemRole" prefix, or a permission is not recognised), GE-1060 (a user in UsersAttached or RoleManagers does not exist), AUTH-1001 / AUTH-1003 / AUTH-1030 / IPV-1002 (authorization).

Response Headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers

500

Backend failure. Codes: DB-1001 / DB-1002 (the role or user profile could not be persisted), GE-1008 (generic). Body is {"Message": " - "}.

Response Headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers