Skip to main content
ZStack
Identity & Access/ZIAM

ZiamBindGroupRole

Binds a global ZIAM role to a user group by creating a RoleBinding resource. The operation is idempotent; repeated calls return changed=false. An enabled project-admin binding grants the role globally to active group members; project-owner remains Project-scoped and must use ProjectMembership.

PUT/api/v1/ziam/groups/{groupUuid}/roles/{roleKey}

Operation ID

ZiamBindGroupRole

Since

1.0.0

Execution Mode

Synchronous

Auth Context

Auth Required

Auth Context

Send these values as request headers when calling this API.

AuthorizationstringRequired

Bearer Token

X-Tenant-IDstring

X-Tenant-ID

Request Inputs

application/json

Body Fields

  • roleUuid
    String

    Optional role uuid. roleKey in the path is always required and is the stable binding key.

    Example: 66666666666666666666666666666666

  • enabled
    Boolean

    Whether the binding is enabled. Defaults to true.

    Example: true

Responses

200 OK
200 OK

On success, this API returns the following response structure.

  • status
    String

    Status for this resource

    Example: ok

  • data
    Object

    Response payload data

    • resourceType
      String

      Resource type for this resource

      Example: Project

    • resourceUuid
      String

      Resource uuid for this resource

      Example: 44444444444444444444444444444444

    • subjectType
      String

      Subject type for this resource

      Example: User

    • subjectUuid
      String

      Subject uuid for this resource

      Example: 11111111111111111111111111111111

    • roleKey
      String

      Role key for this resource

      Example: ziam-platform-admin

    • relationshipUuid
      String

      Relationship uuid for this resource

      Example: 77777777777777777777777777777777

    • changed
      Boolean

      true when this request created or updated a relationship; false when the relationship already existed.

      Example: true

    • joinedAt
      String

      Relationship creation time. Returned when a member, project membership, or role binding exists or is created.

      Example: 2026-06-16T10:00:00Z

    • roleKeys
      List

      Role keys attached to this direct membership. project-owner is Project-scoped. project-admin is not authorized from membership roleKeys and must be assigned through a User or Group RoleBinding. Organization and group member metadata reject both roles. Global management roles ziam-super-admin, ziam-platform-admin, ziam-platform-viewer, and ziam-auditor are rejected here and must be assigned through a RoleBinding roleKey.

      Example: project-owner