Skip to main content
ZStack
Identity & Access/ZIAM

ZiamBindUserRole

Binds a global ZIAM role to a user by creating a RoleBinding resource. The operation is idempotent; repeated calls return changed=false. project-admin is a global user role and is valid here for every Project; ProjectID only selects the current resource scope. project-owner remains Project-scoped and must use ProjectMembership.

PUT/api/v1/ziam/users/{userUuid}/roles/{roleKey}

Operation ID

ZiamBindUserRole

Since

1.0.0

Execution Mode

Synchronous

Auth Context

Auth Required

Auth Context

Send these values as request headers when calling this API.

AuthorizationstringRequired

Bearer Token

X-Tenant-IDstring

X-Tenant-ID

Request Inputs

application/json

Body Fields

  • roleUuid
    String

    Optional role uuid. roleKey in the path is always required and is the stable binding key.

    Example: 66666666666666666666666666666666

  • enabled
    Boolean

    Whether the binding is enabled. Defaults to true.

    Example: true

Responses

200 OK
200 OK

On success, this API returns the following response structure.

  • status
    String

    Status for this resource

    Example: ok

  • data
    Object

    Response payload data

    • resourceType
      String

      Resource type for this resource

      Example: Project

    • resourceUuid
      String

      Resource uuid for this resource

      Example: 44444444444444444444444444444444

    • subjectType
      String

      Subject type for this resource

      Example: User

    • subjectUuid
      String

      Subject uuid for this resource

      Example: 11111111111111111111111111111111

    • roleKey
      String

      Role key for this resource

      Example: ziam-platform-admin

    • relationshipUuid
      String

      Relationship uuid for this resource

      Example: 77777777777777777777777777777777

    • changed
      Boolean

      true when this request created or updated a relationship; false when the relationship already existed.

      Example: true

    • joinedAt
      String

      Relationship creation time. Returned when a member, project membership, or role binding exists or is created.

      Example: 2026-06-16T10:00:00Z

    • roleKeys
      List

      Role keys attached to this direct membership. project-owner is Project-scoped. project-admin is not authorized from membership roleKeys and must be assigned through a User or Group RoleBinding. Organization and group member metadata reject both roles. Global management roles ziam-super-admin, ziam-platform-admin, ziam-platform-viewer, and ziam-auditor are rejected here and must be assigned through a RoleBinding roleKey.

      Example: project-owner

Change History

View all change history

  • Change Time

    DeletedRequest body fields scopeType, scopeUuidAddedResponse fields roleKeysDeletedResponse fields scopeType, scopeUuid
    View API