---
title: "Add an admin grant to a role"
url: "https://dev.developer-internal.sanofi.com/apis/plta-permissions-api-cbz/versions/88cdfef8-3b56-44ca-883d-5b15378e5a3a/operations/addAdminGrant"
---

> Full API specification: https://dev.developer-internal.sanofi.com/apis/plta-permissions-api-cbz/versions/88cdfef8-3b56-44ca-883d-5b15378e5a3a.md

# Add an admin grant to a role

`POST` `/roles/{roleName}/adminGrants`

Operation ID: `addAdminGrant`

Add an admin grant to a role. The caller needs manageRoles over the role's scope, and must already hold an admin right covering the exact operation and restrictions being granted. The action and resource restrictions must be within the role's declared scope. manageRoles and manageMigrations cannot be granted through a role.

## Path parameters

- `roleName` (string, required) - The name of the role

## Request body (required)

Content types: `application/json`

## Responses

- `201` - Created
- `400` - Bad Request
- `401` - Unauthorized
- `403` - Forbidden
- `404` - Not Found
- `409` - Conflict
- `500` - Internal Server Error

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Permission Administration API
  version: 1.5.0
servers:
  - url: https://dev.api.sanofi.com/permissions
paths:
  /roles/{roleName}/adminGrants:
    parameters:
      - description: The name of the role
        in: path
        name: roleName
        required: true
        schema:
          type: string
    post:
      description: Add an admin grant to a role. The caller needs manageRoles over the
        role's scope, and must already hold an admin right covering the exact
        operation and restrictions being granted. The action and resource
        restrictions must be within the role's declared scope. manageRoles and
        manageMigrations cannot be granted through a role.
      operationId: addAdminGrant
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AdminGrant"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AdminGrant"
          description: Created
        "400":
          $ref: "#/components/responses/400"
        "401":
          $ref: "#/components/responses/401"
        "403":
          $ref: "#/components/responses/403"
        "404":
          $ref: "#/components/responses/404"
        "409":
          $ref: "#/components/responses/409"
        "500":
          $ref: "#/components/responses/500"
      summary: Add an admin grant to a role
      tags:
        - Roles
security:
  - oauth: []
components:
  schemas:
    AdminGrant:
      description: An admin right (an operation, with optional action/resource
        restrictions) attached to a role. Every member of the role inherits it.
        The restrictions must be within the role's declared scope. The caller
        must already hold an admin right covering the exact operation and
        restrictions being granted.
      properties:
        actionRestriction:
          description: Name of the action that will restrict the action usable in this
            operation to a specific hierarchy, within the role's scope.
          examples:
            - write_narrative
            - read_compound
          type: string
        adminGrantId:
          description: The unique identifier of the admin grant, mostly for deletion
            purpose.
          format: uuid
          readOnly: true
          type: string
        operationName:
          description: Name of the operation.
          examples:
            - manageActions
            - manageResources
            - manageAccessRights
          type: string
        resourceRestriction:
          description: Name of the resource that will restrict the resource usable in this
            operation to a specific hierarchy, within the role's scope.
          examples:
            - compound_1245
            - study_1245
          type: string
        roleName:
          description: The name of the role this grant is attached to, as given in the path.
          readOnly: true
          type: string
      required:
        - operationName
      type: object
    BadRequestError:
      properties:
        debugId:
          description: A unique request identifier for correlation purposes.
          example: 00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01
          type: string
        detail:
          description: Error detail
          type: string
        errors:
          description: A list of errors that occurred
          items:
            $ref: "#/components/schemas/BadRequestDetails"
          type: array
        instance:
          default: unknown
          description: URI that identifies the specific occurrence of the problem
          example: https://api.dev.accelerator.sanofi/planets/v1/planets/
          type: string
        status:
          description: HTTP status code
          enum:
            - 400
          type: number
        title:
          description: Human-readable identifier
          type: string
        type:
          description: URI that identifies the type of error that occurred
          example: https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-bad-request
          type: string
      required:
        - type
        - title
        - status
        - debugId
        - detail
      type: object
    UnauthorizedError:
      properties:
        debugId:
          description: A unique request identifier for correlation purposes.
          example: 00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01
          type: string
        detail:
          description: Error detail
          enum:
            - You are not authorized to access this resource
          type: string
        status:
          description: HTTP status code
          enum:
            - 401
          type: number
        title:
          description: Human-readable identifier
          enum:
            - Unauthorized
          type: string
        type:
          description: URI that identifies the type of error that occurred
          example: https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-unauthorized
          type: string
      required:
        - type
        - title
        - status
        - debugId
        - detail
      type: object
    ForbiddenError:
      properties:
        debugId:
          description: A unique request identifier for correlation purposes.
          example: 00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01
          type: string
        detail:
          description: Error detail
          enum:
            - You don't have the permission to access this resource
          type: string
        status:
          description: HTTP status code
          enum:
            - 403
          type: number
        title:
          description: Human-readable identifier
          enum:
            - Forbidden
          type: string
        type:
          description: URI that identifies the type of error that occurred
          example: https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-forbidden
          type: string
      required:
        - type
        - title
        - status
        - debugId
        - detail
      type: object
    NotFoundError:
      properties:
        debugId:
          description: A unique request identifier for correlation purposes.
          example: 00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01
          type: string
        detail:
          description: Error detail
          type: string
        status:
          description: HTTP status code
          enum:
            - 404
          type: number
        title:
          description: Human-readable identifier
          enum:
            - Not Found
          type: string
        type:
          description: URI that identifies the type of error that occurred
          example: https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-not-found
          type: string
      required:
        - type
        - title
        - status
        - debugId
        - detail
      type: object
    ConflictError:
      description: An error that occurs when a request conflicts with the current
        state of the server, usually when creating a resource that already
        exists
      properties:
        debugId:
          description: A unique request identifier for correlation purposes.
          example: 00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01
          type: string
        detail:
          description: Error detail
          type: string
        status:
          description: HTTP status code
          enum:
            - 409
          type: number
        title:
          description: Human-readable identifier
          enum:
            - Conflict
          type: string
        type:
          description: URI that identifies the type of error that occurred
          example: https://backstage.prod.accelerator.sanofi/catalog/planet-example-api/default/api/planet-example-api/components#ConflictError
          type: string
      required:
        - type
        - title
        - status
        - debugId
        - detail
      type: object
    InternalServerError:
      description: Object describing the error format expected in API responses. Based
        on [RFC 9457](https://datatracker.ietf.org/doc/html/rfc9457)
      properties:
        debugId:
          description: A unique request identifier for correlation purposes. [Trace
            Context RFC](https://www.w3.org/TR/trace-context/)
          example: 00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01
          type: string
        detail:
          description: More information about the specific problem, and if it's
            appropriate also steps to correct it. For example information about
            a form validation problem
          example: The service is currently unavailable due to an unexpected error
          type: string
        status:
          description: HTTP status code
          example: 500
          type: number
        title:
          description: Human-readable identifier, usually the same type field should have
            the same title field
          example: Internal Server Error
          type: string
        type:
          description: URI that identifies the type of error that occured
          example: https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-internal/
          type: string
      required:
        - type
        - title
        - status
        - debugId
        - detail
      type: object
    BadRequestDetails:
      properties:
        detail:
          description: Error detail
          example: Planet area must be a valid number
          type: string
        pointer:
          description: Pointer to the field that has the error
          example: "#/planet/area"
          type: string
        rejectedValue:
          description: The value that was rejected
          example: NaN
          type: string
      required:
        - detail
        - pointer
      type: object
  responses:
    "400":
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/BadRequestError"
      description: Bad Request
    "401":
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/UnauthorizedError"
      description: Unauthorized
    "403":
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ForbiddenError"
      description: Forbidden
    "404":
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/NotFoundError"
      description: Not Found
    "409":
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ConflictError"
      description: Conflict
    "500":
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/InternalServerError"
      description: Internal Server Error
  securitySchemes:
    oauth:
      bearerFormat: JWT
      scheme: bearer
      type: http
```