Add Roles to Organization Members

Each organization member can be assigned one or more roles, which are applied when users log in through the organization. To learn more about roles and their behavior, read Role-based Access Control.

You can add roles to members in organizations using either the Auth0 Dashboard or the Management API.

To enable a role for an organization member, you must have already created the role in your tenant.

Auth0 Dashboard

To add roles to an organization member via the Auth0 Dashboard:

1. Navigate to Auth0 Dashboard > Organizations, and select the organization for which you want to configure membership.
2. Select the Members view, and select the name of the member to which you would like to add a role.
3. Select Assign role.
4. Enter the role name(s) you would like to assign to the member, and select Add role(s) to organization.

Management API

To add roles to an organization member via the Management API: Make a POST call to the Create Organization Member Roles endpoint. Be sure to replace ORG_ID, MGMT_API_ACCESS_TOKEN, USER_ID, and ROLE_ID placeholder values with your organization ID, Management API Access Token, user ID, and role ID, respectively.

cURL

curl --request POST \
  --url https://your_auth0_domain/api/v2/organizations/ORG_ID/members/USER_ID/roles \
  --header 'authorization: Bearer MGMT_API_ACCESS_TOKEN' \
  --header 'cache-control: no-cache' \
  --header 'content-type: application/json' \
  --data '{ "roles": [ "ROLE_ID", "ROLE_ID", "ROLE_ID" ] }'

Find Your Auth0 Domain

If your Auth0 domain is your tenant name, your regional subdomain (unless your tenant is in the US region and was created before June 2020), plus .auth0.com. For example, if your tenant name were travel0, your Auth0 domain name would be travel0.us.auth0.com. (If your tenant were in the US and created before June 2020, then your domain name would be https://travel0.auth0.com.)

If you are using custom domains, this should be your custom domain name.

Value	Description
ORG_ID	ID of the organization for which you want to add roles to a member.
MGMT_API_ACCESS_TOKEN	Access Token for the Management API with the scope create:organization_member_roles.
USER_ID	ID of the user to which you want to add the specified role(s).
ROLE_ID	ID of the role you want to add to the specified user for the specified organization. Maximum of 100 roles per user.

Response status codes

Possible response status codes are as follows:

Status code	Error code	Message	Cause
204		Roles successfully associated with user.
400	invalid_body	Invalid request body. The message will vary depending on the cause.	The request payload is not valid.
400	invalid_query_string	Invalid request query string. The message will vary depending on the cause.	The query string is not valid.
401		Invalid token.
401		Invalid signature received for JSON Web Token validation.
401		Client is not global.
403	insufficient_scope	Insufficient scope; expected any of: create:organization_member_roles.	Tried to read/write a field that is not allowed with provided bearer token scopes.
429		Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.