Assign roles

Platform

Assign or replace roles on a membership using least-privilege and tenant-scoped rules.

Identity

One user identity

Membership

Tenant affiliation

Role

Functional access

Context

Tenant + membership

PUT/v1/memberships/{membership_id}/rolesScope: roles.assign

Endpoint summary

PUT /v1/memberships/{membership_id}/roles requires roles.assign.

Field	Type	Description
roles	string[]	Complete approved role set for the membership
reason	string	Optional audit reason

Role assignment is tenant-scoped, least-privilege, and cannot grant capabilities outside the caller’s delegation boundary.

JSONCopy

{
  "roles": ["pharmacist", "pharmacy_owner"],
  "reason": "branch manager appointment"
}

Code	Meaning
200	Roles updated
400	Unknown or invalid role combination
403	Role assignment not permitted
404	Membership not found