Assign a role to a user
curl --request PUT \
--url https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId} \
--header 'Authorization: Bearer <token>'import requests
url = "https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}"
headers = {"Authorization": "Bearer <token>"}
response = requests.put(url, headers=headers)
print(response.text)const options = {method: 'PUT', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}"
req, _ := http.NewRequest("PUT", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_bodyRoles
Assign a role to a user
PUT
/
api
/
v1
/
roles
/
{roleId}
/
users
/
{userId}
Assign a role to a user
curl --request PUT \
--url https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId} \
--header 'Authorization: Bearer <token>'import requests
url = "https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}"
headers = {"Authorization": "Bearer <token>"}
response = requests.put(url, headers=headers)
print(response.text)const options = {method: 'PUT', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}"
req, _ := http.NewRequest("PUT", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant}.cubecloud.dev/api/v1/roles/{roleId}/users/{userId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body🔒 Admin only. Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
Gives the user everything the role grants. Idempotent — assigning a role the user already holds changes nothing. Returns
404 if either the user or the role is unknown.
Unlike the other endpoints here, this one is not limited to your custom roles: it also accepts the id of a built-in role, and assigning one grants everything that role confers. Cube’s Admin role is the exception and cannot be granted this way — it is not among the built-in roles this endpoint resolves, so its id returns 404. No call to this endpoint can make a user an account-wide administrator.