Skip to main content
POST
Create Access Profile

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key or Team-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Team keys must allow every team checked by the request. OAuth access depends on the user’s roles and resource access.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
teamId
string
required

The ID of the team to create the access profile for.

name
string
required

The name of the access profile.

description
string | null

A description of the access profile.

matchingCriteria
matching_criteria · object

The rules that determine which users this profile applies to.

grants
grants · object
deprecated

Deprecated: create the profile first, then attach grants through the access-profile-grant endpoints (/v2/access-profile-grants). Still honored for compatibility until writes are rejected.

scopedId
string | null

Stable, team-scoped identity for the profile (apr_ + 22 base62 chars). Omit to have one minted. Must be unique within the team; reserved sentinel values (built-in profiles) are rejected.

Response

200 - application/json

Success

data
data · object

An access profile defines which entitlements are available to which groups of users, and which workflows apply.