> ## Documentation Index > Fetch the complete documentation index at: https://api-docs.select.dev/llms.txt > Use this file to discover all available pages before exploring further. # Grant a role to a team > Grant a role to a team, scoped to a resource or to the whole organization. Every member of the team inherits the granted role on that scope. ## OpenAPI ````yaml https://api.select.dev/v2/openapi.json post /teams/{team_id}/roles openapi: 3.1.0 info: title: SELECT API (v2) version: 0.1.0 servers: - url: https://api.select.dev/v2 description: SELECT API v2 security: [] paths: /teams/{team_id}/roles: post: tags: - teams summary: Grant a role to a team description: >- Grant a role to a team, scoped to a resource or to the whole organization. Every member of the team inherits the granted role on that scope. operationId: create_team_role_route_teams__team_id__roles_post parameters: - name: team_id in: path required: true schema: type: string title: Team Id - name: x-tenant-id in: header required: true schema: type: string description: The organization ID the request is scoped to. title: X-Tenant-Id description: The organization ID the request is scoped to. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/TeamRoleGrantCreateV2' responses: '201': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/TeamRoleGrantV2' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: TeamRoleGrantCreateV2: properties: role: $ref: '#/components/schemas/AccessRole' description: The role to grant the team's members. scope: anyOf: - $ref: '#/components/schemas/RoleGrantScope' - type: 'null' description: >- The resource the role applies to. Omit to grant it across the whole organization. A usage group can only be granted the viewer role. additionalProperties: false type: object required: - role title: TeamRoleGrantCreateV2 TeamRoleGrantV2: properties: id: type: string title: Id description: The unique identifier of this role grant. readOnly: true x-terraform-computed: true role: $ref: '#/components/schemas/AccessRole' description: The role granted to the team's members. snowflake_organization_name: anyOf: - type: string - type: 'null' title: Snowflake Organization Name description: Snowflake organization this grant is scoped to, if any. snowflake_account_uuid: anyOf: - type: string - type: 'null' title: Snowflake Account Uuid description: Snowflake account this grant is scoped to, if any. usage_group_id: anyOf: - type: string - type: 'null' title: Usage Group Id description: Usage group this grant is scoped to, if any. entity: $ref: '#/components/schemas/PermissionEntityWithDisplayName' description: >- The resolved scope this grant applies to — its type, id and human readable display name. Falls back to the organization when the grant carries no narrower scope. readOnly: true x-terraform-computed: true create_time: type: string title: Create Time description: When the role was granted to the team — RFC 3339 UTC. readOnly: true x-terraform-computed: true type: object required: - id - role - entity - create_time title: TeamRoleGrant description: A role granted to a team, with the scope it applies to. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError AccessRole: type: string enum: - admin - editor - monitor_editor - viewer - team_creator title: AccessRole description: The permission level a role grant confers. RoleGrantScope: properties: type: $ref: '#/components/schemas/RoleGrantScopeType' description: The kind of resource this grant applies to. id: anyOf: - type: string - type: 'null' title: Id description: >- Identifier of the resource — the Snowflake organization name, Snowflake account UUID, Databricks account id, Databricks connection id, BigQuery connection id, AWS account id, Tableau site LUID, or usage group id. Required for every scope type except organization. additionalProperties: false type: object required: - type title: RoleGrantScope description: The resource a role grant applies to. PermissionEntityWithDisplayName: properties: type: $ref: '#/components/schemas/PermissionEntityType' id: type: string title: Id display_name: type: string title: Display Name usage_group_details: anyOf: - $ref: '#/components/schemas/UsageGroupDetails' - type: 'null' parent_id: anyOf: - type: string - type: 'null' title: Parent Id type: object required: - type - id - display_name title: PermissionEntityWithDisplayName description: >- Permission entity with a human readable display name. Args: type: The type of the entity. `usage_group`, `snowflake_account`, `snowflake_organization`, `databricks_account`, `databricks_connection`, `team`, or `select_organization`. id: The id of the entity. The `usage_group_id`, `snowflake_account_uuid`, `snowflake_organization_name`, `databricks_account_id`, `databricks_conn_id`, `team_id`, or `organization_id`. display_name: A human readable name for the entity. Typically colon delimited. On this class the property is required. usage_group_details: Optional details about the usage group. Only included in serialization when type is USAGE_GROUP. Note that the hashing and equality check are done based on the `type` and `id` fields as per the `PermissionEntity` class. This means that even if the `display_name` is different, two `PermissionEntityWithDisplayName` instances will still compare equal. ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError RoleGrantScopeType: type: string enum: - organization - snowflake_organization - snowflake_account - databricks_account - databricks_connection - bigquery_connection - aws_account - tableau_site - usage_group title: RoleGrantScopeType description: The kind of resource a role grant applies to. PermissionEntityType: type: string enum: - select_organization - snowflake_organization - snowflake_account - databricks_account - databricks_connection - bigquery_connection - aws_account - tableau_site - team - usage_group title: PermissionEntityType description: >- The type of the permission entity. Comparison operations are supported to understand the level in the hierarchy of the type. NOTE: The object hierarchy is not linear. SELECT Organizations are still at the top, but teams and usage groups are effectively the same level, but will return false if compared. Hierarchy (see ``grants.CONTAINS`` for the authoritative tree): SELECT_ORGANIZATION ├── SNOWFLAKE_ORGANIZATION │ └── SNOWFLAKE_ACCOUNT │ └── USAGE_GROUP ├── DATABRICKS_ACCOUNT │ └── DATABRICKS_CONNECTION ├── BIGQUERY_CONNECTION ├── AWS_ACCOUNT ├── TABLEAU_SITE ├── TEAM │ └── USAGE_GROUP └── USAGE_GROUP UsageGroupDetails: properties: set_name: type: string title: Set Name group_name: type: string title: Group Name type: object required: - set_name - group_name title: UsageGroupDetails description: |- Details about a usage group entity. This is only populated when the entity type is USAGE_GROUP. securitySchemes: HTTPBearer: type: http description: Organization API key (sl_…). scheme: bearer ````