Grant a role to a user
Grant a role to a user, scoped to a resource or to the whole organization.
Roles are held against an email address, which need not belong to a member yet: granting to an address you have invited takes effect when they first sign in.
Authorizations
Organization API key (sl_…).
Headers
The organization ID the request is scoped to.
Path Parameters
Body
Response
Successful Response
A role a user holds, with the scope it applies to.
A user holds a role in one of three ways: granted to them directly, inherited from a team they belong to, or applied to everyone in the organization by default. Only a direct grant can be changed — the other two are edited at their source.
The unique identifier of this role grant.
The role the user holds.
admin, editor, monitor_editor, viewer, team_creator The resolved scope this grant applies to — its type, id and human readable display name. Falls back to the organization when the grant carries no narrower scope.
Whether this role applies to everyone in the organization by default rather than being granted to this user.
The team this role is inherited from, when the user holds it through team membership rather than directly.
When the role was granted — RFC 3339 UTC, e.g. 2026-06-05T10:30:00Z.
When the grant was last updated — RFC 3339 UTC.
Opaque strong ETag for optimistic concurrency.
Snowflake organization this grant is scoped to, if any.
Snowflake account this grant is scoped to, if any.
Usage group this grant is scoped to, if any.

