> ## Documentation Index > Fetch the complete documentation index at: https://api-docs.select.dev/llms.txt > Use this file to discover all available pages before exploring further. # Grant a role to a user > Grant a role to a user, scoped to a resource or to the whole organization. Roles are held against an email address, which need not belong to a member yet: granting to an address you have invited takes effect when they first sign in. ## OpenAPI ````yaml https://api.select.dev/v2/openapi.json post /users/{email}/roles openapi: 3.1.0 info: title: SELECT API (v2) version: 0.1.0 servers: - url: https://api.select.dev/v2 description: SELECT API v2 security: [] paths: /users/{email}/roles: post: tags: - users summary: Grant a role to a user description: >- Grant a role to a user, scoped to a resource or to the whole organization. Roles are held against an email address, which need not belong to a member yet: granting to an address you have invited takes effect when they first sign in. operationId: create_user_role_route_users__email__roles_post parameters: - name: email in: path required: true schema: type: string title: Email - name: x-tenant-id in: header required: true schema: type: string description: The organization ID the request is scoped to. title: X-Tenant-Id description: The organization ID the request is scoped to. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UserRoleGrantCreateV2' responses: '201': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/UserRoleGrantV2' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: UserRoleGrantCreateV2: properties: role: $ref: '#/components/schemas/AccessRole' description: The role to grant the user. scope: anyOf: - $ref: '#/components/schemas/RoleGrantScope' - type: 'null' description: >- The resource the role applies to. Omit to grant it across the whole organization. additionalProperties: false type: object required: - role title: UserRoleGrantCreateV2 UserRoleGrantV2: properties: id: type: string title: Id description: The unique identifier of this role grant. readOnly: true x-terraform-computed: true role: $ref: '#/components/schemas/AccessRole' description: The role the user holds. snowflake_organization_name: anyOf: - type: string - type: 'null' title: Snowflake Organization Name description: Snowflake organization this grant is scoped to, if any. snowflake_account_uuid: anyOf: - type: string - type: 'null' title: Snowflake Account Uuid description: Snowflake account this grant is scoped to, if any. usage_group_id: anyOf: - type: string - type: 'null' title: Usage Group Id description: Usage group this grant is scoped to, if any. entity: $ref: '#/components/schemas/PermissionEntityWithDisplayName' description: >- The resolved scope this grant applies to — its type, id and human readable display name. Falls back to the organization when the grant carries no narrower scope. readOnly: true x-terraform-computed: true is_default: type: boolean title: Is Default description: >- Whether this role applies to everyone in the organization by default rather than being granted to this user. readOnly: true x-terraform-computed: true granted_from_team_name: anyOf: - type: string - type: 'null' title: Granted From Team Name description: >- The team this role is inherited from, when the user holds it through team membership rather than directly. readOnly: true x-terraform-computed: true create_time: type: string title: Create Time description: When the role was granted — RFC 3339 UTC, e.g. 2026-06-05T10:30:00Z. readOnly: true x-terraform-computed: true update_time: type: string title: Update Time description: When the grant was last updated — RFC 3339 UTC. readOnly: true x-terraform-computed: true etag: type: string title: Etag description: Opaque strong ETag for optimistic concurrency. readOnly: true x-terraform-computed: true type: object required: - id - role - entity - is_default - granted_from_team_name - create_time - update_time - etag title: UserRoleGrant description: >- A role a user holds, with the scope it applies to. A user holds a role in one of three ways: granted to them directly, inherited from a team they belong to, or applied to everyone in the organization by default. Only a direct grant can be changed — the other two are edited at their source. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError AccessRole: type: string enum: - admin - editor - monitor_editor - viewer - team_creator title: AccessRole description: The permission level a role grant confers. RoleGrantScope: properties: type: $ref: '#/components/schemas/RoleGrantScopeType' description: The kind of resource this grant applies to. id: anyOf: - type: string - type: 'null' title: Id description: >- Identifier of the resource — the Snowflake organization name, Snowflake account UUID, Databricks account id, Databricks connection id, BigQuery connection id, AWS account id, Tableau site LUID, or usage group id. Required for every scope type except organization. additionalProperties: false type: object required: - type title: RoleGrantScope description: The resource a role grant applies to. PermissionEntityWithDisplayName: properties: type: $ref: '#/components/schemas/PermissionEntityType' id: type: string title: Id display_name: type: string title: Display Name usage_group_details: anyOf: - $ref: '#/components/schemas/UsageGroupDetails' - type: 'null' parent_id: anyOf: - type: string - type: 'null' title: Parent Id type: object required: - type - id - display_name title: PermissionEntityWithDisplayName description: >- Permission entity with a human readable display name. Args: type: The type of the entity. `usage_group`, `snowflake_account`, `snowflake_organization`, `databricks_account`, `databricks_connection`, `team`, or `select_organization`. id: The id of the entity. The `usage_group_id`, `snowflake_account_uuid`, `snowflake_organization_name`, `databricks_account_id`, `databricks_conn_id`, `team_id`, or `organization_id`. display_name: A human readable name for the entity. Typically colon delimited. On this class the property is required. usage_group_details: Optional details about the usage group. Only included in serialization when type is USAGE_GROUP. Note that the hashing and equality check are done based on the `type` and `id` fields as per the `PermissionEntity` class. This means that even if the `display_name` is different, two `PermissionEntityWithDisplayName` instances will still compare equal. ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError RoleGrantScopeType: type: string enum: - organization - snowflake_organization - snowflake_account - databricks_account - databricks_connection - bigquery_connection - aws_account - tableau_site - usage_group title: RoleGrantScopeType description: The kind of resource a role grant applies to. PermissionEntityType: type: string enum: - select_organization - snowflake_organization - snowflake_account - databricks_account - databricks_connection - bigquery_connection - aws_account - tableau_site - team - usage_group title: PermissionEntityType description: >- The type of the permission entity. Comparison operations are supported to understand the level in the hierarchy of the type. NOTE: The object hierarchy is not linear. SELECT Organizations are still at the top, but teams and usage groups are effectively the same level, but will return false if compared. Hierarchy (see ``grants.CONTAINS`` for the authoritative tree): SELECT_ORGANIZATION ├── SNOWFLAKE_ORGANIZATION │ └── SNOWFLAKE_ACCOUNT │ └── USAGE_GROUP ├── DATABRICKS_ACCOUNT │ └── DATABRICKS_CONNECTION ├── BIGQUERY_CONNECTION ├── AWS_ACCOUNT ├── TABLEAU_SITE ├── TEAM │ └── USAGE_GROUP └── USAGE_GROUP UsageGroupDetails: properties: set_name: type: string title: Set Name group_name: type: string title: Group Name type: object required: - set_name - group_name title: UsageGroupDetails description: |- Details about a usage group entity. This is only populated when the entity type is USAGE_GROUP. securitySchemes: HTTPBearer: type: http description: Organization API key (sl_…). scheme: bearer ````