Create role

What this does: Creates a new custom role in the workspace. Custom roles can be edited and deleted, unlike base roles which are system-defined and read-only.

Role types:

normal: For internal team members (employees, managers, etc.)
guest: For external users like clients or partners with restricted access

Permission inheritance:

Set a parent role ID to inherit permissions from that role
Inherited permissions can be overridden by explicitly setting them in the permissions map
This allows creating role variants without duplicating permission configurations

Permission validation:

Permissions are automatically validated against disallowed permissions for the role type
Guest roles have restrictions on certain permissions (e.g., cannot manage workspace settings)
Invalid permissions are rejected with appropriate error messages

Required fields:

name: Display name for the role
icon: Icon identifier (e.g., “ri-user-star-line” or “:person_in_tuxedo:”)
type: Either “normal” or “guest”

Optional fields:

description: Human-readable description of the role’s purpose
parentId: ID of parent role for permission inheritance
permissions: Map of permission keys to boolean values (inherited from parent if not specified)

What is returned: Returns the complete role details including the generated role ID, creation timestamp, and all permissions (including inherited ones).

Use cases:

Create specialized roles for specific teams or departments
Set up guest roles for external collaborators
Build role templates that can be customized per workspace

POST/administration/roles

Authorization

AuthorizationOAuth2 access token · headerrequired

Scopes:api:write

AuthorizationBearer token (JWT) · headerrequired

Query parameters

fieldsToReturnstring

Comma-separated list of top-level response fields to return. Overrides the endpoint compact default unless responseShape=full is used.

responseShapestring

Advanced override. Omit for the endpoint compact default. Use full only when you need the complete endpoint response, including nested fields that are not selectable with fieldsToReturn.

Allowed:compactfull

Header parameters

LT-Response-Shapestring

Advanced override. Set to full only when you need the complete endpoint response, including nested fields that are not selectable with fieldsToReturn.

Allowed:full

Request body

requiredapplication/json

descriptionstring

Human-readable description explaining the role purpose and responsibilities. Maximum 400 characters.

iconstringrequired

Icon identifier for the role. Can be a RemixIcon class name (e.g., "ri-user-star-line") or an emoji code (e.g., ":person_in_tuxedo:"). Used for visual identification in role lists and user interfaces.

namestringrequired

Display name for the role. This is shown in user interfaces when selecting or displaying roles.

parentIdstring

ID of the parent role for permission inheritance. If provided, this role will inherit all permissions from the parent role. Inherited permissions can be overridden by explicitly setting them in the permissions map. Must not create circular dependencies (cannot set a child role as parent).

permissionsobject

Map of permission keys to boolean values. Keys are permission identifiers (e.g., "projects.create", "tasks.delete"). Values are true to allow the permission or false to disallow it. If not provided and a parent role is set, permissions are inherited from the parent. Guest roles cannot have certain permissions (e.g., workspace administration).

typestringrequired

Role type determines the intended use case and permission restrictions. "normal" roles are for internal team members (employees, managers). "guest" roles are for external users like clients or partners and have additional permission restrictions.

Allowed:normalguest

Responses

200

createdAtstring<date-time>

ISO 8601 timestamp indicating when this custom role was created. Only present for custom roles, not base roles.

createdBystring

User ID of the person who created this custom role. Only present for custom roles, not base roles.

descriptionstringrequired

Human-readable description of the role purpose and responsibilities, localized based on user language preference.

editedAtstring<date-time>

ISO 8601 timestamp indicating when this custom role was last modified. Only present for custom roles, not base roles.

effectivePermissionsobjectrequired

Permission map after resolving the full parent chain and child overrides.

iconstringrequired

Icon identifier for the role. Can be a RemixIcon class name (e.g., "ri-user-line") or an emoji code (e.g., ":person_in_tuxedo:"). Used for visual identification in role lists.

idstringrequired

Unique identifier for the role. Base roles have IDs containing underscore-prefixed identifiers (e.g., "_root_", "_ceo_", "_staff_"). Custom roles have workspace-prefixed IDs.

namestringrequired

Display name of the role, localized based on user language preference.

parentIdstring

ID of the parent role if this role inherits permissions from another role. Undefined if the role has no parent (e.g., base roles or top-level custom roles).

permissionsobjectrequired

Complete map of all permissions for this role. Keys are permission identifiers (e.g., "projects.create", "tasks.delete"). Values are true if the permission is explicitly allowed, false if explicitly disallowed, or missing if inherited from parent role. This map includes both explicitly set permissions and inherited permissions.

rawPermissionsobjectrequired

Permissions explicitly stored or defined on this role before inheritance.

readOnlybooleanrequired

Boolean flag indicating if this is a base role (system-defined) that cannot be modified or deleted. Base roles include Root, CEO, Team Leader, Staff, and Guest.

typestringrequired

Role type indicating the intended use case. "normal" for internal team members, "guest" for external users. Determines permission restrictions.

401Unauthorized - Invalid or missing authentication token

403Forbidden - Insufficient API scopes or permissions

Request

curl -X POST "https://leadtime.app/api/public/administration/roles" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "type": "normal"
}'

const response = await fetch("https://leadtime.app/api/public/administration/roles", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_ACCESS_TOKEN",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "type": "normal"
})
});

import requests

response = requests.post(
    "https://leadtime.app/api/public/administration/roles",
    headers={
        "Authorization": "Bearer YOUR_ACCESS_TOKEN",
        "Content-Type": "application/json"
    },
    json={
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": True,
    "projects.delete": False
  },
  "type": "normal"
},
)

Response

{
  "createdAt": "2024-01-01T00:00:00Z",
  "createdBy": "string",
  "description": "Standard employee role",
  "editedAt": "2024-01-01T00:00:00Z",
  "effectivePermissions": {
    "profile.manage": true,
    "tasks.create": true,
    "tasks.delete": false
  },
  "icon": "ri-user-line",
  "id": "workspace-id_employee",
  "name": "Employee",
  "parentId": "workspace-id_admin",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "rawPermissions": {
    "tasks.create": true,
    "tasks.delete": false
  },
  "readOnly": false,
  "type": "normal"
}