How to create roles and permission via the WorkOS SDK?

[sagar7993]

I can see in the WorkOS dashboard that I can create/update roles and permissions, and attach a permission to a role via the dashboard UI. I do not see any way to achieve this via code. Could you help by providing code samples on how to do this.

I need to be able to update roles for a user by email, and I also need to be able to update permissions for specific users/roles.

[PaulAsjes]

Hi there @sagar7993, creating and updating roles and permissions isn't currently supported by the WorkOS API, but it's something that we're actively discussing. I don't have a timeline to share at the moment, but I've shared this with the team to help us as we plan future roles and permissions features.

[tburgin]

Just want to +1 this issue. We are considering moving to WorkOS, being able to create organization roles from the API would unblock us.

[mattgd]

Hi all! I'm from the WorkOS team and we're considering adding management APIs for roles and permissions.
I'd like to understand each of your use cases:

1. Do you have a need to manage environment roles via the WorkOS API, or only organization-specific roles?
2. How would roles get created/updated? By your users from a UI in your application, or some other way?
3. Do you have any need to create permissions via API? If so, how do you use permissions for access control in your application?

Feel free to include any other information that might be helpful. Tagging @sagar7993, @tburgin, and @russellhancox as you'd shown interest above, but others are free to chime in.

[tburgin]

Hello! Great to hear you are considering APIs for roles and permissions.

1. We are looking for an API around managing organization-specific roles.
2. The organization-specific roles will be created by users of our app from a UI. They will be able to choose from a relatively static, but large set of permissions.
3. The list of permissions will be relatively static. An API is not required. The only time we would change or add permissions is during development of new features that require new permissions. We would probably make use of an API if available, just for automation, but it is low priority.

[mattgd]

@tburgin Very helpful, thanks for this info! If in the future we had a flow for managing organization roles via the WorkOS Admin Portal, would that be useful to you? Or would still prefer to have your own UI for managing roles? More than likely we'd still have a public API, but trying to gauge interest in an Admin Portal-driven experience.

[tburgin]

An Admin Portal-driven experience would actually be great. We already make use of the dsync portal, so this would fit.

[sagar7993]

• Do you have a need to manage environment roles via the WorkOS API, or only organization-specific roles?
• How would roles get created/updated? By your users from a UI in your application, or some other way?
• Do you have any need to create permissions via API? If so, how do you use permissions for access control in your application?

1. I need to assign/update both environment roles/permissions, as well as org specific roles for my users
2. Roles will be assigned/updated via my dashboard UI. I need a layout where I can list each user, and assign a env role/permission to them, in addition to that I need to be able to select each org that the user is a part of and assign org-specific roles to them
3. As of now I don't have a need to do this via API's, UI implementation is all I'm looking for currently

[mattgd]

Thanks for your response @sagar7993. I just want to confirm a couple things:

1. Do you need to create new environment/organization roles for your users, or just assign existing roles you've previously created in the WorkOS dashboard?
2. Got it. If it happens to be of use to you, we have a WorkOS Widget for managing users, which includes editing their role.

[sagar7993]

Thanks for your response @sagar7993. I just want to confirm a couple things:

1. Do you need to create new environment/organization roles for your users, or just assign existing roles you've previously created in the WorkOS dashboard?
2. Got it. If it happens to be of use to you, we have a WorkOS Widget for managing users, which includes editing their role.

I'm looking to be able to assign existing roles and permissions already created via the WorkOS dashboard right now.

As of now I don't have a use case where I need to create a new role/permission in WorkOS via SDK or API

[mattgd]

@sagar7993 Got it, thanks! Assigning existing roles can be done currently via the organizations memberships API using the role_slug parameter. Permissions are assigned to roles via the dashboard.

[sagar7993]

@mattgd thanks for the clarification. I understand now that role assignment is possible via the organisation membership API, and permissions will need to be managed for a role via the WorkOS dashboard

I'd also like to add/remove permissions for an individual user, regardless of their role. Is that possible currently?

Basically I am trying to create roles like this example -

admin role - has 10 permissions assigned to it. I'd like to selectively manage which of these ten permissions any given user can have. For example, let's say I have permissions such as - can_view_stats, can_delete_message, can_send_message and so on.

User A - needs to have permissions for can_send_message and can_delete_message

User B - needs to have permissions for can_send_message only

Both User A and User B still need to be admin role.

How can I achieve this using the WorkOS API/SDK?

[maxheyn]

I would like to voice support for adding this feature.

My organization currently is working on creating a new app using WorkOS and it would be helpful to be able to create and manage roles via the WorkOS SDK.

For our other projects we are using a different auth platform and when we need to update/create roles, it is done via an integration with their management API and automatically deployed to all relevant apps.

For example:

We define a permissions file that lists all available roles, and individual roles directory that may contain files for each individual role with their respective permissions and other information. When a pull request comes in, our team reviews the changes, and on merge it is deployed to our staging/development environment, and on release to our production environment using the management SDK.

This way our team has visibility in changes and can easily reference the structure of our app's permissions/roles system when developing new features where keeping that in mind is useful. Otherwise it seems like it is only possible to members who have access to our WorkOS dashboard.

[mattgd]

@mattgd thanks for the clarification. I understand now that role assignment is possible via the organisation membership API, and permissions will need to be managed for a role via the WorkOS dashboard

I'd also like to add/remove permissions for an individual user, regardless of their role. Is that possible currently?

Basically I am trying to create roles like this example -

admin role - has 10 permissions assigned to it. I'd like to selectively manage which of these ten permissions any given user can have. For example, let's say I have permissions such as - can_view_stats, can_delete_message, can_send_message and so on.

User A - needs to have permissions for can_send_message and can_delete_message

User B - needs to have permissions for can_send_message only

Both User A and User B still need to be admin role.

How can I achieve this using the WorkOS API/SDK?

Hi @sagar7993, apologies for not getting back to you sooner. Is there a reason User A and B must both have the admin role? Could one have an admin role, and the other have some sort of super_admin role, which is a superset of the admin role permissions?

While we don't have plans currently to allow for individual permissions to be assigned to organization memberships, we have discussed adding multiple roles support. This would allow you to have two separate roles with respective permissions, which might help you better organize your permission assignment.

[mattgd]

I would like to voice support for adding this feature.

My organization currently is working on creating a new app using WorkOS and it would be helpful to be able to create and manage roles via the WorkOS SDK.

For our other projects we are using a different auth platform and when we need to update/create roles, it is done via an integration with their management API and automatically deployed to all relevant apps.

For example:

We define a permissions file that lists all available roles, and individual roles directory that may contain files for each individual role with their respective permissions and other information. When a pull request comes in, our team reviews the changes, and on merge it is deployed to our staging/development environment, and on release to our production environment using the management SDK.

This way our team has visibility in changes and can easily reference the structure of our app's permissions/roles system when developing new features where keeping that in mind is useful. Otherwise it seems like it is only possible to members who have access to our WorkOS dashboard.

Hi @maxheyn, thanks for sending over these details on your use case. I totally understand the benefits of managing roles/permissions in code. This is something the upcoming RBAC management APIs will support.

It may not be necessary in your use case, but in addition to RBAC management APIs, we're also exploring a WorkOS Terraform provider. Would that be something your team would be interested in?