> ## Documentation Index > Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt > Use this file to discover all available pages before exploring further. # Create inline role bindings > Create one role binding per input item, each with a single subject and a single permission. The binding name is deterministically generated from the inputs, so repeated calls are idempotent. ## OpenAPI ````yaml /openapi.json post /api/svc/v1/role-bindings/inline openapi: 3.1.0 info: title: TrueFoundry API description: API for TrueFoundry version: 0.1.0 contact: {} servers: - url: https://{controlPlaneURL} variables: controlPlaneURL: default: app.truefoundry.com description: Control Plane URL security: [] tags: - name: Agent - name: Agent Skills - name: Applications - name: Metrics - name: Apply - name: Artifacts - name: Audit Logs - name: Clusters - name: Jobs - name: Logs - name: MCP Servers V2 - name: MLRepos - name: Model Deployments - name: Models - name: Personal Access Tokens - name: Prompts - name: Provider Integrations - name: SCIM v2 - name: Secret Groups - name: Secrets - name: Teams - name: Traces - name: Users - name: Virtual Accounts - name: Role Bindings - name: Workspaces paths: /api/svc/v1/role-bindings/inline: post: tags: - Role Bindings summary: Create inline role bindings description: >- Create one role binding per input item, each with a single subject and a single permission. The binding name is deterministically generated from the inputs, so repeated calls are idempotent. operationId: RoleBinding.createInlineRoleBindings parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateInlineRoleBindingsRequestDto' responses: '200': description: List of created role bindings. content: application/json: schema: $ref: '#/components/schemas/InlineRoleBindingsResponseDto' security: - jwt: [] components: schemas: CreateInlineRoleBindingsRequestDto: type: object properties: roleBindings: minItems: 1 description: >- List of inline role binding items. Each item produces one role binding. type: array items: $ref: '#/components/schemas/InlineRoleBindingItemDto' required: - roleBindings title: CreateInlineRoleBindingsRequestDto x-fern-type-name: CreateInlineRoleBindingsRequestDto InlineRoleBindingsResponseDto: type: object properties: data: description: List of created role bindings. type: array items: $ref: '#/components/schemas/RoleBinding' required: - data title: InlineRoleBindingsResponseDto x-fern-type-name: InlineRoleBindingsResponseDto InlineRoleBindingItemDto: type: object properties: resourceType: type: string description: Target resource kind. example: workspace resourceFqn: type: string description: Human-readable Fully Qualified Name of the resource. subjectFqn: type: string description: >- Human-readable fully-qualified name of the subject in type:name format. example: user:alice@example.com role: type: string description: Human-readable name of the role to bind. example: workspace-editor required: - resourceType - resourceFqn - subjectFqn - role title: InlineRoleBindingItemDto x-fern-type-name: InlineRoleBindingItemDto RoleBinding: type: object properties: id: type: string nullable: true name: type: string accountId: type: string manifest: oneOf: - $ref: '#/components/schemas/RoleBindingManifest' description: Stored role binding manifest metadata: type: object additionalProperties: true nullable: true createdBySubject: $ref: '#/components/schemas/Subject' createdAt: format: date-time type: string nullable: true updatedAt: format: date-time type: string nullable: true required: - name - accountId - manifest - createdBySubject title: RoleBinding x-fern-type-name: RoleBinding RoleBindingManifest: type: object required: - type - name - subjects - permissions properties: type: description: +value=role-binding type: string enum: - role-binding name: description: Unique name for this role binding. type: string pattern: ^[a-z][a-z0-9-]{1,62}[a-z0-9]$ subjects: description: >- One row per principal; set type and name (email, team name, virtual account name, or external identity name). type: array items: $ref: '#/components/schemas/RoleBindingSubject' permissions: description: Resource-scoped role grants (resource type, FQN, and role name). type: array items: $ref: '#/components/schemas/RoleBindingPermission' title: RoleBindingManifest x-fern-type-name: RoleBindingManifest Subject: type: object properties: subjectId: type: string description: Subject ID subjectType: description: Subject type allOf: - $ref: '#/components/schemas/SubjectType' subjectSlug: type: string description: Subject slug nullable: true subjectDisplayName: type: string description: Subject display name nullable: true subjectPatName: type: string description: Subject PAT name nullable: true subjectControllerName: type: string nullable: true subjectExternalIdentitySlug: type: string description: External identity slug (external_identity_id:sub:email) nullable: true required: - subjectId - subjectType title: Subject x-fern-type-name: Subject RoleBindingSubject: description: >- Single row per principal: type selects how to interpret name (email vs names). Field names mirror the manifest root (type + name) for consistency in the UI and YAML. type: object required: - type - name properties: type: description: >- Whether this row identifies a user (email), a team (name), a virtual account (name), or an external identity (name). type: string enum: - user - team - virtualaccount - external-identity name: description: >- User email when type is user; team or virtual account name when type is team or virtualaccount; external identity name when type is external-identity. type: string minLength: 1 maxLength: 1024 title: RoleBindingSubject x-fern-type-name: RoleBindingSubject RoleBindingPermission: description: Grants a named account role on a specific resource identified by FQN. type: object required: - resourceType - resourceFqn - role properties: resourceType: description: Target resource kind (e.g. workspace, cluster, ml-repo). type: string minLength: 1 maxLength: 128 resourceFqn: description: Fully qualified name of the resource. type: string minLength: 1 maxLength: 1024 role: description: Name of the role to bind (e.g. workspace-editor, model-user). type: string minLength: 1 maxLength: 255 title: RoleBindingPermission x-fern-type-name: RoleBindingPermission SubjectType: type: string enum: - user - team - serviceaccount - virtualaccount - external-identity - agent-identity - role description: >- Type of the authenticated subject. "user" for human users, "serviceaccount" (also known as virtual account) for programmatic access. title: SubjectType x-fern-type-name: SubjectType securitySchemes: jwt: type: http scheme: bearer bearerFormat: JWT ````