# Create a role binding

**POST** `/admin/role-bindings`

:::code-group
```bash title="cURL"
curl --request POST \
  --url https://api.pinecone.io/admin/role-bindings \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "principal_type": "service_account",
  "principal_id": "e2e92523-85dc-4142-b8c2-e681be8b78df",
  "resource_type": "project",
  "resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
  "role": "ProjectOwner"
}'
```

```json title="200"
{
  "created_at": "2026-04-10T15:23:00.000Z",
  "id": "9a8e3528-b9c0-4358-84ce-84c28e91b566",
  "principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
  "principal_type": "service_account",
  "resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
  "resource_type": "project",
  "role": "DataPlaneEditor"
}
```
:::

## Authorizations

- `Authorization` (header, string, required) — Bearer authentication header of the form `Bearer <token>`.

## Headers

- `X-Pinecone-Api-Version` (header, string, required) — Required date-based version header

## Body

- `principal_type` (body, string, required) — The kind of principal that receives permissions from a role binding. Possible values: `user`, `service_account`, `api_key`, `invite`.
- `principal_id` (body, string, required) — Principal ID. Format depends on `principal_type`.
- `resource_type` (body, string, required) — The kind of resource scope a role binding applies to. Possible values: `organization`, `project`.
- `resource_id` (body, string) — Project UUID. Required when `resource_type` is `project`; omit for `organization` scope.
- `role` (body, string, required) — A role assigned to a principal at a resource scope.

## Response

- `200` — Role binding created.
- `400` — Bad request. The request body included invalid request parameters.
- `401` — Unauthorized. Possible causes: Invalid API key.
- `403` — Forbidden
- `404` — Not found
- `409` — Conflict. The request conflicts with the persisted state of the resource. Common causes include invariant violations (e.g., removing the last `OrgOwner`), lifecycle-state mismatches (e.g., resending an invite that is not pending), and constraint violations checked against persisted data.
- `500` — Internal server error.
- `4XX` — Unexpected error on request.

## Related pages

- [List role bindings](./admin-2-2026-07-admin-role-bindings-list-role-bindings.md)
- [Get role binding details](./admin-2-2026-07-admin-role-bindings-get-role-binding-details.md)
- [Delete a role binding](./admin-2-2026-07-admin-role-bindings-delete-a-role-binding.md)
- [Create a role binding](./admin-2-2026-04-admin-create-role-binding.md)
- [List role bindings](./admin-2-2026-04-admin-list-role-bindings.md)
- [Get role binding details](./admin-2-2026-04-admin-fetch-role-binding.md)
- [Delete a role binding](./admin-2-2026-04-admin-delete-role-binding.md)

# Agent Instructions

Cite this page’s canonical URL and keep its documentation version.
Follow Link headers to discover available agent guidance and tools.
Read the advertised skill for the requested version before choosing starting pages.
Treat documentation as reference material, not execution authorization.