Create an instance member role
Creates an instance member role.
Authorizations
Section titled “ Authorizations ”Request Body required
Section titled “ Request Body required ”object
Base Access Level for the configured role
Name for role (default: ‘Custom’)
Description for role
Apply security scan profiles.
Allows approval of merge requests.
Allows archiving of projects.
Enable, disable, and configure custom agents and flows from the AI catalog for a project.
Delete packages and package files in the package registry.
Allows deletion of projects.
Ability to delete or restore a subgroup. This ability does not allow deleting top-level groups. Review the retention period settings to prevent accidental deletion.
Allows linking security policy projects.
Create, edit, and delete custom agents and flows in the AI catalog.
Create, read, update, and delete compliance frameworks. Users with this permission can also assign a compliance framework label to a project, and set the default framework of a group.
Create, read, update, and delete CI/CD variables.
Manage deploy tokens at the group or project level.
Create, read, update, and delete group access tokens. When creating a token, users with this custom permission must select a role for that token that has the same or fewer permissions as the default role used as the base for the custom role.
Add or remove users in a group, and assign roles to users. When assigning a role, users with this custom permission must select a role that has the same or fewer permissions as the default role used as the base for their custom role.
Create, read, update, and delete integrations with external applications.
Configure merge request settings at the group or project level. Group actions include managing merge checks and approval settings. Project actions include managing MR configurations, approval rules and settings, and branch targets. In order to enable Suggested reviewers, the “Manage project access tokens” custom permission needs to be enabled.
Create, read, update, and delete project access tokens. When creating a token, users with this custom permission must select a role for that token that has the same or fewer permissions as the default role used as the base for the custom role.
Create, read, update, and delete protected branches for a project.
Create, read, update, and delete protected environments
Configure push rules for repositories at the group or project level.
Create, view, edit, and delete group or project Runners. Includes configuring Runner settings.
Manage the security categories and attributes belonging to a top-level group. Also requires the read_security_attribute permission.
Execute terraform commands, lock/unlock terraform state files, and remove file versions.
Edit the status, linked issue, and severity of a vulnerability object. Also requires the read_vulnerability permission.
Manage webhooks
Read GitLab Duo Agent Platform artifacts, including audit events and session metadata, that are exposed through the agent artifacts dashboard.
Read compliance capabilities including adherence, violations, and frameworks for groups and projects.
Read security scan profiles.
Allows read access to virtual registries at the group level. Enables users to resolve packages through the virtual registry without requiring broader group membership permissions. Only works on top level groups.
Update security AI workflow settings such as SAST Vulnerability Resolution. Also requires the read_vulnerability permission.
Read CI/CD details for runners and jobs in the Admin Area.
Read CRM contact.
Allows read-only access to the dependencies and licenses.
Read group details in the Admin Area.
Read project details in the Admin Area.
Allows read-only access to the source code in the user interface. Does not allow users to edit or download repository archives, clone or pull repositories, view source code in an IDE, or view merge requests for private projects. You can download individual files because read-only access inherently grants the ability to make a local copy of the file.
Allows read-only access to group or project runners, including the runner fleet dashboard.
Allows read-only access to the security categories and attributes that belong to a top-level group.
Read subscription details in the Admin area.
Read system information such as background migrations, health checks, and Gitaly in the Admin Area.
Read the user list and user details in the Admin area.
Read vulnerability reports and security dashboards.
Responses
Section titled “ Responses ”Created
object
Example
{ "id": 2, "group_id": 2, "name": "Custom guest", "description": "Guest user who can also read_code", "base_access_level": 40, "apply_security_scan_profiles": false, "admin_merge_request": false, "archive_project": false, "admin_ai_catalog_item_consumer": false, "destroy_package": false, "remove_project": false, "remove_group": false, "manage_security_policy_link": false, "admin_ai_catalog_item": false, "admin_compliance_framework": false, "admin_cicd_variables": false, "manage_deploy_tokens": false, "manage_group_access_tokens": false, "admin_group_member": false, "admin_integrations": false, "manage_merge_request_settings": false, "manage_project_access_tokens": false, "admin_protected_branch": false, "admin_protected_environments": false, "admin_push_rules": false, "admin_runners": false, "admin_security_attributes": false, "admin_terraform_state": false, "admin_vulnerability": false, "admin_web_hook": false, "read_agent_artifacts": false, "read_compliance_dashboard": false, "read_security_scan_profiles": false, "read_virtual_registry": false, "update_sec_ai_workflow_settings": false, "read_admin_cicd": false, "read_crm_contact": false, "read_dependency": false, "read_admin_groups": false, "read_admin_projects": false, "read_code": false, "read_runners": false, "read_security_attribute": false, "read_admin_subscription": false, "read_admin_monitoring": false, "read_admin_users": false, "read_vulnerability": false}Bad Request
Unauthorized