Skip to main content
Feedback

Role-Based Access Control policy

Updated 22 July 2026

You can use the role-based access control policy (RBAC) to control access to a resource by specifying the required roles. You can configure the policy to allow only incoming requests that match at least one of the configured roles.

You can configure role-based access in a policy rule or in the authentication source on a Gateway. To set up roles on a Gateway, refer to this topic.

note

  • Configuring Restrictions by Role on the Deployed API screen creates a role-based access control policy as part of the standard policies.

  • The RBAC policy depends on authorization and must always run after the standard policy.

Timing

On RequestOn Response
X

Configuration

PropertyRequiredDescriptionTypeDefault
rolesyesThe list of required roles.Array of strings

Example

{ "roles": { "requiredRoles": ["read", "write", "admin"] } }

Errors

CodeMessage
403If the policy roles do not match the auth user roles, you view the following error message:
Role(s) <LIST_OF_USER_ROLES> for user <USER_NAME> do not match the required role(s) for this request.
If the auth user doesn’t have any roles, you view the following error message:
No Role(s) are associated for user <USER_NAME> to validate the current request.
On this Page