Skip to main content
Pinecone uses role-based access controls (RBAC) to manage access to resources. Users, service accounts, and API keys are all principals, and a principal’s access is determined by the roles assigned to it for a resource (an organization or a project). This page shows how to assign and manage roles in the Pinecone console and programmatically with the Admin API.
For the roles available at each scope and the permissions they grant, see Organization roles and Project roles.

​
Common role assignments

A user must have an organization role to belong to the organization, and gains access to a project through one or more project roles. A principal’s effective permissions are the union of all the roles it holds, so you can combine roles to grant exactly the access a user needs. The following table maps common scenarios to the roles to assign:
Assigning an organization role adds the user to the organization; assigning a project role grants access to that specific project. To assign these roles in the console, see Manage organization members and Manage project members.

​
Invite a developer to a project

Invite a user as an organization member and grant them the ProjectManager role so they can build and query in a single project without managing its members or API keys. In the console, add the user from Manage project members and select the Project manager role. With the Admin API, include both roles in the role_bindings array when you invite the user:
curl
For more information, see Assign roles when creating a principal.

​
Grant an existing user read-only data access

To give a user who is already in your organization read-only access to a project’s data, assign the ProjectMember role for baseline project access and the DataPlaneViewer role for read-only data. Each role binding is a separate request. First, add the user to the project with the ProjectMember role:
curl
Then, grant read-only data access with the DataPlaneViewer role:
curl

​
Extend a user’s access with an additional role

Because effective permissions are the union of all roles, you can broaden access by adding another role rather than replacing the existing one. The user from the previous example holds ProjectMember and DataPlaneViewer; add ControlPlaneViewer to also allow read-only access to the project’s indexes, assistants, backups, and collections:
curl
The user now holds ProjectMember, DataPlaneViewer, and ControlPlaneViewer on the project, giving read-only access to all of its resources and data. For more information, see Create a role binding.

​
Manage roles in the console

You can assign and change roles when you manage principals in the console:

​
Manage roles with the Admin API

The Admin API represents each role assignment as a role binding that grants one role to one principal for one resource scope. You can assign roles when you create a principal, or manage role bindings directly after creation.
An access token must be provided to authenticate with the Admin API.

​
Assign roles when creating a principal

When you invite a user or create a service account, grant roles with the role_bindings field. Set resource_type to organization or project; for project scope, include the project’s resource_id. Invite a user as an organization member with a project role:
curl
Create a service account with an access role:
curl
For API keys, assign project roles with the roles field instead. For more information, see Manage API keys.

​
Create a role binding

To grant a role to an existing principal, create a role binding:
curl
For more information, see Create a role binding.

​
List role bindings

Role bindings are not included in the responses for users, invites, or service accounts. To list the roles assigned to a principal, filter by principal_type and principal_id:
curl
For more information, see List role bindings and Fetch a role binding.

​
Delete a role binding

To revoke a role, delete its role binding:
curl
You cannot delete the last OrgOwner role binding for an organization. An organization must always have at least one owner.
For more information, see Delete a role binding.