PINECONE_ACCESS_TOKEN="YOUR_ACCESS_TOKEN"
curl "https://api.pinecone.io/admin/role-bindings" \
-H "X-Pinecone-Api-Version: 2026-04" \
-H "Authorization: Bearer $PINECONE_ACCESS_TOKEN" \
-d '{
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor"
}'
{
"id": "9a8e3528-b9c0-4358-84ce-84c28e91b566",
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor",
"created_at": "2026-04-10T15:23:00Z"
}
Create a role binding
Grant a role to a principal at an organization or project scope.
Set resource_type to select the scope. For project scope, resource_id is required and must be the project UUID. For organization scope, omit resource_id; the binding applies to the caller’s organization.
Returns 409 if an identical binding already exists, or if the target principal is an invite that has already been accepted (processed).
PINECONE_ACCESS_TOKEN="YOUR_ACCESS_TOKEN"
curl "https://api.pinecone.io/admin/role-bindings" \
-H "X-Pinecone-Api-Version: 2026-04" \
-H "Authorization: Bearer $PINECONE_ACCESS_TOKEN" \
-d '{
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor"
}'
{
"id": "9a8e3528-b9c0-4358-84ce-84c28e91b566",
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor",
"created_at": "2026-04-10T15:23:00Z"
}
PINECONE_ACCESS_TOKEN="YOUR_ACCESS_TOKEN"
curl "https://api.pinecone.io/admin/role-bindings" \
-H "X-Pinecone-Api-Version: 2026-04" \
-H "Authorization: Bearer $PINECONE_ACCESS_TOKEN" \
-d '{
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor"
}'
{
"id": "9a8e3528-b9c0-4358-84ce-84c28e91b566",
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor",
"created_at": "2026-04-10T15:23:00Z"
}
Authorizations
An access token must be provided in the Authorization header using the Bearer scheme.
Headers
Required date-based version header
Body
Principal, resource scope, and role to bind.
The kind of principal that receives permissions from a role binding.
Possible values: user, service_account, api_key, invite.
"service_account"
Principal ID. Format depends on principal_type.
"e2e92523-85dc-4142-b8c2-e681be8b78df"
The kind of resource scope a role binding applies to.
Possible values: organization, project.
"project"
A role assigned to a principal at a resource scope.
"ProjectOwner"
Project UUID. Required when resource_type is project; omit for organization scope.
"a2f7dddb-1597-4eff-9f71-535fde243f58"
Response
Role binding created.
Grants a role to a principal at a resource scope.
The unique ID of the role binding.
The kind of principal that receives permissions from a role binding.
Possible values: user, service_account, api_key, invite.
"service_account"
The principal's ID. A UUID for all principal types (user, service_account, api_key, invite).
"e2e92523-85dc-4142-b8c2-e681be8b78df"
The kind of resource scope a role binding applies to.
Possible values: organization, project.
"project"
The organization or project that the binding is scoped to.
A role assigned to a principal at a resource scope.
"ProjectOwner"
When the role binding was created.
Was this page helpful?