> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pinecone.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Create a role binding
> Grant a role to a principal at an organization or project scope.
Set `resource_type` to select the scope. For `project` scope, `resource_id` is required and must be the project UUID. For `organization` scope, omit `resource_id`; the binding applies to the caller's organization.
Returns `409` if an identical binding already exists, or if the target principal is an invite that has already been accepted (processed).
```bash curl theme={null}
PINECONE_ACCESS_TOKEN="YOUR_ACCESS_TOKEN"
curl "https://api.pinecone.io/admin/role-bindings" \
-H "X-Pinecone-Api-Version: 2026-04" \
-H "Authorization: Bearer $PINECONE_ACCESS_TOKEN" \
-d '{
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor"
}'
```
```json curl theme={null}
{
"id": "9a8e3528-b9c0-4358-84ce-84c28e91b566",
"principal_type": "service_account",
"principal_id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"resource_type": "project",
"resource_id": "a2f7dddb-1597-4eff-9f71-535fde243f58",
"role": "DataPlaneEditor",
"created_at": "2026-04-10T15:23:00Z"
}
```
## OpenAPI
````yaml https://raw.githubusercontent.com/pinecone-io/pinecone-api/refs/heads/main/2026-04/admin_2026-04.oas.yaml post /admin/role-bindings
openapi: 3.0.3
info:
title: Pinecone Admin API
description: >
Provides an API for managing a Pinecone organization and its resources,
including projects, API keys, organization users and invites, service
accounts, and role bindings.
contact:
name: Pinecone Support
url: https://support.pinecone.io
email: support@pinecone.io
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0
version: 2026-04
servers:
- url: https://api.pinecone.io
description: Production API endpoints
security:
- BearerAuth: []
tags:
- name: API Keys
description: Actions that manage API Keys.
- name: Organizations
description: Actions that manage organizations.
- name: Projects
description: Actions that manage projects.
- name: Users
description: Actions that manage users.
- name: Invites
description: Actions that manage invites.
- name: Service Accounts
description: Actions that manage service accounts.
- name: Role Bindings
description: Actions that manage role bindings.
paths:
/admin/role-bindings:
post:
tags:
- Role Bindings
summary: Create a role binding
description: >
Grant a role to a principal at an organization or project scope.
Set `resource_type` to select the scope. For `project` scope,
`resource_id` is required and must be the project UUID. For
`organization` scope, omit `resource_id`; the binding applies to the
caller's organization.
Returns `409` if an identical binding already exists, or if the target
principal is an invite that has already been accepted (processed).
operationId: create_role_binding
parameters:
- in: header
name: X-Pinecone-Api-Version
description: Required date-based version header
required: true
schema:
default: 2026-04
type: string
style: simple
requestBody:
description: Principal, resource scope, and role to bind.
content:
application/json:
schema:
$ref: '#/components/schemas/CreateRoleBindingRequest'
examples:
bind-org-member:
summary: Bind OrgMember to a user (organization scope)
value:
principal_id: e2e92523-85dc-4142-b8c2-e681be8b78df
principal_type: user
resource_type: organization
role: OrgMember
bind-org-member-to-invite:
summary: Bind OrgMember to an invite (organization scope)
value:
principal_id: 9c8e3528-b9c0-4358-84ce-84c28e91b566
principal_type: invite
resource_type: organization
role: OrgMember
bind-data-plane-editor:
summary: Bind DataPlaneEditor to a service account (project scope)
value:
principal_id: f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c
principal_type: service_account
resource_id: a2f7dddb-1597-4eff-9f71-535fde243f58
resource_type: project
role: DataPlaneEditor
required: true
responses:
'200':
description: Role binding created.
content:
application/json:
schema:
$ref: '#/components/schemas/RoleBinding'
'400':
description: Bad request. The request body included invalid request parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
index-metric-validation-error:
summary: Validation error
value:
error:
code: INVALID_ARGUMENT
message: >-
Bad request. The request body included invalid request
parameters.
status: 400
'401':
description: 'Unauthorized. Possible causes: Invalid API key.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
unauthorized:
summary: Unauthorized
value:
error:
code: UNAUTHENTICATED
message: Invalid API key.
status: 401
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'409':
description: >-
Conflict. The request conflicts with the persisted state of the
resource. Common causes include invariant violations (e.g., removing
the last `OrgOwner`), lifecycle-state mismatches (e.g., resending an
invite that is not pending), and constraint violations checked
against persisted data.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
last-org-owner:
summary: Cannot delete the last OrgOwner
value:
error:
code: ABORTED
message: >-
Cannot delete the last OrgOwner role binding for this
organization.
status: 409
invite-not-pending:
summary: 'Resend rejected: invite is not pending'
value:
error:
code: ALREADY_EXISTS
message: Invite has already been accepted and cannot be resent.
status: 409
invite-already-pending:
summary: >-
Invite rejected: pending invite already exists for this
email
value:
error:
code: ALREADY_EXISTS
message: A pending invite already exists for this email.
status: 409
already-member:
summary: 'Invite rejected: email already belongs to an org member'
value:
error:
code: ALREADY_EXISTS
message: >-
This email already belongs to a member of the
organization.
status: 409
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
internal-server-error:
summary: Internal server error
value:
error:
code: UNKNOWN
message: Internal server error
status: 500
4XX:
description: Unexpected error on request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
components:
schemas:
CreateRoleBindingRequest:
type: object
properties:
principal_type:
example: service_account
description: |-
The kind of principal that receives permissions from a role binding.
Possible values: `user`, `service_account`, `api_key`, `invite`.
x-enum:
- user
- service_account
- api_key
- invite
type: string
principal_id:
example: e2e92523-85dc-4142-b8c2-e681be8b78df
description: Principal ID. Format depends on `principal_type`.
type: string
resource_type:
example: project
description: |-
The kind of resource scope a role binding applies to.
Possible values: `organization`, `project`.
x-enum:
- organization
- project
type: string
resource_id:
example: a2f7dddb-1597-4eff-9f71-535fde243f58
description: >-
Project UUID. Required when `resource_type` is `project`; omit for
`organization` scope.
type: string
role:
example: ProjectOwner
description: A role assigned to a principal at a resource scope.
x-enum:
- OrgOwner
- OrgManager
- OrgMember
- OrgBillingAdmin
- ProjectOwner
- ProjectManager
- ProjectMember
- ProjectEditor
- ProjectViewer
- ControlPlaneEditor
- ControlPlaneViewer
- DataPlaneEditor
- DataPlaneViewer
type: string
required:
- principal_type
- principal_id
- resource_type
- role
RoleBinding:
example:
created_at: '2026-04-10T15:23:00.000Z'
id: 9a8e3528-b9c0-4358-84ce-84c28e91b566
principal_id: f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c
principal_type: service_account
resource_id: a2f7dddb-1597-4eff-9f71-535fde243f58
resource_type: project
role: DataPlaneEditor
description: Grants a `role` to a `principal` at a `resource` scope.
type: object
properties:
id:
description: The unique ID of the role binding.
type: string
format: uuid
principal_type:
example: service_account
description: |-
The kind of principal that receives permissions from a role binding.
Possible values: `user`, `service_account`, `api_key`, `invite`.
x-enum:
- user
- service_account
- api_key
- invite
type: string
principal_id:
example: e2e92523-85dc-4142-b8c2-e681be8b78df
description: >-
The principal's ID. A UUID for all principal types (`user`,
`service_account`, `api_key`, `invite`).
type: string
resource_type:
example: project
description: |-
The kind of resource scope a role binding applies to.
Possible values: `organization`, `project`.
x-enum:
- organization
- project
type: string
resource_id:
description: The organization or project that the binding is scoped to.
type: string
role:
example: ProjectOwner
description: A role assigned to a principal at a resource scope.
x-enum:
- OrgOwner
- OrgManager
- OrgMember
- OrgBillingAdmin
- ProjectOwner
- ProjectManager
- ProjectMember
- ProjectEditor
- ProjectViewer
- ControlPlaneEditor
- ControlPlaneViewer
- DataPlaneEditor
- DataPlaneViewer
type: string
created_at:
description: When the role binding was created.
type: string
format: date-time
required:
- id
- principal_type
- principal_id
- resource_type
- resource_id
- role
- created_at
ErrorResponse:
example:
error:
code: QUOTA_EXCEEDED
message: >-
The index exceeds the project quota of 5 pods by 2 pods. Upgrade
your account or change the project settings to increase the quota.
status: 429
description: The response shape used for all error responses.
type: object
properties:
status:
example: 500
description: The HTTP status code of the error.
type: integer
error:
example:
code: INVALID_ARGUMENT
message: >-
Index name must contain only lowercase alphanumeric characters or
hyphens, and must not begin or end with a hyphen.
description: Detailed information about the error that occurred.
type: object
properties:
code:
description: >-
The error code.
Possible values: `OK`, `UNKNOWN`, `INVALID_ARGUMENT`,
`DEADLINE_EXCEEDED`, `QUOTA_EXCEEDED`, `NOT_FOUND`,
`ALREADY_EXISTS`, `PERMISSION_DENIED`, `UNAUTHENTICATED`,
`RESOURCE_EXHAUSTED`, `FAILED_PRECONDITION`, `ABORTED`,
`OUT_OF_RANGE`, `UNIMPLEMENTED`, `INTERNAL`, `UNAVAILABLE`,
`DATA_LOSS`, `FORBIDDEN`, or `UNPROCESSABLE_ENTITY`.
x-enum:
- OK
- UNKNOWN
- INVALID_ARGUMENT
- DEADLINE_EXCEEDED
- QUOTA_EXCEEDED
- NOT_FOUND
- ALREADY_EXISTS
- PERMISSION_DENIED
- UNAUTHENTICATED
- RESOURCE_EXHAUSTED
- FAILED_PRECONDITION
- ABORTED
- OUT_OF_RANGE
- UNIMPLEMENTED
- INTERNAL
- UNAVAILABLE
- DATA_LOSS
- FORBIDDEN
- UNPROCESSABLE_ENTITY
type: string
message:
example: >-
Index name must contain only lowercase alphanumeric characters
or hyphens, and must not begin or end with a hyphen.
type: string
details:
description: >-
Additional information about the error. This field is not
guaranteed to be present.
type: object
required:
- code
- message
required:
- status
- error
securitySchemes:
BearerAuth:
type: http
scheme: bearer
description: >
An [access
token](https://docs.pinecone.io/guides/organizations/manage-service-accounts#retrieve-an-access-token)
must be provided in the `Authorization` header using the `Bearer`
scheme.
````