Grant a privilege to a role
Adds one privilege (an area privilege for an event-type group) to an existing role.
Switches on one cell of a role's privilege matrix — the same change as ticking a privilege checkbox for a role in TimeLog's settings. If the event-type group is connected to pages, the role also gets access to those pages. It does not create a role, and REST v1 has no operation that creates or deletes roles. The call returns 200 with body null. There is no read operation for a role's privileges, so the result cannot be verified through REST v1.
Use it to:
- Provision a account's role set-up from a template (same privileges on many accounts)
Not for:
- Creating a role — not possible in REST v1
- Giving a role to a user — use UserRoleIDs on
POST /v1/user/create/ update
Rules across fields:
Behaviour:
- Not idempotent.
- Safe to retry only under a condition.
- Duplicates: Not deduplicated — the same mapping can be stored several times.
- Side effect: Recomputes the time-tracking search rows of the role's users when the privilege is 'register on all tasks' or 'projects available for employee department / resource group'.
- Side effect: Maps the group's connected pages to the role (page access), each with its own audit events.
- On failure: Unknown RoleID or AreaPrivilegeGUID with a valid group: the inserts, the allocation recompute and the page mappings are kept; the call returns 500.
Call first: GET /v1/role
See also: DELETE /v1/role, GET /v1/privilege/user-privileges
Not yet documented: behaviour → consistency; examples (success).
curl -X POST "https://app3.timelog.com/your-account/api/v1/role" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-d '{
"RoleID": 123,
"AreaPrivilegeGUID": "123e4567-e89b-12d3-a456-426614174000",
"EventTypeGroupGUID": "123e4567-e89b-12d3-a456-426614174000"
}'
import requests
import json
url = "https://app3.timelog.com/your-account/api/v1/role"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
"RoleID": 123,
"AreaPrivilegeGUID": "123e4567-e89b-12d3-a456-426614174000",
"EventTypeGroupGUID": "123e4567-e89b-12d3-a456-426614174000"
}
response = requests.post(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://app3.timelog.com/your-account/api/v1/role", {
method: "POST",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
},
body: JSON.stringify({
"RoleID": 123,
"AreaPrivilegeGUID": "123e4567-e89b-12d3-a456-426614174000",
"EventTypeGroupGUID": "123e4567-e89b-12d3-a456-426614174000"
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"RoleID": 123,
"AreaPrivilegeGUID": "123e4567-e89b-12d3-a456-426614174000",
"EventTypeGroupGUID": "123e4567-e89b-12d3-a456-426614174000"
}`)
req, err := http.NewRequest("POST", "https://app3.timelog.com/your-account/api/v1/role", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://app3.timelog.com/your-account/api/v1/role')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
"RoleID": 123,
"AreaPrivilegeGUID": "123e4567-e89b-12d3-a456-426614174000",
"EventTypeGroupGUID": "123e4567-e89b-12d3-a456-426614174000"
}'
response = http.request(request)
puts response.body
"null"
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"Code": 100,
"Details": [],
"Message": "Unknown error occur in system, please contact system administrator.",
"Parameters": "model: {"RoleID":0,"AreaPrivilegeGUID":"00000000-0000-0000-0000-000000000000","EventTypeGroupGUID":"00000000-0000-0000-0000-000000000000"}",
"Url": "https://app{server-number}.timelog.com/{account}/api/v1/role"
}
/v1/role
Target server for requests. Edit to use your own host.
OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.
Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.The media type of the request body
The role to change.
Refers to RoleRead.RoleID. Look up valid values with GET /v1/role.
- On POST the mapping rows are already written when it fails.
- The role is a locked system role or an employee-specific role — No check on the role kind.
role.list does not return locked system or employee-specific roles, but this field accepts them.
Valid values come from GET /v1/role.
GUID of the area privilege (a row of TimeLog's privilege catalogue, e.g. 'all employees' in the employee area). Reference to another object. - On POST the mapping rows are already written when it fails. - The area privilege does not belong to the event-type group's area — No pairing check. > Not yet documented: values → lookup op.
GUID of the event-type group: the set of actions (event types) the privilege is granted for, e.g. view / create / edit. Reference to another object. - The group has connected pages — POST also gives the role access to those pages; DELETE removes them unless another group still needs them. > Not yet documented: values → lookup op.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
Not yet documented: how to obtain a token.
Not yet documented: token lifetime.
Body
The role to change.
Refers to RoleRead.RoleID. Look up valid values with GET /v1/role.
-
On POST the mapping rows are already written when it fails.
-
The role is a locked system role or an employee-specific role — No check on the role kind.
role.list does not return locked system or employee-specific roles, but this field accepts them.
Valid values come from GET /v1/role.
GUID of the area privilege (a row of TimeLog's privilege catalogue, e.g. 'all employees' in the employee area).
Reference to another object.
-
On POST the mapping rows are already written when it fails.
-
The area privilege does not belong to the event-type group's area — No pairing check.
Not yet documented: values → lookup op.
GUID of the event-type group: the set of actions (event types) the privilege is granted for, e.g. view / create / edit.
Reference to another object.
- The group has connected pages — POST also gives the role access to those pages; DELETE removes them unless another group still needs them.
Not yet documented: values → lookup op.
Responses
Success without content: HTTP 200 with the literal JSON body null. Literal JSON null.