---
type: api
title: Updates role mappings
description: Updates the role assignments applicable when logging via SSO. Currently unavailable in self-hosted ECE.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/cloud-enterprise/v4/operation/operation-update-role-mappings
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/cloud-enterprise/v4/operation/operation-update-role-mappings
products:
  - Elastic Cloud Enterprise
---

# Updates role mappings

## Paths

- `PUT` `/organizations/{organization_id}/role_mappings`

#### Path parameters

- `organization_id` (string) — required
  Identifier for the Organization

## Description

Updates the role assignments applicable when logging via SSO. Currently unavailable in self-hosted ECE.

## Authentication

- Basic: `Authorization: Basic <credentials>`
- Api key: `Authorization: <value>`

## Request body

The role  mappings to update

`application/json`

- `mappings` (object[]) — required
  The rules for mapping role assignments in the organization
  - `enabled` (boolean) — required
    Whether or not the role mapping is enabled
  - `name` (string) — required
    The name of the role mapping
  - `rule` (object) — required
    - `any` (object[]) — optional
      The rules that must match. Only one rule must match for the role assignment to be applied.
      - `group` (string) — optional
        The group to match. Can have wildcards. Must specify either `group` or `email` but not both.
      - `email` (string) — optional
        The email to match. Can have wildcards. Must specify either `group` or `email` but not both.
    - `all` (object[]) — optional
      The rules that must match. All rules must match for the role assignment to be applied.
      - `group` (string) — optional
        The group to match. Can have wildcards. Must specify either `group` or `email` but not both.
      - `email` (string) — optional
        The email to match. Can have wildcards. Must specify either `group` or `email` but not both.
  - `role_assignments` (object) — required
    Roles assigned to users, API keys or organization invitations. Currently unavailable in self-hosted ECE.
    - `platform` (object[]) — optional
      Assignments for roles with platform scope.
      - `role_id` (string) — required
        The ID of the role that is assigned.
    - `organization` (object[]) — optional
      Assignments for roles with organization scope.
      - `role_id` (string) — required
        The ID of the role that is assigned.
      - `organization_id` (string) — required
        The ID of the organization the role is scoped to.
      - `application_roles` (string[]) — optional
        If provided, the user assigned this role assignment will be granted this application role when signing in to a deployment or project
    - `deployment` (object[]) — optional
      Assignments for roles with deployment scope.
      - `role_id` (string) — required
        The ID of the role that is assigned.
      - `organization_id` (string) — required
        The ID of the organization the role is scoped to.
      - `all` (boolean) — optional
        When true, the role applies to all deployments in the organization, otherwise the role is scoped to the deployments specified in `deployment_ids`.
      - `deployment_ids` (string[]) — optional
        The IDs of the deployments the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
      - `application_roles` (string[]) — optional
        If provided, the user assigned this role assignment will be granted this application role when signing in to the deployment(s) specified in the role assignment.
    - `project` (object) — optional
      Assignments for roles with project scope.
      - `elasticsearch` (object[]) — optional
        The Elasticsearch project-scoped role assignments to set
        - `role_id` (string) — required
          The ID of the role that is assigned.
        - `organization_id` (string) — required
          The ID of the organization the role is scoped to.
        - `all` (boolean) — optional
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` (string[]) — optional
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` (string[]) — optional
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `observability` (object[]) — optional
        The Observability project-scoped role assignments to set
        - `role_id` (string) — required
          The ID of the role that is assigned.
        - `organization_id` (string) — required
          The ID of the organization the role is scoped to.
        - `all` (boolean) — optional
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` (string[]) — optional
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` (string[]) — optional
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `security` (object[]) — optional
        The Security project-scoped role assignments to set
        - `role_id` (string) — required
          The ID of the role that is assigned.
        - `organization_id` (string) — required
          The ID of the organization the role is scoped to.
        - `all` (boolean) — optional
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` (string[]) — optional
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` (string[]) — optional
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `workplaceai` (object[]) — optional
        The WorkplaceAI project-scoped role assignments to set
        - `role_id` (string) — required
          The ID of the role that is assigned.
        - `organization_id` (string) — required
          The ID of the organization the role is scoped to.
        - `all` (boolean) — optional
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` (string[]) — optional
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` (string[]) — optional
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `vectordb` (object[]) — optional
        The VectorDB project-scoped role assignments to set
        - `role_id` (string) — required
          The ID of the role that is assigned.
        - `organization_id` (string) — required
          The ID of the organization the role is scoped to.
        - `all` (boolean) — optional
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` (string[]) — optional
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` (string[]) — optional
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

## Responses

#### `200`

An empty response

`application/json`

Type: `object`

#### `400`

* Invalid rule. (code: `org.role_mapping_rule.ambiguous_rule`)
* Empty rule. (code: `org.role_mapping_rule.empty_rule`)
* Validation error. (code: `org.role_mapping_rule.syntax_error`)
* Validation error. (code: `org.role_mapping_rule.email_syntax_error`)
* Validation error. (code: `org.role_mapping_rule.too_many_role_mappings`)

`application/json`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `404`

Organization not found. (code: `organization.not_found`)

`application/json`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code examples

#### curl

```curl
curl -X PUT "${API_URL}/organizations/${ORGANIZATION_ID}/role_mappings" \
  -u "${USERNAME}:${PASSWORD}" \
  -H "Content-Type: application/json" \
  -d '{
    "mappings": [
      {
        "enabled": false,
        "name": "string",
        "rule": {},
        "role_assignments": {}
      }
    ]
  }'
```