> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memorylake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Access Group

> Creates an access group

```
POST /openapi/memorylake/admin/v1/access-groups
```

Creates an access group. Its permissions come from an optional base — a role (base\_role\_key) or another access group (base\_access\_group\_id), fixed at creation — plus its own permission list. Only an owner or admin may create a group based on tenant\_admin. A team has at most 200 access groups.

<Note>
  **Permission required:** `access_group:manage`

  * Changes that give someone an admin role, or that reduce what an admin can reach, also require the team owner or an admin.
</Note>

### Headers

<ParamField header="Idempotency-Key" type="string">
  Optional. Retrying with the same value replays the first result instead of creating a second group.
</ParamField>

### Request Body

<ParamField body="name" type="string" required>
  Display name
</ParamField>

<ParamField body="base_access_group_id" type="string">
  Optional, exclusive with base\_role\_key. The group grants everything this access group grants.
</ParamField>

<ParamField body="base_role_key" type="string">
  Optional. The group grants everything this role grants. Granting tenant\_admin needs an owner or admin. One of: `tenant_member`, `tenant_admin`.
</ParamField>

<ParamField body="description" type="string">
  Optional description
</ParamField>

<ParamField body="permissions" type="array">
  Optional permissions on top of the base

  <Expandable title="Access Group Permission object">
    <ParamField body="permissions[].action" type="string" required>Action</ParamField>
    <ParamField body="permissions[].resource_type" type="string" required>Resource type (see GET /permission-catalog?grantable\_to=access\_group)</ParamField>
  </Expandable>
</ParamField>

<RequestExample>
  ```bash cURL theme={null}
  curl -X POST 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access-groups' \
    -H 'Authorization: Bearer sk_xxxxxx' \
    -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
    -H 'Content-Type: application/json' \
    -d '{
      "name": "Example name",
      "base_access_group_id": "654c7f7dfc968117cbb5a2e1e31a838e",
      "base_role_key": "tenant_member",
      "description": "Example description",
      "permissions": [
        {
          "action": "example",
          "resource_type": "example"
        }
      ]
    }'
  ```
</RequestExample>

### Response

<ResponseField name="data" type="object">
  <Expandable title="Access Group object">
    <ResponseField name="created_at" type="integer">Unix seconds</ResponseField>
    <ResponseField name="created_by" type="string">principal\_id of the creator</ResponseField>
    <ResponseField name="group_id" type="string">Identifier</ResponseField>
    <ResponseField name="member_count" type="integer">Number of members</ResponseField>
    <ResponseField name="name" type="string">Display name</ResponseField>

    <ResponseField name="permissions" type="array">
      Permissions the group grants on top of its base role or base group

      <Expandable title="Access Group Permission object">
        <ResponseField name="action" type="string">Action</ResponseField>
        <ResponseField name="resource_type" type="string">Resource type (see GET /permission-catalog?grantable\_to=access\_group)</ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="updated_at" type="integer">Unix seconds</ResponseField>
    <ResponseField name="base_access_group_id" type="string">The group grants everything this other access group grants. Fixed at creation.</ResponseField>
    <ResponseField name="base_role_key" type="string">The group grants everything this role grants (tenant\_member or tenant\_admin). Fixed at creation.</ResponseField>
    <ResponseField name="description" type="string">Description</ResponseField>

    <ResponseField name="scope_summary" type="array">
      Instances the group gives access to, counted per resource type

      <Expandable title="Access Group Scope Count object">
        <ResponseField name="instance_count" type="integer">Instances of this type the group gives its members access to</ResponseField>
        <ResponseField name="resource_type" type="string">Resource type</ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseExample>
  ```json Success (201) theme={null}
  {
    "success": true,
    "message": "Operation completed successfully",
    "data": {
      "created_at": 1760000000,
      "created_by": "example",
      "group_id": "6f8976043c3a1d0040a5853315a3c843",
      "member_count": 1,
      "name": "Example name",
      "permissions": [
        {
          "action": "example",
          "resource_type": "example"
        }
      ],
      "updated_at": 1760000000,
      "base_access_group_id": "d62d704744ca464eeee07a49ef8c2877",
      "base_role_key": "tenant_member",
      "description": "Example description",
      "scope_summary": [
        {
          "instance_count": 1,
          "resource_type": "example"
        }
      ]
    }
  }
  ```
</ResponseExample>

### Errors

Errors answer with `success: false`, a `message` and an `error_code`. See [Error Codes](/features/memorylake/api-reference/errors) for every code.

| Status | Meaning |
| - | - |
| `400` | A parameter or the body is invalid |
| `401` | The API key is missing, invalid, disabled or expired |
| `403` | The key is not allowed to do this |
| `404` | The resource does not exist |
| `409` | The request conflicts with the current state, e.g. a duplicate or a limit reached |
| `422` | The body or a parameter failed validation |
| `429` | Too many requests. Wait for the time in `Retry-After` |
| `500` | Server-side error |
| `503` | Temporarily unavailable. Retry later |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.