--- updatedAt: 2026-06-04T19:58:43.000Z agentTools: projectIndex: https://docs.wristband.dev/llms.txt --- # Create Permission Boundary Creates a new permission boundary resource. ### Required Permissions Below is the list of required permissions needed to interact with this API. For each permission, the allowed permission boundaries are also specified. | Permission | Boundary | Description | | ------------------------------ | ----------- | ------------------------------------------------------------------------------------------------------ | | **permission-boundary:create** | Application | The subject can create permission boundaries under the application to which the subject is associated. | # OpenAPI definition ```json { "openapi": "3.1.0", "info": { "title": "Resource Management APIs", "version": "1.0.0", "description": "Resource Management APIs", "license": { "name": "Private", "url": "https://wristband.dev/terms/" }, "termsOfService": "https://wristband.dev/terms/", "contact": { "name": "Wristband Support", "email": "support@wristband.dev", "url": "https://wristband.dev/contact/" } }, "servers": [ { "url": "https://{application_vanity_domain}", "description": "Wristband application scoped URL.", "variables": { "application_vanity_domain": { "default": "yourapp-yourorg.us.wristband.dev", "description": "Wristband vanity domain scoped to a specific application." } } } ], "tags": [ { "name": "Permission Boundaries", "description": "Permission Boundaries", "x-displayName": "Permission Boundaries" } ], "paths": { "/api/v1/permission-boundaries": { "post": { "summary": "Create Permission Boundary", "operationId": "createPermissionBoundaryV1", "tags": [ "Permission Boundaries" ], "requestBody": { "description": "Permission Boundary Resource", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_PermissionBoundary" }, "examples": { "Example 1 - Custom": { "value": { "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "CUSTOM", "name": "custom-boundary", "displayName": "Custom Boundary", "value": "custom-boundary-value", "description": "A custom permission boundary.", "tenantVisibility": "NONE" } }, "Example 2 - Tenant Exclusion": { "value": { "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "TENANT_EXCLUSION_LIST", "name": "excluded-tenants", "displayName": "Excluded Tenants", "description": "Boundary that excludes a small group of tenants.", "resourceList": [ "jayovsssgbgbpk47ihblujcm2e" ], "tenantVisibility": "ALL" } }, "Example 3 - Tenant Inclusion": { "value": { "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "TENANT_INCLUSION_LIST", "name": "included-tenants", "displayName": "Included Tenants", "description": "Boundary that includes a small group of tenants.", "resourceList": [ "jayovsssgbgbpk47ihblujcm2e" ], "tenantVisibility": "ALL" } } } } } }, "responses": { "201": { "description": "Created", "headers": { "Location": { "$ref": "#/components/headers/Resource_Management_APIs_Location" }, "ETag": { "$ref": "#/components/headers/Resource_Management_APIs_ETag" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_PermissionBoundary" }, "examples": { "Example 1 - Custom": { "$ref": "#/components/examples/Resource_Management_APIs_CustomPermissionBoundary" }, "Example 2 - Tenant Exclusion": { "$ref": "#/components/examples/Resource_Management_APIs_ExclusionListPermissionBoundary" }, "Example 3 - Tenant Inclusion": { "$ref": "#/components/examples/Resource_Management_APIs_InclusionListPermissionBoundary" } } } } }, "400": { "$ref": "#/components/responses/Resource_Management_APIs_400-with-message-body" }, "401": { "$ref": "#/components/responses/Resource_Management_APIs_401" }, "403": { "$ref": "#/components/responses/Resource_Management_APIs_403" }, "405": { "$ref": "#/components/responses/Resource_Management_APIs_405" }, "406": { "$ref": "#/components/responses/Resource_Management_APIs_406" }, "415": { "$ref": "#/components/responses/Resource_Management_APIs_415" }, "500": { "$ref": "#/components/responses/Resource_Management_APIs_500" }, "503": { "$ref": "#/components/responses/Resource_Management_APIs_503" } }, "security": [ { "Resource_Management_APIs_BearerAuth": [] } ] } } }, "components": { "securitySchemes": { "Resource_Management_APIs_BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" } }, "schemas": { "Resource_Management_APIs_id": { "type": "string", "minLength": 1, "maxLength": 26, "example": "pl4a4aa4jzydksmrf3jnu5yfcw", "description": "Globally unique Id of the resource.", "readOnly": true }, "Resource_Management_APIs_api-error": { "title": "ApiError", "type": "object", "description": "API error object", "x-examples": { "Example 1": { "code": "invalid_request", "message": "The request was invalid", "ticket": "11t7n71hi5e6t" } }, "properties": { "type": { "type": "string", "example": "base_error", "minLength": 1, "description": "The type of the API error.", "readOnly": true }, "code": { "type": "string", "example": "invalid_request", "minLength": 1, "description": "A code identifying the error that occurred.", "readOnly": true }, "message": { "type": "string", "example": "The request was invalid", "description": "A free text message describing the error. This error message is only meant to help developers understand the cause of the error. It should not be used for programmatic purposes.", "readOnly": true }, "ticket": { "type": "string", "example": "11t7n71hi5e6t", "description": "Ticket that can help correlate the error to the backend", "readOnly": true }, "details": { "type": "object", "description": "A map of details about the error. The keys are defined by the API.", "additionalProperties": {}, "example": { "attemptsRemaining": 4 } } }, "required": [ "type", "code" ] }, "Resource_Management_APIs_constraint-violations-api-error": { "title": "ConstraintViolationsApiError", "description": "An API error that occurred due to a constraint violation", "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, { "type": "object", "readOnly": true, "required": [ "violations" ], "properties": { "violations": { "type": "object", "readOnly": true, "required": [ "code" ], "properties": { "code": { "type": "string", "description": "A code identifying the constraint violation.", "minLength": 1, "example": "too_long" }, "constraintAttributes": { "type": "object", "description": "A map of constraint attribute values.", "additionalProperties": { "type": "string" }, "example": { "maxLength": "10" } } } } } } ], "x-examples": { "Example 1": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The request contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": "10" } }, "field2": { "code": "not_null" } } } } }, "Resource_Management_APIs_version-metadata": { "title": "VersionMetadata", "type": "object", "description": "Version metadata associated to a resource.", "properties": { "version": { "type": "string", "example": "1.0", "description": "The version of the resource", "readOnly": true }, "lastModifiedTime": { "type": "string", "format": "date-time", "example": "2016-06-13T19:49:31.686Z", "description": "The time at which the resource was last modified", "readOnly": true }, "creationTime": { "type": "string", "format": "date-time", "example": "2016-06-13T19:49:31.686Z", "description": "The time at which the resource was created", "readOnly": true } } }, "Resource_Management_APIs_applicationOnlyCreateOwnerType": { "description": "[Required on Create] The type of the owner of the resource.", "type": "string", "enum": [ "APPLICATION" ], "minLength": 1, "maxLength": 30, "example": "APPLICATION" }, "Resource_Management_APIs_createOwnerId": { "description": "[Required on Create] The ID of the owner of the resource.", "type": "string", "minLength": 1, "maxLength": 26, "example": "d7aml4q5lza3fdi2gavzdliouy" }, "Resource_Management_APIs_PermissionBoundary": { "title": "Permission Boundary", "description": "Permission Boundary", "type": "object", "x-tags": [ "Models" ], "properties": { "id": { "$ref": "#/components/schemas/Resource_Management_APIs_id" }, "ownerType": { "$ref": "#/components/schemas/Resource_Management_APIs_applicationOnlyCreateOwnerType" }, "ownerId": { "$ref": "#/components/schemas/Resource_Management_APIs_createOwnerId" }, "type": { "description": "[Required on Create] Enum representing the permission boundary type.\n\n- `PREDEFINED`: [Read-only] A predefined permission boundary. These permission boundaries are created by Wristband.\n- `CUSTOM`: A custom permission boundary that was created by an end user.\n- `TENANT_INCLUSION_LIST`: The boundary consists of all tenants in the resource list. (For multi-tenant apps only)\n- `TENANT_EXCLUSION_LIST`: The boundary consists of all tenants under an application not specified in the resource list. (For multi-tenant apps only)", "type": "string", "enum": [ "PREDEFINED", "CUSTOM", "TENANT_INCLUSION_LIST", "TENANT_EXCLUSION_LIST" ], "minLength": 1, "maxLength": 45, "example": "CUSTOM" }, "name": { "description": "[Required on Create] The name of the permission boundary. Name must be unique (case-insensitive) within an application.\nPredefined boundary names are prefixed with `predefined:`. Non-predefined, application-level boundary names are prefixed with `app::name`.", "type": "string", "pattern": "^[a-zA-Z0-9]+(-+[a-zA-Z0-9]+)*$", "minLength": 1, "maxLength": 40, "example": "custom-boundary" }, "displayName": { "description": "[Required on Create] The display name of the permission boundary.", "type": "string", "minLength": 1, "maxLength": 60, "example": "Custom Boundary" }, "value": { "description": "The value of the role boundary. This value must be unique (case-insensitive) per application and adhere to the following constraints:\n\n- Value is required when the type is either `PREDEFINED` OR `CUSTOM`.\n- Value must be `null` when the type is either `TENANT_INCLUSION_LIST` or `TENANT_EXCLUSION_LIST`.\n- For the `PREDEFINED` type, the value must be one of `APPLICATION`, `TENANT`, or `SELF`.\n- For the `CUSTOM` type, the value can be anything.", "type": "string", "minLength": 1, "maxLength": 200, "example": "boundary-value" }, "description": { "description": "Optional description of the permission boundary.", "type": "string", "minLength": 1, "maxLength": 500, "example": "This permission boundary is limited to only a few tenants." }, "resourceList": { "description": "The list of resources that comprise the permission boundary. The list can be empty for `TENANT_INCLUSION_LIST` and `TENANT_EXCLUSION_LIST` types, but it must be empty for all other types.", "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "description": "The ID of the tenant resource which comprises the boundary.", "type": "string", "minLength": 1, "maxLength": 26, "example": "jayovsssgbgbpk47ihblujcm2e" }, "example": [ "jayovsssgbgbpk47ihblujcm2e" ] }, "tenantVisibility": { "description": "[Required on Create] Enum representing the tenants that this permission boundary should be visible to.\n\n- `ALL`: The permission boundary is visible to all tenants, and it can be assigned to any tenant-owned role or permission group. Useful for application boundaries that can be assigned to tenant-owned roles or permission groups.\n- `NONE`: The permission boundary is not visible to any tenants, and it cannot be assigned to any tenant-owned roles or permission groups. Useful for internal application boundaries that tenants should not be aware of.", "type": "string", "enum": [ "ALL", "NONE" ], "minLength": 1, "maxLength": 45, "example": "ALL" }, "metadata": { "$ref": "#/components/schemas/Resource_Management_APIs_version-metadata" } }, "example": { "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "TENANT_EXCLUSION_LIST", "name": "excluded-tenants", "displayName": "Excluded Tenants", "description": "Boundary that excludes a group of tenants.", "resourceList": [ "jayovsssgbgbpk47ihblujcm2e" ], "tenantVisibility": "ALL" } } }, "examples": { "Resource_Management_APIs_CustomPermissionBoundary": { "description": "Basic example of a permission boundary JSON object with type `CUSTOM`.", "value": { "id": "a4jzydksmrf3jnu5yfcwpl4a4a", "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "CUSTOM", "name": "custom-boundary", "displayName": "Custom Boundary", "value": "custom-boundary-value", "description": "A custom permission boundary.", "tenantVisibility": "NONE", "metadata": { "version": "0.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_ExclusionListPermissionBoundary": { "description": "Basic example of a permission boundary JSON object with type `TENANT_EXCLUSION_LIST`.", "value": { "id": "a4jzydksmrf3jnu5yfcwpl4a4a", "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "TENANT_EXCLUSION_LIST", "name": "excluded-tenants", "displayName": "Excluded Tenants", "description": "Boundary that excludes a small group of tenants.", "resourceList": [ "jayovsssgbgbpk47ihblujcm2e" ], "tenantVisibility": "ALL", "metadata": { "version": "0.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_InclusionListPermissionBoundary": { "description": "Basic example of a permission boundary JSON object with type `TENANT_INCLUSION_LIST`.", "value": { "id": "a4jzydksmrf3jnu5yfcwpl4a4a", "ownerType": "APPLICATION", "ownerId": "pl4a4aa4jzydksmrf3jnu5yfcw", "type": "TENANT_INCLUSION_LIST", "name": "included-tenants", "displayName": "Included Tenants", "description": "Boundary that includes a small group of tenants.", "resourceList": [ "jayovsssgbgbpk47ihblujcm2e" ], "tenantVisibility": "ALL", "metadata": { "version": "0.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } } }, "headers": { "Resource_Management_APIs_ETag": { "schema": { "type": "string", "example": "1.0", "minLength": 1 }, "description": "The version of the resource" }, "Resource_Management_APIs_Location": { "schema": { "type": "string" }, "description": "URL pointing to the location of the newly created resource" } }, "responses": { "Resource_Management_APIs_401": { "description": "Unauthorized", "headers": { "WWW-Authenticate": { "description": "Includes details on the failed authentication condition. This header is set in accordance with the [OAuth2 specification](https://datatracker.ietf.org/doc/html/rfc6750#section-3).", "schema": { "type": "string", "example": "Bearer error=\"invalid_token\", error_description=\"The provided access token was invalid\"" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unauthenticated": { "value": { "type": "base_error", "code": "invalid_access_token", "message": "The provided access token was invalid", "ticket": "1u0d0edhwbjsd" } } } } } }, "Resource_Management_APIs_403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unauthorized": { "value": { "type": "base_error", "code": "unauthorized", "message": "The request failed authorization", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_405": { "description": "Method Not Allowed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - method_not_supported": { "value": { "type": "base_error", "code": "method_not_supported", "message": "The specified HTTP method is not supported", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_406": { "description": "Not Acceptable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - not_acceptable": { "value": { "type": "base_error", "code": "not_acceptable", "message": "The Accept header was invalid", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unsupported_media_type": { "value": { "type": "base_error", "code": "unsupported_media_type", "message": "The Content-Type header was invalid", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - internal_server_failure ": { "value": { "type": "base_error", "code": "internal_server_failure", "message": "An unexpected error occurred while processing the request", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - service_unavailable": { "value": { "type": "base_error", "code": "service_unavailable", "message": "The service is currently unavailable", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_400-with-message-body": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, { "$ref": "#/components/schemas/Resource_Management_APIs_constraint-violations-api-error" } ] }, "examples": { "code - invalid_request": { "value": { "type": "base_error", "code": "invalid_request", "message": "The request was invalid", "ticket": "11t7n71hi5e6t" } }, "code - request_constraint_violations": { "value": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The message body contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": 10 } }, "field2": { "code": "not_null" } } } }, "code - message_body_constraint_violations": { "value": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The message body contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": 10 } }, "field2": { "code": "not_null" } } } } } } } } } }, "x-tagGroups": [ { "name": "Resource Management APIs", "tags": [ "Applications", "Auth Factors", "Auth Sessions", "Auth Session Policies", "Bot Detection Policies", "Custom Claims", "Custom Domains", "Email Brandings", "Email Domains", "Email Policies", "External IdP Profiles", "External IdP Tokens", "Identity Providers", "IdP Attribute Mappings", "IdP Role Mappings", "MFA Policies", "OAuth2 Clients", "Page Brandings", "Password Policies", "Permissions", "Permission Boundaries", "Permission Groups", "Refresh Tokens", "Remembered Tenants", "Roles", "Role Assignment Policies", "Signing Keys", "Tenants", "Users", "User Schemas", "Vanity Domains", "Webhook Policies", "Workflow Policies" ] } ] } ```