## Resource: RoleAssignment

Defines an assignment of a role.

| JSON representation |
|---|
| ``` { "roleAssignmentId": string, "roleId": string, "kind": string, "etag": string, "assignedTo": string, "assigneeType": enum (`https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments#AssigneeType`), "scopeType": string, "orgUnitId": string, "condition": string, "expirationDetails": { object (`https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments#ExpirationDetails`) } } ``` |

| Fields ||
|---|---|
| `roleAssignmentId` | `string (https://developers.google.com/discovery/v1/type-format format)` ID of this roleAssignment. |
| `roleId` | `string (https://developers.google.com/discovery/v1/type-format format)` The ID of the role that is assigned. |
| `kind` | `string` The type of the API resource. This is always `admin#directory#roleAssignment`. |
| `etag` | `string` ETag of the resource. |
| `assignedTo` | `string` The unique ID of the entity this role is assigned to---either the `userId` of a user, the `groupId` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts). |
| `assigneeType` | ``enum (`https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments#AssigneeType`)`` Output only. The type of the assignee (`USER` or `GROUP`). |
| `scopeType` | `string` <br /> The scope in which this role is assigned. Acceptable values are: - `CUSTOMER` - `ORG_UNIT` |
| `orgUnitId` | `string` If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to. |
| `condition` | `string` Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`roleId`) is applied to the actor (`assignedTo`) at the scope (`scopeType`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition. |
| `expirationDetails` | ``object (`https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments#ExpirationDetails`)`` Optional. Details regarding the expiration of this role assignment. |

## AssigneeType

The type of identity to which a role is assigned.

| Enums ||
|---|---|
| `USER` | An individual user within the domain. |
| `GROUP` | A group within the domain. |

## ExpirationDetails

Details regarding the expiration of this role assignment. Used to automatically revoke access when the time limit is reached.

| JSON representation |
|---|
| ``` { "expireTime": string } ``` |

| Fields ||
|---|---|
| Union field `expiration`. `expiration` can be only one of the following: ||
| `expireTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` The specific timestamp when the role assignment expires. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |

| ## Methods ||
|---|---|
| ### `https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/delete` | Deletes a role assignment. |
| ### `https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/get` | Retrieves a role assignment. |
| ### `https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/insert` | Creates a role assignment. |
| ### `https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/list` | Retrieves a paginated list of all roleAssignments. |