admin.roles.addAssignments method
We're still building and not all features are available quite yet. Enjoy this peek into the future!
Not ready for the future? Return to the past at api.slack.com.
Usage info
With admin.roles.addAssignments, you can add members to a specified role, granting them the permission scopes that are assigned to that role.
The API will process all user, team, and org IDs passed. In cases where an invalid user or other entity ID is passed, the ID will be rejected and details (including the reason for the rejection) will be provided in the respective rejected_users and/or rejected_entities response.
Admin Roles
The following roles and their respective scope types can be assigned by Org Owners and Org Admins on Enterprise plans:
| Role | Role ID | Scope Type |
|---|---|---|
| Analytics Admin | Rl0L | Team or Org |
| Audit Logs Admin | Rl0C | Team or Org |
| Channel Admin | Rl01 | Team or Org |
| Channel Manager | Rl0A | Team or Org |
| Conversation Admin | Rl05 | Team or Org |
| DLP Admin | Rl09 | Org |
| Exports Admin | Rl0F | Org |
| Integrations Manager | Rl0D | Org |
| Legal Holds Admin | Rl04 | Org |
| Message Activity Manager | Rl0E | Org |
| Role Admin | Rl02 | Team or Org |
| Sales Admin | Rl0G | Org |
| Security Admin | Rl0J | Org |
| Slack Platform Developer | Rl0B | Team or Org |
| User Admin | Rl03 | Team or Org |
| Workflow Admin | Rl0K | Org |
Utilizing Admin API endpoints
This admin scope is obtained through version two of the OAuth V2 flow, but there are a few additional requirements. The app requesting this scope must be installed by an admin or Owner of an Enterprise Grid organization. Also, the app must be installed on the entire org, not on an individual workspace. See below for more details.
If the app is installed by an Org Admin or Owner, ensure the Channel Management settings provide the appropriate permissions. The Org Admin or Owner installing the app must have the Channel Management role, and must also be granted access to Public channels and Private channels within this role. If these criteria aren't met, the Org Admin or Owner will receive a not_allowed error when attempting to install an app.
Admin API endpoints reach across an entire Enterprise Grid organization, not individual workspaces.
For a token to be imbued with Admin scopes, it must be obtained from installing an app on the entire Grid org, not just a workspace within the organization.
To configure and install an app supporting Admin API endpoints on your Enterprise Grid organization:
- Create a new Slack app. Your app will need to be able to handle a standard OAuth 2 flow.
- In the app's settings, select OAuth & Permissions from the left navigation. Scroll down to the section titled Scopes and add the
admin.*scope you want. Click the Save Changes button. - In the app's settings, select Manage Distribution from the left navigation. Under the section titled Share Your App with Other Workspaces, make sure all four sections have the green check. Then click the green Activate Public Distribution button.
- Under the Share Your App with Your Workspace section, copy the Sharable URL and paste it into a browser to initiate the OAuth handshake that will install the app on your organization. You must be logged in as an admin or Owner of your Enterprise Grid organization to install the app.
- Check the dropdown in the upper right of the installation screen to make sure you are installing the app on the organization, not an individual workspace within the organization. See the image below for a visual.
- Once your app completes the OAuth flow, you will be granted an OAuth token that can be used for calling Admin API methods for your organization.
When installing an app to use an Admin API endpoint, be sure to install it on your Grid organization, not a workspace within the organization.