Create a resource with the Node.js SDK
permit.api.resources.create() creates a resource type, such as document or invoice, in the Permit.io environment that your Node.js SDK client is connected to. A resource defines the actions that policies grant, such as read or write. This reference is for backend developers who define the policy schema from code instead of the Permit dashboard.
Prerequisites
- A
permitclient created with an API key for the environment. See Create a Permit client and Get your API key.
Method signature
| Method | Signature | Status |
|---|---|---|
permit.api.resources.create | create(resourceData: ResourceCreate): Promise<ResourceRead> | Recommended |
permit.api.createResource | createResource(resource: ResourceCreate): Promise<ResourceRead> | Deprecated alias with the same argument |
Parameters
The method takes one argument: a ResourceCreate object. Pass the object itself, not a JSON string.
| Field | Type | Required | Description |
|---|---|---|---|
key | string | Yes | URL-friendly identifier of the resource (a slug). Use the key instead of the resource ID in later calls and in permit.check(). |
name | string | Yes | Display name of the resource. |
actions | object | Yes | Actions on the resource. Each key is an action key, and each value is an action definition object, such as { name: "Read" } or {}. |
urn | string | No | Uniform Resource Name (URN) of the resource. |
description | string | No | What the resource represents in your system. |
attributes | object | No | Attributes that each instance of the resource has, for use in attribute-based access control (ABAC) policies. |
roles | object | No | Resource roles for relationship-based access control (ReBAC). Each key is a role key, and each value holds the role properties, such as granted permissions. |
relations | object | No | Relations to other resources. Each key is a relation key, and each value is the related resource. |
Example ResourceCreate object with placeholder values:
{
key: "key",
name: "name",
urn: "urn",
description: "description",
actions: {},
attributes: {},
roles: {},
relations: {}
}
Example
const response = await permit.api.resources.create(resource);
Return value
The method resolves to a ResourceRead object: the fields you sent, plus id, organization_id, project_id, environment_id, created_at, and updated_at.
If the Permit API returns an error status code, for example status code 409 when a resource with the same key exists, permit.api.resources.create() throws a PermitApiError. The deprecated permit.api.createResource() rethrows the underlying Axios error.