I'm trying to secure some REST URLs that are present in my ApiController.php so that users with certain privileges can access these REST APIs. I created some users and assigned them with some Roles using the below link:


As you can see, I'm creating roles in Drupal Admin following below steps:

Drupal UI → People → Role → Add New Role // line 4

After that, I added a few permissions in permission.yml:


edit permission:
  title: 'edit permission'

And updated routing file to secure APIs:


  path: '/update'
    _controller: 'ApiController::update'
    _permission: 'edit permission'

This is working fine. i.e. users that have "edit permission" can access URL "/update". But, I don't want to do step on line 4 rather I would like to use some .yaml file to create Roles.


User roles are defined in YML files called user.role.ROLENAME.yml.

Do a config export (drush cex) to get an idea how these files should look like (they will be written to your config/sync directory).

Then create your custom role YML files in my_module/config/install and they will be created when you enable your module (if you took a YML file from config/sync as blueprint, remove the uuid and default_config_hash keys)

The file should look something like this:

langcode: en
status: true
dependencies: {  }
id: my_custom_role
label: My custom role
weight: 1234
is_admin: null
  - 'do fancy stuff'
  • This helped a lot! Thanks – Virtual Jun 13 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.