# Kong manage role and authority

**URL:** <https://discuss.konghq.com/t/kong-manage-role-and-authority/12554>\
**Category:** Questions\
**Created:** [April 5, 2024, 4:23am UTC](https://discuss.konghq.com/t/kong-manage-role-and-authority/12554 "2024-04-05T04:23:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![muhamad\_iqbal](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/muhamad_iqbal/32/4421_2.png) [@muhamad\_iqbal](https://discuss.konghq.com/u/muhamad_iqbal)\
**Post date:** [April 5, 2024, 4:23am UTC](https://discuss.konghq.com/t/kong-manage-role-and-authority/12554/1 "2024-04-05T04:23:04Z")

</div>

Hi

Is it possible in Kong we define the endpoint and secure the endpoint with some kind of rules, for instances /api/users/create hasRole(‘Admin’) and hasAuthority(‘write’). And that particular rule is extract from JWT Token ?

Thanks,  
Nizar

---

<div class="post-metadata">

**Author:** ![johnharris85](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/johnharris85/32/3010_2.png) [@johnharris85](https://discuss.konghq.com/u/johnharris85)\
**Post date:** [April 22, 2024, 8:28pm UTC](https://discuss.konghq.com/t/kong-manage-role-and-authority/12554/2 "2024-04-22T20:28:30Z")

</div>

Hey Nizar,

You may be able to do some / most of what you want with some logic built around the JWT plugin: [JWT - Plugin | Kong Docs](https://docs.konghq.com/hub/kong-inc/jwt) (OSS). If you are on Kong Enterprise, the OIDC plugin is more full-featured and probably can do all of what you need based on specific groups / claims etc: [OpenID Connect - Plugin | Kong Docs](https://docs.konghq.com/hub/kong-inc/openid-connect/).