# Role Based Access Control in kong

**URL:** <https://discuss.konghq.com/t/role-based-access-control-in-kong/678>\
**Category:** Feature Requests & Feedback\
**Created:** [March 13, 2018, 12:43pm UTC](https://discuss.konghq.com/t/role-based-access-control-in-kong/678 "2018-03-13T12:43:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yvsssantosh](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/yvsssantosh/32/143_2.png) [@yvsssantosh](https://discuss.konghq.com/u/yvsssantosh)\
**Post date:** [March 13, 2018, 12:43pm UTC](https://discuss.konghq.com/t/role-based-access-control-in-kong/678/1 "2018-03-13T12:43:45Z")

</div>

Currently we have ACL’s in kong which allow or restrict a particular user to an endpoint written in kong

But how about Role Based Access Control?

So was just wondering if we could take each endpoint in given by user in kong and specify that only user having services.api\_name.get can access get request (just as an example when we are trying to perform /GET ) or allow users to configure the requests itself i.e. services.api\_name.get -\> is configured by the user where he/she can assign specific roles and users inheriting those roles can access that endpoint

---

<div class="post-metadata">

**Author:** ![balexandre](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/balexandre/32/234_2.png) [@balexandre](https://discuss.konghq.com/u/balexandre)\
**Post date:** [March 15, 2018, 9:02am UTC](https://discuss.konghq.com/t/role-based-access-control-in-kong/678/2 "2018-03-15T09:02:02Z")

</div>

As it stands today, and after reading the documentation, I have to assume that the only option is to [create a new API](https://getkong.org/docs/0.12.x/admin-api/#add-api) entry and restrict that one to only `GET` for example using the `methods` property, then you can acl it to `api-xxx-only-get`.

If you need more tunning, I would strongly suggest you do use JWT in your endpoint and restrict per consumer… maybe a Kong JWT plugin + OAuth0 could also else shape your request like it’s [explain in the docs](https://getkong.org/plugins/jwt/) because then all the roles are managed in their own dashboard.