Define a role with Blueprints

Use Blueprints to define a custom role in code alongside your project's other resources.

Blueprints let you define custom roles alongside other resources. Roles are sets of permissions that can be assigned to users and robot tokens. You can even combine roles and robot tokens with Blueprints to provide explicit access in Functions.

In this guide, you’ll define a custom role resource with Blueprints and deploy the blueprint to Sanity.

Prerequisites:

• The latest version of the sanity CLI is recommended to interact with Blueprints. You can always run the latest CLI commands with npx sanity@latest.
• An existing project and a role with permission to edit roles (requires the sanity-project-roles permission).
• Custom role support was first introduced in @sanity/blueprints v0.5.0. We recommend using the latest version of the library.

To initialize a blueprint in the current directory, run the command below. Replace the project ID with your own. Skip to the next section if you already have a blueprint set up.

npx sanity@latest blueprints init . --type ts --project-id <project-id> --stack-name production

pnpm dlx sanity@latest blueprints init . --type ts --project-id <project-id> --stack-name production

yarn dlx sanity@latest blueprints init . --type ts --project-id <project-id> --stack-name production

bunx sanity@latest blueprints init . --type ts --project-id <project-id> --stack-name production

Use the defineRole helper to define a custom role resource.

import { defineBlueprint, defineRole } from "@sanity/blueprints"

export default defineBlueprint({
  resources: [
    defineRole({
      name: 'custom-robot-role',
      title: 'Custom Robot Role',
      appliesToRobots: true,
      appliesToUsers: false,
      permissions: [{
        name: 'sanity-project-cors',
        action: 'create',
      }],
    })
  ],
})

A full list of available configuration options is available in the reference documentation. You can learn more about the parts that make up a role in the roles and permissions documentation.

Next, deploy the blueprint.

npx sanity blueprints deploy

pnpm dlx sanity blueprints deploy

yarn dlx sanity blueprints deploy

bunx sanity blueprints deploy

Once the deployment finishes, the custom role is active.

If you need to make changes, update the blueprint file (sanity.blueprint.ts) and run the deploy command again.

To assign this role to a robot token that a function uses, see Use robot tokens with Functions.

Sometimes you want to remove a deployed resource so it won't run anymore or affect any future usage quotas.

To remove a resources created with a blueprint, you need to either:

• Remove the definition from the blueprint, and run the deploy command again.
• Destroy the blueprint with the destroy command.

The blueprints destroy command removes, or undeploys, the blueprint and all of its resources from Sanity's infrastructure. It does not remove your local files.

npx sanity blueprints destroy

pnpm dlx sanity blueprints destroy

yarn dlx sanity blueprints destroy

bunx sanity blueprints destroy

To remove the resource from the blueprint locally, you can remove it from the resources array in the sanity.blueprint.ts file, then delete any associated files.

When you run blueprints destroy, it's as if you never used blueprints init during setup. The only difference is you still have all the files in your directory. To use this blueprint again and redeploy it, you'll need to let Sanity know about it. You can do this by running init again:

npx sanity blueprints init

pnpm dlx sanity blueprints init

yarn dlx sanity blueprints init

bunx sanity blueprints init

This launches an editing interface that lets you reconfigure the blueprint, if needed, and it reconnects the blueprint to Sanity. Now you can add more functions or redeploy. Keep in mind that any environment variables added before destroying the blueprint will not carry over.