Grant user role upon registration in different organization

Hi! I have a question regarding the automatic granting of a role to a user upon creation.
I am using a self-hosted instance, deployed via helm chart version 9.5.3. The zitadel version is v4.2.0.
I have two organizations. The default organization (ORG1) is granted access to a project in ORG2.
Now when I create a new user in ORG1, I want it, by default, to have the role, 'reader' in the project in ORG2.
Therefore I created an action is per the documentation example https://zitadel.com/docs/apis/actions/code-examples#add-grants-to-users :

function addDefaultGrants(ctx, api) {
    api.userGrants.push({
        projectID: '<PROJECT_ID>',
        roles: ['reader']
    });
}

function addDefaultGrants(ctx, api) {
    api.userGrants.push({
        projectID: '<PROJECT_ID>',
        roles: ['reader']
    });
}

function addDefaultGrants(ctx, api) {
    api.userGrants.push({
        projectID: '<PROJECT_ID>',
        roles: ['reader']
    });
}

function addDefaultGrants(ctx, api) {
    api.userGrants.push({
        projectID: '<PROJECT_ID>',
        roles: ['reader']
    });
}

This role does of course exist in the project in ORG2. But as I created the action for ORG1, where I want to create the user, I get an error upon creation:

Errors.Project.Role.NotFound (COMMAND-mm9F4)

Errors.Project.Role.NotFound (COMMAND-mm9F4)

Errors.Project.Role.NotFound (COMMAND-mm9F4)

Errors.Project.Role.NotFound (COMMAND-mm9F4)
Maybe I am missing something, but is there a way to have users created in ORG1 and grant them a role in the project in ORG2 via an action upon creation?
Thanks in advance

ZITADEL Docs

Actions are a powerful tool to extend ZITADEL and you might wonder what use cases actions can be used for.

Ask Inkeep•11/21/25, 9:22 AM

Hi @Bob, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

Ask Inkeep•11/21/25, 9:22 AM

Answer

I wasn't able to find a direct answer, here are some relevant sources:

ZITADEL Projects (1) : This explains how project grants work between organizations and how granted organizations can manage selected roles for projects.
Assign project role to user authorization via API (2) : This discussion shows that when creating user grants via API, you need to use roleKeysroleKeys instead of rolesroles in the request body.

Ask Inkeep•11/21/25, 9:22 AM

To learn more, see the sources I considered:

[1] ZITADEL Projects
[2] Assign project role to user authorization via API

Ask Inkeep•11/21/25, 9:22 AM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] ZITADEL Projects](https://z...

Ask InkeepAPP•11/21/25, 9:22 AM

Got it. Tagging @Rajat for additional help.

Rajat•11/24/25, 11:16 AM

hey @Bob welcome to the server, you can check out this comment of mine that helps you verify if you created the role in the correct org

(which I think is the issue here) and then please let me know here if you have any other questions

BobOP•11/25/25, 2:57 PM

Thanks Rajat, that solves my problem!

Gigi the Giraffe (Zitadel)•11/25/25, 3:34 PM

Looks like you just helped out another community member! Thanks for being so helpful @1441354091233149024! You're now one step closer to leveling up—keep up the amazing peer support!

Rajat•11/25/25, 3:34 PM

awesome @Bob you can mark my answer with

and it will auto close this thread