> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexagon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# createRoleMembersPlan (OPA)

> Creates a template Role Members Plan File from workspace roles on the OPA instance. These are the runtime roles shown in the OPA UI after an applicati

Creates a template Role Members Plan File from workspace roles on the OPA instance. These are the runtime roles shown in the OPA UI after an application is activated. Design-area roles may reflect only what is defined in the artifact, while this plan updates workspace roles. The source Process Application must be activated so that role membership is available through the data-access API. System-defined roles are not included.

Workspace roles are not version-specific. The plan keys do not include a version, membership is managed by application name and role name, consistent with how roles are managed in the OPA UI.

The `roleMembersPlan.properties` file lists users, groups, and external applications for each Process Application role. Each entry specifies the members that should be applied to the corresponding application and role on the target environment.

The same application export (`.expx`) is typically deployed across multiple environments, where role membership may differ between Dev, Test, and Production. The plan file stores these environment-specific members so FlexDeploy can update them automatically during deployment.

After the application is imported and activated, FlexDeploy reads the plan file, identifies entries for that application, and updates the matching workspace roles on the target. For `APPLICATION` roles, membership becomes exactly the set defined in the plan, members are added or removed as needed. For `GLOBAL` roles, plan members are added only. Existing members are not removed because removing a global member could affect access to other applications.

If no plan file exists, or if a role has no member entries in the plan, that role is left unchanged. Role member overrides run only when the application is activated. Keep only the role entries that you want to override and remove the remaining entries.

> [!NOTE]
>
> Either **FDOPA\_CLOUD\_ACCOUNT\_CODE** Target property value or **FDOPA\_INP\_CLOUD\_ACCOUNT\_CODE** plugin input value should exist. When both exist, the plugin input value will take precedence. See [Creating/Editing a Cloud Account and Provider](https://docs.flexagon.com/flexdeploy-11-2-documentation/flexdeploy-users-guide/integrations/cloud-account-and-provider.md) for details on how to setup a Cloud Account for OIC.

# Target Properties

<table><colgroup><col /><col /><col /><col /></colgroup><tbody><tr><th>**Property Name**</th><th>**Property Code**</th><th>**Required**</th><th>**Description**</th></tr><tr><td>OPA Account</td><td>`FDOPA_CLOUD_ACCOUNT_CODE`</td><td>No</td><td>The OPA account includes essential properties such as the URL, Username, Password, and OAuth details for the OPA instance. You can manage the OPA account via the **Integrations > Cloud** page.See [Configuring OPA Cloud Account](https://docs.flexagon.com/flexdeploy-11-2-documentation/flexdeploy-plugin-guides/flexdeploy-oracle-process-automation-plugin-guide/appendix-opa/configuring-opa-cloud-account.md) for additional details.</td></tr></tbody></table>

# Inputs

<table><colgroup><col /><col /><col /><col /></colgroup><tbody><tr><th>**Input Name**</th><th>**Input Code**</th><th>**Required**</th><th>**Description**</th></tr><tr><td>OPA Account</td><td>`FDOPA_INP_CLOUD_ACCOUNT_CODE`</td><td>No</td><td>The OPA account with all the required properties like Base URI, Username and Password for running OPA Instance.</td></tr><tr><td>Application Identifiers</td><td>`FDOPA_INP_APPLICATION_NAME`</td><td>No</td><td>CSV list of application identifiers (for example APP1,APP2). Do not include version. Leave blank to export roles for all process applications.</td></tr><tr><td>Role Members Plan File</td><td>`FDOPA_INP_ROLE_MEMBERS_PLAN`</td><td>No</td><td>Optional input to specify a different role members plan file name. Default 'roleMembersPlan.properties'.</td></tr></tbody></table>

# Artifacts

This operation doesn’t consume or produce any artifacts.

# Endpoint Selection

This operation will select all available endpoints associated to the Target.

# Endpoint Execution

This operation will execute on any one of the selected endpoints and will be random in the determination of which one.