Cannot assign roles creating User through REST endpoint Sidenote, already seen this page, doesn't seem to help: How to create user with role(s) through REST service?

I've setup a new endpoint on my platform to try to allow a 3rd party to create users on the site, I've connected it up and I'm testing it out through a REST client on Firefox. So far it seems to be working fine with the exception of applying the role to the new account.

According to the link pasted above, it needs to be set to:

{
  "name": "rest_user_1",
  "mail": "rest_user_1@test.com",
  "pass": "abc123",
  "status": "1",
  "roles": [
    "5",
    "6"
  ]
}


But that doesn't work, I've got the debugger enabled, and I can see from the response it seems to be coming back with this

Array
(
    [0] =&gt; Array
        (
            [name] =&gt; rest_user_1
            [mail] =&gt; rest_user_1@test.com
            [pass] =&gt; abc123
            [status] =&gt; 1
            [roles] =&gt; Array
                (
                    [0] =&gt; 5
                    [1] =&gt; 6
                )

        )

)


To me it looks like it's assigning the role IDs (5/6) as the values in an array, rather than the keys, so instead I tried writing my body in a different way:

My body at the moment is:

{
  "name": "rest_user_2",
  "mail": "rest_user_2@test.com",
  "pass": "abc123",
  "status": "1",
  "roles": {
    "5": "Role 1",
    "6": "Role 2"
  }
}


And the response in the log messages looks like:

Array
(
    [0] =&gt; Array
        (
            [name] =&gt; rest_user_2
            [mail] =&gt; rest_user_2@test.com
            [pass] =&gt; abc123
            [status] =&gt; 1
            [roles] =&gt; Array
                (
                    [5] =&gt; Role 1
                    [6] =&gt; Role 2
                )

        )

)


Which looks like exactly what I'd expect, but yet, still it hasn't applied the roles to my account. Can anyone help?
For other people reaching this post, the answer to this is to use some kind of authentication on the REST endpoint, that only allows trusted users to create new users.

Otherwise anonymous users would be able to create admins and crash the site.

So this code is correct,

"roles": [
  "5",
  "6"
]


but the problem is that the user calling the endpoint has to have the administer permissions and administer users permission to be able to set roles to users.

That can be done by setting a role that has those permissions and also has permission to call the endpoint.

oAuth could be used to do that.