Cloud SQL Admin API Method: users.insert.

I’m trying to create a user for GCP CloudSQL Postgres that can connect via IAM.
User creation is successful, and the connection itself is working just fine.
However I have problems in setting the server roles on creation.

No matter what role I set in the request, I always get only 2:

• cloudsqliamserviceaccount
• [email protected]

It looks like these roles are ignored when the user type is CLOUD_IAM_SERVICE_ACCOUNT.

I tried to leave the user creation as is and update it later with proper roles, however I get an:

{
  "code": 400,
  "errors": [
    {
      "domain": "global",
      "message": "Invalid request: User of a different type already exists.",
      "reason": "invalid"
    }
  ],
  "message": "Invalid request: User of a different type already exists."
}

My bigger goal is to grant access to a db via REST, without making a connection & executing a SQL statement.
Or manual intervention, of course.