Can role be picked from yml and user from API

That is valid, but I would question why you would choose to do that.
We recommend you use API for easy of maintenance, and only use files for the users + roles that absolutely have to work even when your cluster is red.