Create Permission Rules

curl -X POST 'https://app.memorylake.ai/openapi/memorylake/admin/v1/permission-rules' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "actions": [
      "example"
    ],
    "reason": "example",
    "resource": "example",
    "subject_id": "8488f48135da0a123c4c74cad0b8fbbc",
    "subject_type": "role",
    "auto_grant_prerequisites": false,
    "effect": "allow"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "prerequisite_rule_count": 1,
    "rules": [
      {
        "action": "example",
        "editable": false,
        "effect": "allow",
        "resource": "example",
        "rule_id": "e15be74d9ecc690478b6de3c80b98886",
        "subject_id": "e44cc30b3cc8c0e0c437912296ab9d73",
        "subject_type": "role"
      }
    ]
  }
}

curl -X POST 'https://app.memorylake.ai/openapi/memorylake/admin/v1/permission-rules' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "actions": [
      "example"
    ],
    "reason": "example",
    "resource": "example",
    "subject_id": "8488f48135da0a123c4c74cad0b8fbbc",
    "subject_type": "role",
    "auto_grant_prerequisites": false,
    "effect": "allow"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "prerequisite_rule_count": 1,
    "rules": [
      {
        "action": "example",
        "editable": false,
        "effect": "allow",
        "resource": "example",
        "rule_id": "e15be74d9ecc690478b6de3c80b98886",
        "subject_id": "e44cc30b3cc8c0e0c437912296ab9d73",
        "subject_type": "role"
      }
    ]
  }
}

POST /openapi/memorylake/admin/v1/permission-rules

Allows one or more actions on a resource for a custom role or a single member — one rule per action. Only allow rules can be created; a deny (which would win over allows from any source except the owner) is not available — to take a permission away, delete the rule that grants it. The built-in roles cannot be changed, and actions that belong to the team owner cannot be granted. When an action depends on others the subject lacks, the request is refused with 409 unless auto_grant_prerequisites is set.

Permission required: policy:manage

Headers

string

Optional. Retrying with the same value replays the first result.

Request Body

array

required

Actions to allow on the resource; one rule per distinct action

string

required

Why the change is made; recorded in the audit log

string

required

Resource type, e.g. memorylake:project (see GET /permission-catalog), or one instance as <resource_type>:<instance_id>. API key permissions are written on tenant:service_account:own or tenant:service_account:any.

string

required

A custom role key of this team, or a member’s principal_id. The built-in roles cannot be changed.

string

required

role or member

boolean

When an action needs others the subject lacks (e.g. modify needs read), add those too. Without it such a request is refused with 409 naming what is missing.

string

default:"allow"

allow. Deny rules cannot be created: to take a permission away, delete the rule that grants it.

curl -X POST 'https://app.memorylake.ai/openapi/memorylake/admin/v1/permission-rules' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "actions": [
      "example"
    ],
    "reason": "example",
    "resource": "example",
    "subject_id": "8488f48135da0a123c4c74cad0b8fbbc",
    "subject_type": "role",
    "auto_grant_prerequisites": false,
    "effect": "allow"
  }'

Response

object

Show Create Permission Rules object

integer

How many extra rules were added for prerequisites (auto_grant_prerequisites)

array

The rules created, one per distinct action

Show Permission Rule object

string

Action

boolean

false for the rules of the built-in roles (owner, admin, member), which cannot be changed

string

allow grants the action; deny takes it away and wins over an allow from any non-owner source. Only allow rules can be created; deny rules may still appear on older data.

string

Resource type (see GET /permission-catalog), or one instance of it as <resource_type>:<instance_id>

string

Opaque identifier; pass it to Delete Permission Rule. Do not parse it.

string

Role key, or the member’s principal_id

string

What the rule applies to. One of: role, member.

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "prerequisite_rule_count": 1,
    "rules": [
      {
        "action": "example",
        "editable": false,
        "effect": "allow",
        "resource": "example",
        "rule_id": "e15be74d9ecc690478b6de3c80b98886",
        "subject_id": "e44cc30b3cc8c0e0c437912296ab9d73",
        "subject_type": "role"
      }
    ]
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`400`	A parameter or the body is invalid
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Headers

Request Body

Response

Errors

​Headers

​Request Body

​Response

​Errors

Headers

Request Body

Response

Errors