Get Role Access Scope

curl -X GET 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "role_key": "tenant_member",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

curl -X GET 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "role_key": "tenant_member",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

GET /openapi/memorylake/admin/v1/roles/{role_key}/access-scope

Returns, per resource type, whether holders of the role reach every instance (mode all) or only the listed ones (mode instances). The owner role has no scope (409). The ETag header identifies this state for a conditional Set Role Access Scope.

Permission required: policy:manage

Path Parameters

string

required

Role key (key)

curl -X GET 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx'

Response

object

Show Role Access Scope object

string

The role

array

One entry per scopable resource type

Show Access Scope Entry object

string

all = every instance; instances = only the listed ones

string

Resource type, e.g. memorylake:project (see GET /permission-catalog)

array

Read-only. Instance-level actions the member’s role grants for this type — the most a scope entry can allow.

array

The instances, when mode is instances

Show Access Scope Instance object

string

Instance id, as returned by the data API

array

Actions allowed on this instance. Omit for every action the member’s role allows.

array

Read-only. The subset of actions the member’s CURRENT role still grants.

string

Read-only. The permission level, when via_permission_level is true. One of: read, write, manage.

array

Read-only. Actions stored here that the member’s current role no longer grants.

boolean

Read-only. The member reaches this instance through a permission level granted on it, not through this scope. May be echoed back on write; such instances are skipped.

string

Parent workspace of a project instance. Required when writing a project instance.

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "role_key": "tenant_member",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Path Parameters

Response

Errors

​Path Parameters

​Response

​Errors

Path Parameters

Response

Errors