PUT /openapi/memorylake/admin/v1/access/{resource_type}/{resource_id}/scope-grants/{subject_type}/{subject_id}
resource_type | resource_id is | Permission |
|---|---|---|
workspaces | workspace_id | workspace:assign on workspace_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: workspace:assign on workspace_id or access_group:viewAlso required: workspace:read on workspace_id |
projects | project_id | project:assign on project_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: project:assign on project_id or access_group:viewAlso required: project:read on project_id |
actors | actor_id | actor:assign on actor_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: actor:assign on actor_id or access_group:viewAlso required: actor:read on actor_id |
agents | agent_id | agent:assign on agent_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: agent:assign on agent_id or access_group:viewAlso required: agent:read on agent_id |
skills | skill_id | skill:assign on skill_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: skill:assign on skill_id or access_group:viewAlso required: skill:read on skill_id |
boundaries | boundary_id | boundary:assign on boundary_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: boundary:assign on boundary_id or access_group:viewAlso required: boundary:read on boundary_id |
workspaces/{workspace_id}/actors | actor_id | workspace_actor:assign on workspace_id}/{actor_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: workspace_actor:assign on workspace_id}/{actor_id or access_group:viewAlso required: workspace_actor:read on workspace_id}/{actor_id |
workspaces/{workspace_id}/agents | agent_id | workspace_agent:assign on workspace_id}/{agent_id or member:set_scope (when subject_type is members) or access_group:manage (when subject_type is access-groups)Also required: workspace_agent:assign on workspace_id}/{agent_id or access_group:viewAlso required: workspace_agent:read on workspace_id}/{agent_id |
Path Parameters
string
required
Resource type — one of the values in the table above
string
required
Identifier of the resource, as listed in the table above
string
required
members or access-groups
string
required
principal_id of a member, or an access group id
Headers
string
Optional. Retrying with the same value replays the first result.
Request Body
string
required
Why the change is made; recorded in the audit log
string
Projects only: the project’s workspace, so the project can be shown by name in access scopes
curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/scope-grants/members/89914667f74821b220f374d323f0f4b0' \
-H 'Authorization: Bearer sk_xxxxxx' \
-H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
-H 'Content-Type: application/json' \
-d '{
"reason": "example",
"workspace_id": "ca1916805adbcec16aceaaf65c1a4b74"
}'
Response
object
Show Resource Access View object
Show Resource Access View object
array
Members and access groups that reach the instance
Show Resource Access Entry object
Show Resource Access Entry object
string
Display name
string
principal_id, or access group id
string
member or access_group
array
Actions the explicit sources allow
string
For blocked entries: scope = limited to other instances; permission = their role cannot view this resource type at all
object
Members: the levels the caller may set them to here
Show Permission Level Options object
Show Permission Level Options object
boolean
Whether the caller may remove the member’s level (level none)
array
Levels the caller may set this member to (excluding the current one)
string
Why the current level cannot be lowered or removed: outranked = the member’s level is not below the caller’s; last_manager = the member is the last one who can manage the resource; no_permission = the caller cannot share this resource
string
The member’s level set on this instance; omitted when none is set. One of:
read, write, manage.integer
Access groups: number of members
string
What the member can do on this instance, from every source combined. One of:
read, write, manage.string
Members: their role
integer
How many instances of this resource type are in the subject’s access scope
string
Members: all = not limited by an access scope for this resource type; instances = limited to the instances in their scope
array
How the subject reaches the instance
Show Resource Access Source object
Show Resource Access Source object
string
role: the member’s role reaches every instance. scope_grant: the instance is in the subject’s access scope. access_group: an access group’s instance list. parent: granted on the parent workspace. permission_level: a permission level set on this instance.
string
For access_group: the group
string
For access_group: its name
array
Actions this source allows; [”*”] = all the subject’s permissions allow
string
For parent: the parent workspace id
array
For permission_level: the levels held on this instance
integer
Members who can access the instance
array
Members who cannot
Show Resource Access Entry object
Show Resource Access Entry object
string
Display name
string
principal_id, or access group id
string
member or access_group
array
Actions the explicit sources allow
string
For blocked entries: scope = limited to other instances; permission = their role cannot view this resource type at all
object
Members: the levels the caller may set them to here
Show Permission Level Options object
Show Permission Level Options object
boolean
Whether the caller may remove the member’s level (level none)
array
Levels the caller may set this member to (excluding the current one)
string
Why the current level cannot be lowered or removed: outranked = the member’s level is not below the caller’s; last_manager = the member is the last one who can manage the resource; no_permission = the caller cannot share this resource
string
The member’s level set on this instance; omitted when none is set. One of:
read, write, manage.integer
Access groups: number of members
string
What the member can do on this instance, from every source combined. One of:
read, write, manage.string
Members: their role
integer
How many instances of this resource type are in the subject’s access scope
string
Members: all = not limited by an access scope for this resource type; instances = limited to the instances in their scope
array
How the subject reaches the instance
Show Resource Access Source object
Show Resource Access Source object
string
role: the member’s role reaches every instance. scope_grant: the instance is in the subject’s access scope. access_group: an access group’s instance list. parent: granted on the parent workspace. permission_level: a permission level set on this instance.
string
For access_group: the group
string
For access_group: its name
array
Actions this source allows; [”*”] = all the subject’s permissions allow
string
For parent: the parent workspace id
array
For permission_level: the levels held on this instance
array
Permission levels the caller may set on this instance; empty when the caller cannot share it
string
Instance id; <workspace_id>/<id> for workspace actors and agents
string
Resource type
{
"success": true,
"message": "Operation completed successfully",
"data": {
"allowed": [
{
"name": "Example name",
"subject_id": "e9225468996bae25743a2b64eeb19cc7",
"subject_type": "member",
"actions": [
"example"
],
"blocked_by": "scope",
"level_options": {
"can_set_none": true,
"settable_levels": [
"example"
],
"blocked_reason": "outranked",
"current_level": "read"
},
"member_count": 1,
"permission_level": "read",
"role": "tenant_member",
"scope_grant_count": 1,
"scope_mode": "all",
"sources": [
{
"type": "role",
"access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
"access_group_name": "Example access group",
"actions": [],
"parent_id": "ba8581988563142580f3237fbf400514",
"permission_levels": []
}
]
}
],
"allowed_count": 1,
"blocked": [
{
"name": "Example name",
"subject_id": "e9225468996bae25743a2b64eeb19cc7",
"subject_type": "member",
"actions": [
"example"
],
"blocked_by": "scope",
"level_options": {
"can_set_none": true,
"settable_levels": [
"example"
],
"blocked_reason": "outranked",
"current_level": "read"
},
"member_count": 1,
"permission_level": "read",
"role": "tenant_member",
"scope_grant_count": 1,
"scope_mode": "all",
"sources": [
{
"type": "role",
"access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
"access_group_name": "Example access group",
"actions": [],
"parent_id": "ba8581988563142580f3237fbf400514",
"permission_levels": []
}
]
}
],
"grantable_levels": [
"example"
],
"instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
"resource_type": "example"
}
}
Errors
Errors answer withsuccess: false, a message and an error_code. See Error Codes for every code.
| Status | Meaning |
|---|---|
400 | A parameter or the body is invalid |
401 | The API key is missing, invalid, disabled or expired |
403 | The key is not allowed to do this |
404 | The resource does not exist |
409 | The request conflicts with the current state, e.g. a duplicate or a limit reached |
422 | The body or a parameter failed validation |
429 | Too many requests. Wait for the time in Retry-After |
500 | Server-side error |
503 | Temporarily unavailable. Retry later |