Set Access Group Access Scope

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access-groups/7013fb5c15cfb29411f040967354b8a3/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "group_id": "75bcd78140d9e42928db031f1fbb59a5",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access-groups/7013fb5c15cfb29411f040967354b8a3/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "group_id": "75bcd78140d9e42928db031f1fbb59a5",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

PUT /openapi/memorylake/admin/v1/access-groups/{group_id}/access-scope

Replaces, per listed resource type, the instances the group gives its members access to. A group only adds access: mode all removes the type’s instances from the group and limits nobody. Project instances need their workspace_id. The response is the scope as Get Access Group Access Scope returns it, so view is required as well. The response carries an ETag header (the same value a GET of this resource returns). Send it back in If-Match to make the write conditional: when the resource has changed in the meantime the write is refused with 412 and nothing is changed. The check narrows, but does not fully close, the window for a concurrent overwrite — two writers that pass it at the same instant can both write.

Permission required: access_group:manage and access_group:view

Changes that give someone an admin role, or that reduce what an admin can reach, also require the team owner or an admin.

Path Parameters

string

required

Identifier

Headers

string

Optional. The ETag from a previous read of this resource. The write is refused with 412 when the resource has changed since; omit it to overwrite unconditionally.

Request Body

string

required

Why the change is made; recorded in the audit log

array

required

Each listed resource type’s instance list is replaced by the given one; mode all removes the type’s instances (a group never limits anyone). Types not listed keep their current list.

Show Access Scope Entry object

string

required

all = every instance; instances = only the listed ones

string

required

Resource type, e.g. memorylake:project

array

Required when mode is instances

Show Access Scope Instance object

string

required

Instance id

array

Omit for every action the member’s role allows

boolean

Echo of a read-only row. Instances marked true are skipped on write — permission levels are set on the resource, not through scope.

string

Parent workspace — required for project instances

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access-groups/7013fb5c15cfb29411f040967354b8a3/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

Response

object

Show Access Group Access Scope object

string

The group

array

One entry per scopable resource type; a group only ever adds access

Show Access Scope Entry object

string

all = every instance; instances = only the listed ones

string

Resource type, e.g. memorylake:project (see GET /permission-catalog)

array

Read-only. Instance-level actions the member’s role grants for this type — the most a scope entry can allow.

array

The instances, when mode is instances

Show Access Scope Instance object

string

Instance id, as returned by the data API

array

Actions allowed on this instance. Omit for every action the member’s role allows.

array

Read-only. The subset of actions the member’s CURRENT role still grants.

string

Read-only. The permission level, when via_permission_level is true. One of: read, write, manage.

array

Read-only. Actions stored here that the member’s current role no longer grants.

boolean

Read-only. The member reaches this instance through a permission level granted on it, not through this scope. May be echoed back on write; such instances are skipped.

string

Parent workspace of a project instance. Required when writing a project instance.

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "group_id": "75bcd78140d9e42928db031f1fbb59a5",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`400`	A parameter or the body is invalid
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`412`	The `If-Match` value no longer matches: the resource changed since you read it
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Set Access Group Access Scope

Path Parameters

Headers

Request Body

Response

Errors

​Path Parameters

​Headers

​Request Body

​Response

​Errors

Path Parameters

Headers

Request Body

Response

Errors