Set Permission Level

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/permission-levels/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "level": "read",
    "reason": "example",
    "workspace_id": "5bf25dc12466a4a9059dac4c35873ec7"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/permission-levels/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "level": "read",
    "reason": "example",
    "workspace_id": "5bf25dc12466a4a9059dac4c35873ec7"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

PUT /openapi/memorylake/admin/v1/access/{resource_type}/{resource_id}/permission-levels/{subject_type}/{subject_id}

Sets the permission level a member or access group holds on the resource. Use List Permission Level Options to see which levels you may set.

`resource_type`	`resource_id` is	Permission
`workspaces`	`workspace_id`	`workspace:assign` on `workspace_id` Also required: `workspace:read` on `workspace_id`
`projects`	`project_id`	`project:assign` on `project_id` Also required: `project:read` on `project_id`
`actors`	`actor_id`	`actor:assign` on `actor_id` Also required: `actor:read` on `actor_id`
`agents`	`agent_id`	`agent:assign` on `agent_id` Also required: `agent:read` on `agent_id`
`skills`	`skill_id`	`skill:assign` on `skill_id` Also required: `skill:read` on `skill_id`
`boundaries`	`boundary_id`	`boundary:assign` on `boundary_id` Also required: `boundary:read` on `boundary_id`
`workspaces/{workspace_id}/actors`	`actor_id`	`workspace_actor:assign` on `workspace_id}/{actor_id` Also required: `workspace_actor:read` on `workspace_id}/{actor_id`
`workspaces/{workspace_id}/agents`	`agent_id`	`workspace_agent:assign` on `workspace_id}/{agent_id` Also required: `workspace_agent:read` on `workspace_id}/{agent_id`

Changes that give someone an admin role, or that reduce what an admin can reach, also require the team owner or an admin.

Path Parameters

string

required

Resource type — one of the values in the table above

string

required

Identifier of the resource, as listed in the table above

string

required

members (access groups cannot hold permission levels). One of: members, access-groups.

string

required

principal_id of the member

Headers

string

Optional. Retrying with the same value replays the first result.

Request Body

string

required

The member’s final level on this instance. none removes every level set here — it is not a deny: the member keeps whatever their role, access scope or access groups give them. Not every type has every level (database connections have read and manage only); grantable_levels on the access view lists them. One of: read, write, manage, none.

string

required

Why the change is made; recorded in the audit log

string

Projects only: the project’s workspace, so the project can be shown by name in access scopes

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/permission-levels/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "level": "read",
    "reason": "example",
    "workspace_id": "5bf25dc12466a4a9059dac4c35873ec7"
  }'

Response

object

Show Resource Access View object

array

Members and access groups that reach the instance

Show Resource Access Entry object

string

Display name

string

principal_id, or access group id

string

member or access_group

array

Actions the explicit sources allow

string

For blocked entries: scope = limited to other instances; permission = their role cannot view this resource type at all

object

Members: the levels the caller may set them to here

Show Permission Level Options object

boolean

Whether the caller may remove the member’s level (level none)

array

Levels the caller may set this member to (excluding the current one)

string

Why the current level cannot be lowered or removed: outranked = the member’s level is not below the caller’s; last_manager = the member is the last one who can manage the resource; no_permission = the caller cannot share this resource

string

The member’s level set on this instance; omitted when none is set. One of: read, write, manage.

integer

Access groups: number of members

string

What the member can do on this instance, from every source combined. One of: read, write, manage.

string

Members: their role

integer

How many instances of this resource type are in the subject’s access scope

string

Members: all = not limited by an access scope for this resource type; instances = limited to the instances in their scope

array

How the subject reaches the instance

Show Resource Access Source object

string

role: the member’s role reaches every instance. scope_grant: the instance is in the subject’s access scope. access_group: an access group’s instance list. parent: granted on the parent workspace. permission_level: a permission level set on this instance.

string

For access_group: the group

string

For access_group: its name

array

Actions this source allows; [”*”] = all the subject’s permissions allow

string

For parent: the parent workspace id

array

For permission_level: the levels held on this instance

integer

Members who can access the instance

array

Members who cannot

Show Resource Access Entry object

string

Display name

string

principal_id, or access group id

string

member or access_group

array

Actions the explicit sources allow

string

For blocked entries: scope = limited to other instances; permission = their role cannot view this resource type at all

object

Members: the levels the caller may set them to here

Show Permission Level Options object

boolean

Whether the caller may remove the member’s level (level none)

array

Levels the caller may set this member to (excluding the current one)

string

The member’s level set on this instance; omitted when none is set. One of: read, write, manage.

integer

Access groups: number of members

string

What the member can do on this instance, from every source combined. One of: read, write, manage.

string

Members: their role

integer

How many instances of this resource type are in the subject’s access scope

string

Members: all = not limited by an access scope for this resource type; instances = limited to the instances in their scope

array

How the subject reaches the instance

Show Resource Access Source object

string

For access_group: the group

string

For access_group: its name

array

Actions this source allows; [”*”] = all the subject’s permissions allow

string

For parent: the parent workspace id

array

For permission_level: the levels held on this instance

array

Permission levels the caller may set on this instance; empty when the caller cannot share it

string

Instance id; <workspace_id>/<id> for workspace actors and agents

string

Resource type

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`400`	A parameter or the body is invalid
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Path Parameters

Headers

Request Body

Response

Errors

​Path Parameters

​Headers

​Request Body

​Response

​Errors

Path Parameters

Headers

Request Body

Response

Errors