Set Role Access Scope

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "role_key": "tenant_member",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "role_key": "tenant_member",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

PUT /openapi/memorylake/admin/v1/roles/{role_key}/access-scope

Replaces the scope of each listed resource type for everyone holding the role. A scope limits; it never grants more than the role allows. Applies to tenant_admin, tenant_member and custom roles — the owner role cannot be limited (409). Project instances need their workspace_id. The response carries an ETag header (the same value a GET of this resource returns). Send it back in If-Match to make the write conditional: when the resource has changed in the meantime the write is refused with 412 and nothing is changed. The check narrows, but does not fully close, the window for a concurrent overwrite — two writers that pass it at the same instant can both write.

Permission required: policy:manage

Changes that give someone an admin role, or that reduce what an admin can reach, also require the team owner or an admin.

Path Parameters

string

required

tenant_admin, tenant_member or a custom role key

Headers

string

Optional. The ETag from a previous read of this resource. The write is refused with 412 when the resource has changed since; omit it to overwrite unconditionally.

Request Body

string

required

Why the change is made; recorded in the audit log. At most 255 bytes (UTF-8).

array

required

Each listed resource type’s scope is replaced by the given one; types not listed keep their current scope.

Show Access Scope Entry object

string

required

all = every instance; instances = only the listed ones

string

required

Resource type, e.g. memorylake:project

array

Required when mode is instances

Show Access Scope Instance object

string

required

Instance id

array

Omit for every action the member’s role allows

boolean

Echo of a read-only row. Instances marked true are skipped on write — permission levels are set on the resource, not through scope.

string

Parent workspace — required for project instances

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

Response

object

Show Role Access Scope object

string

The role

array

One entry per scopable resource type

Show Access Scope Entry object

string

all = every instance; instances = only the listed ones

string

Resource type, e.g. memorylake:project (see GET /permission-catalog)

array

Read-only. Instance-level actions the member’s role grants for this type — the most a scope entry can allow.

array

The instances, when mode is instances

Show Access Scope Instance object

string

Instance id, as returned by the data API

array

Actions allowed on this instance. Omit for every action the member’s role allows.

array

Read-only. The subset of actions the member’s CURRENT role still grants.

string

Read-only. The permission level, when via_permission_level is true. One of: read, write, manage.

array

Read-only. Actions stored here that the member’s current role no longer grants.

boolean

Read-only. The member reaches this instance through a permission level granted on it, not through this scope. May be echoed back on write; such instances are skipped.

string

Parent workspace of a project instance. Required when writing a project instance.

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "role_key": "tenant_member",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ]
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`400`	A parameter or the body is invalid
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`412`	The `If-Match` value no longer matches: the resource changed since you read it
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Path Parameters

Headers

Request Body

Response

Errors

​Path Parameters

​Headers

​Request Body

​Response

​Errors

Path Parameters

Headers

Request Body

Response

Errors