Update Custom Role

curl -X PATCH 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "Example description",
    "label": "example"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "admin_grant_only": false,
    "assignable": false,
    "built_in": false,
    "key": "sk-f6e5d4c3...redacted...b2a1",
    "label": "example",
    "base_role_key": "tenant_member",
    "description": "Example description",
    "parent_role_key": "example",
    "permissions": [
      {
        "permission": "example",
        "source": "built_in"
      }
    ]
  }
}

curl -X PATCH 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "Example description",
    "label": "example"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "admin_grant_only": false,
    "assignable": false,
    "built_in": false,
    "key": "sk-f6e5d4c3...redacted...b2a1",
    "label": "example",
    "base_role_key": "tenant_member",
    "description": "Example description",
    "parent_role_key": "example",
    "permissions": [
      {
        "permission": "example",
        "source": "built_in"
      }
    ]
  }
}

PATCH /openapi/memorylake/admin/v1/roles/{role_key}

Renames a custom role or changes its description. Only the fields you send change; null is rejected. Built-in roles cannot be changed (409). To change what a role grants, use permission rules.

Permission required: policy:custom_role_manage

Path Parameters

string

required

Key of a custom role

Headers

string

Optional. Retrying with the same value replays the first result.

Request Body

string

New description; "" clears it

string

New display name

curl -X PATCH 'https://app.memorylake.ai/openapi/memorylake/admin/v1/roles/data_analyst' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "Example description",
    "label": "example"
  }'

Response

object

Show Role Detail object

boolean

When true, only the team owner or a member holding the admin baseline — through their role or through an access group — may grant this role. A property of the role, the same for every caller; it is not the console role list’s per-caller assignable flag.

boolean

Whether member and invitation writes accept this role at all — the same for every caller. The owner role never is. Unlike the console’s role list, this does not say whether you yourself may grant it: for that, combine it with admin_grant_only and your own role.

boolean

true for the three roles every team has; false for roles authored in this team

string

The value the role fields of member and invitation writes accept

string

Display name. Built-in roles carry a fixed English label; custom roles carry the operator-authored one.

string

For custom roles: the role whose permission rules were copied into this one when it was created. Absent on built-in roles and on custom roles created without a base.

string

Operator-authored description. Only custom roles carry one.

string

Same value as base_role_key; kept for existing clients.

array

Every permission the role grants, with its source. Returned only to callers holding policy:manage on tenant:policy; omitted for everyone else. An empty list means the role grants nothing. Instance limits (the role’s access scope) are not reflected here.

Show Role Permission object

string

Permission, as <resource_type>:<action> (e.g. memorylake:project:project:read)

string

built_in: part of a built-in role’s definition. base_role: the base role grants it too — it was copied from the base role when this role was created. role_rule: granted only by this role’s own permission rules.

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "admin_grant_only": false,
    "assignable": false,
    "built_in": false,
    "key": "sk-f6e5d4c3...redacted...b2a1",
    "label": "example",
    "base_role_key": "tenant_member",
    "description": "Example description",
    "parent_role_key": "example",
    "permissions": [
      {
        "permission": "example",
        "source": "built_in"
      }
    ]
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`400`	A parameter or the body is invalid
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Path Parameters

Headers

Request Body

Response

Errors

​Path Parameters

​Headers

​Request Body

​Response

​Errors

Path Parameters

Headers

Request Body

Response

Errors