Set Member Access Scope

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/members/dbcf9a3aabee5042775269c9d137a2f8/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "principal_id": "4f228e77b76b88a423054d60d928dba3",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ],
    "role": "tenant_member"
  }
}

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/members/dbcf9a3aabee5042775269c9d137a2f8/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "principal_id": "4f228e77b76b88a423054d60d928dba3",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ],
    "role": "tenant_member"
  }
}

PUT /openapi/memorylake/admin/v1/members/{principal_id}/access-scope

Replaces the scope of each listed resource type. A scope limits a member; it never grants more than the member’s role allows. Project instances need their workspace_id. A restricted type must leave the member at least one reachable instance. The response carries an ETag header (the same value a GET of this resource returns). Send it back in If-Match to make the write conditional: when the resource has changed in the meantime the write is refused with 412 and nothing is changed. The check narrows, but does not fully close, the window for a concurrent overwrite — two writers that pass it at the same instant can both write.

Permission required: member:set_scope

Changes that give someone an admin role, or that reduce what an admin can reach, also require the team owner or an admin.

Path Parameters

string

required

Identifier of the member (principal_id)

Headers

string

Optional. The ETag from a previous read of this resource. The write is refused with 412 when the resource has changed since; omit it to overwrite unconditionally.

Request Body

string

required

Why the change is made; recorded in the audit log. At most 255 bytes (UTF-8).

array

required

Each listed resource type’s scope is replaced by the given one; types not listed keep their current scope.

Show Access Scope Entry object

string

required

all = every instance; instances = only the listed ones

string

required

Resource type, e.g. memorylake:project

array

Required when mode is instances

Show Access Scope Instance object

string

required

Instance id

array

Omit for every action the member’s role allows

boolean

Echo of a read-only row. Instances marked true are skipped on write — permission levels are set on the resource, not through scope.

string

Parent workspace — required for project instances

curl -X PUT 'https://app.memorylake.ai/openapi/memorylake/admin/v1/members/dbcf9a3aabee5042775269c9d137a2f8/access-scope' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "instances": [
          {
            "id": "185afe41ca6ac4566fdc7a9adeabf5a0",
            "actions": [],
            "via_permission_level": false,
            "workspace_id": "12404b77739317d2b08fc918a95f0be9"
          }
        ]
      }
    ]
  }'

Response

object

Show Access Scope object

string

The member

array

One entry per scopable resource type

Show Access Scope Entry object

string

all = every instance; instances = only the listed ones

string

Resource type, e.g. memorylake:project (see GET /permission-catalog)

array

Read-only. Instance-level actions the member’s role grants for this type — the most a scope entry can allow.

array

The instances, when mode is instances

Show Access Scope Instance object

string

Instance id, as returned by the data API

array

Actions allowed on this instance. Omit for every action the member’s role allows.

array

Read-only. The subset of actions the member’s CURRENT role still grants.

string

Read-only. The permission level, when via_permission_level is true. One of: read, write, manage.

array

Read-only. Actions stored here that the member’s current role no longer grants.

boolean

Read-only. The member reaches this instance through a permission level granted on it, not through this scope. May be echoed back on write; such instances are skipped.

string

Parent workspace of a project instance. Required when writing a project instance.

string

The member’s primary role

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "principal_id": "4f228e77b76b88a423054d60d928dba3",
    "scopes": [
      {
        "mode": "all",
        "resource_type": "example",
        "available_actions": [
          "example"
        ],
        "instances": [
          {
            "id": "bc572b050c9920425b5fd75681eccbb2",
            "actions": [],
            "effective_actions": [],
            "permission_level": "read",
            "shadowed_actions": [],
            "via_permission_level": false,
            "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
          }
        ]
      }
    ],
    "role": "tenant_member"
  }
}

Errors

Errors answer with success: false, a message and an error_code. See Error Codes for every code.

Status	Meaning
`400`	A parameter or the body is invalid
`401`	The API key is missing, invalid, disabled or expired
`403`	The key is not allowed to do this
`404`	The resource does not exist
`409`	The request conflicts with the current state, e.g. a duplicate or a limit reached
`412`	The `If-Match` value no longer matches: the resource changed since you read it
`422`	The body or a parameter failed validation
`429`	Too many requests. Wait for the time in `Retry-After`
`500`	Server-side error
`503`	Temporarily unavailable. Retry later

MemoryLake API

Memory Router API

Path Parameters

Headers

Request Body

Response

Errors

​Path Parameters

​Headers

​Request Body

​Response

​Errors

Path Parameters

Headers

Request Body

Response

Errors