Skip to main content
PUT
Edit a role's grant map

Authorizations

x-api-key
string
header
required

Path Parameters

name
string
required

Body

application/json

The edit-role request body: only the per-tag grant map + description are editable; the base-tier jq / base_tier are seed-fixed and rejected on any change attempt. Both fields are omit-means-keep — an absent grants (None) preserves the stored grant map (it is never silently wiped), and an absent description preserves the stored description.

description
string | null
grants
Grants · object | null

Response

Success.

data
RoleDefinition · object
required

An operator-authored role: the ONE validated shape the enforcer / membership-check, the management operations, and the generated Studio SDK all share.

A role composes TWO layers. Layer 1 is a KEPT jq security base — carried on the condition field (from ConditionMixin) so the body round-trips it, but NEVER authored through the grant map: the seed sets it (admin → None, editor/viewer → their base jq) and a new role inherits it from its base_tier. Layer 2 is the editable grants — a per-tag ACCESS LEVEL map (feature-group TAG name → none/read/write) naming the role's level on each feature group. An absent tag means level none (deny).