Skip to main content
POST
Set/remove single tag grants on a role

Authorizations

x-api-key
string
header
required

Path Parameters

name
string
required

Body

application/json

The set/remove-grants request body: set upserts a tag → level (the one sanctioned overwrite), remove drops tags. At least one must be non-empty; a tag may not appear in both.

remove
string[]
set
Set · object

Response

Success.

data
RoleDefinition · object
required

An operator-authored role: the ONE validated shape the enforcer / membership-check, the management operations, and the generated Studio SDK all share.

A role composes TWO layers. Layer 1 is a KEPT jq security base — carried on the condition field (from ConditionMixin) so the body round-trips it, but NEVER authored through the grant map: the seed sets it (admin → None, editor/viewer → their base jq) and a new role inherits it from its base_tier. Layer 2 is the editable grants — a per-tag ACCESS LEVEL map (feature-group TAG name → none/read/write) naming the role's level on each feature group. An absent tag means level none (deny).