Skip to main content
POST
Set/remove single tag grants on a role

Authorizations

x-api-key
string
header
required

Path Parameters

name
string
required

Body

application/json

The upsert/remove-grants request body.

upsert writes a tag → level (the one sanctioned overwrite), remove drops tags. At least one must be non-empty; a tag may not appear in both.

remove
string[]
upsert
Upsert · object

Response

Success.

data
RoleDefinition · object
required

An operator-authored role: the one validated shape every access-control surface shares.

Shared by the enforcer / membership-check, the management operations, and the generated Studio SDK.

A role composes TWO layers. Layer 1 is a KEPT jq security base — carried on the condition field (from ConditionMixin) so the body round-trips it, but NEVER authored through the grant map: the seed sets it (admin → None, editor/viewer → their base jq) and a new role inherits it from its base_tier. Layer 2 is the editable grants — a per-tag ACCESS LEVEL map (feature-group TAG name → none/read/write) naming the role's level on each feature group. An absent tag means level none (deny).