Grant a bundle to a grantee for an organization
POST/api/v1/grants
Requires Idempotency-Key. Delegation narrows: the bundle's permissions must be a subset of the caller's own, for an organization inside the caller's own subtree; anything else is refused in the standard shape. Revoking a grant takes effect within one token lifetime: the gateway remembers a resolved principal for at most five minutes (principalCacheSeconds, never past the token's own expiry), and a revoked grant authorises until that entry expires.
Request
Responses
- 201
- 400
- 401
- 403
- 404
- 409
- 415
- 429
- 500
- 502
- 503
The grant was created.
Response Headers
The correlation id of the request, on every response including 401.
The request is malformed. callerShould: fix-and-retry.
Response Headers
The correlation id of the request, on every response including 401.
Authentication is required. callerShould: authenticate.
Response Headers
The correlation id of the request, on every response including 401.
The token is valid but maps to no usable principal. callerShould: stop.
Response Headers
The correlation id of the request, on every response including 401.
The resource was not found. The same answer for a subject that does not exist and one outside the caller's scope. callerShould: stop.
Response Headers
The correlation id of the request, on every response including 401.
The resource is not in a state that allows this (callerShould: re-read-and-decide), or A concurrent change conflicted with this request (callerShould: re-read-and-retry-once). Told apart by the type URI; the code member names the refusal (for example subject.slug_taken). A conflict the module marked not retryable carries callerShould: re-read-and-decide.
Response Headers
The correlation id of the request, on every response including 401.
The request body has an unsupported media type. Send application/json. callerShould: fix-and-retry.
Response Headers
The correlation id of the request, on every response including 401.
Too many requests. The rate limit for this caller was reached: 600 a minute per authenticated principal, 60 a minute per client address before authentication (both configurable). callerShould: retry-with-backoff, after the number of seconds in Retry-After.
Response Headers
The correlation id of the request, on every response including 401.
Whole seconds to wait before the next request.
An internal error occurred. callerShould: retry-with-backoff.
Response Headers
The correlation id of the request, on every response including 401.
A system we depend on failed. callerShould: retry-with-backoff.
Response Headers
The correlation id of the request, on every response including 401.
The service cannot serve this right now. callerShould: retry-with-backoff.
Response Headers
The correlation id of the request, on every response including 401.