grants

📄️Grant a bundle to a grantee for an organization

Requires `Idempotency-Key`. Delegation narrows: the bundle's permissions must be a subset of the caller's own, for an organization inside the caller's own subtree; anything else is refused in the standard shape. Revoking a grant takes effect within one token lifetime: the gateway remembers a resolved principal for at most five minutes (`principalCacheSeconds`, never past the token's own expiry), and a revoked grant authorises until that entry expires.

📄️List the grants inside the caller scope

Filtered by organization, grantee and status, newest first, in pages: pass `nextCursor` back as `cursor`. Revoking a grant takes effect within one token lifetime: the gateway remembers a resolved principal for at most five minutes (`principalCacheSeconds`, never past the token's own expiry), and a revoked grant authorises until that entry expires.

📄️Revoke a grant

Requires `Idempotency-Key`; takes no body. Revoking an already revoked grant answers the same revoked grant. Revoking a grant takes effect within one token lifetime: the gateway remembers a resolved principal for at most five minutes (`principalCacheSeconds`, never past the token's own expiry), and a revoked grant authorises until that entry expires.