authz

Grant Assignment

Grant a role x scope assignment to a tenant member.

Enforces the grantability policy (app/authz/grants.py): no privilege escalation, no cross-tenant grants, member-only. An admin may grant up to admin; only an owner may grant owner (ADR 0016 decision 3). Every grant is recorded in the tamper-evident audit trail (UC-039) with the token's azp/act/tier (ADR 0016 decision 5).

post/v1/tenant/members/{sub}/assignments

Request

  • Base URL: https://api.4chems.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.4chems.com/v1/tenant/members/{sub}/assignments
  • Auth: HTTP bearer

Path parameters

substring required

Query parameters

tenant_idstring nullable

Request body

rolestring required
scope_typestring required
scope_idstring required

Response

Successful Response

idstring uuid required
subject_typestring required
subjectstring required
rolestring required
scope_typestring required
scope_idstring required
expires_atstring date-time nullable required
granted_bystring required
granted_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.