---
title: "Grant Assignment"
method: POST
path: "/v1/tenant/members/{sub}/assignments"
tags: ["authz"]
---

# Grant Assignment

`POST /v1/tenant/members/{sub}/assignments`

## Request

- Base URL: `https://api.4chems.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.4chems.com/v1/tenant/members/{sub}/assignments`
- Auth: HTTP bearer

Grant a role x scope assignment to a tenant member.

Enforces the grantability policy (app/authz/grants.py): no privilege
escalation, no cross-tenant grants, member-only. An `admin` may grant up
to `admin`; only an `owner` may grant `owner` (ADR 0016 decision 3).
Every grant is recorded in the tamper-evident audit trail (UC-039) with
the token's `azp`/`act`/`tier` (ADR 0016 decision 5).

## Path parameters

- `sub` string, required

## Query parameters

- `tenant_id` string, nullable

## Request body

- AssignmentIn
  - `role` string, required
  - `scope_type` string, required
  - `scope_id` string, required

## Response `201`

Successful Response

- AssignmentOut
  - `id` string, uuid, required
  - `subject_type` string, required
  - `subject` string, required
  - `role` string, required
  - `scope_type` string, required
  - `scope_id` string, required
  - `expires_at` string, date-time, nullable, required
  - `granted_by` string, required
  - `granted_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/4chems/apis/platform-api.md) · [All operations](https://skmtc.dev/4chems/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/4chems/apis/platform-api/revisions/65e4f7b4dba0?raw)