---
title: "Apply guarded FGA tuple mutations"
method: POST
path: "/api/svc-registry/fga/tuples"
tags: ["svc-registry"]
---

# Apply guarded FGA tuple mutations

`POST /api/svc-registry/fga/tuples`

## Request

- Base URL: `https://app.gocrisp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.gocrisp.com/api/svc-registry/fga/tuples`
- Auth: none declared

Accepts `writes` and/or `deletes` arrays totaling at most 40 FGA tuple operations per request. Each accepted mutation is one atomic FGA Write; invalid tuples reject the entire transaction. Duplicate writes/missing deletes use bounded exact-key refresh and whole-transaction revalidation, never per-tuple retries. Creates require complete structural prerequisites; delete-only repair remains allowed. Requires a Google ID token from the configured AI Studio Terraform or runtime service account (localdev instead accepts a signed-in user's Auth0 token on loopback). Autonomous calls need no forwarded user header or service FGA grant; caller and write-scope validation apply. Writes and deletes must target objects of AI Studio's own applications or account, organization and group objects, or the dock's global application instance at `platform/crisp/app-dock` and its descendants (module instances, role-bundle instances and sharable entities). Dock catalog objects and its other scopes are excluded. All mutations pass through the dock authorization writer and its write guardrails. With X-User-Authorization: Bearer <user JWT>, supported grants and memberships are authorized against the verified user's Studio workspace owner with accountId and pre-write tenant boundary checks; structural and role-wiring tuples are rejected in delegated requests.

## Request body

- FgaTupleMutationRequest: Guarded FGA tuple mutations, capped at one backing FGA transaction.
  - `writes` TupleKey[]: The combined writes and deletes in this request cannot exceed the FGA transaction limit.
    - `user` string, required
    - `relation` string, required
    - `object` string, required
    - `condition` TupleCondition
      - `name` string, required
      - `context` object, required
  - `deletes` TupleKey[]: The combined writes and deletes in this request cannot exceed the FGA transaction limit.
    - `user` string, required
    - `relation` string, required
    - `object` string, required
    - `condition` TupleCondition
      - `name` string, required
      - `context` object, required

## Response `200`

Successful Response

- FgaTupleMutationResponse: Tuple counts accepted by the guarded FGA mutation endpoint.
  - `writesProcessed` integer, required
  - `deletesProcessed` integer, required
  - `rejectedTuples` RejectedTuple[]
    - `operation` 'write' | 'delete', required
    - `tuple` RejectedTupleKey, required: Public tuple identity for a rejected write operation.
      - `user` string, required
      - `relation` string, required
      - `object` string, required
    - `reason` string, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-09** `2d5570083be4`: 1 info
  - added the optional property `rejectedTuples` to the response with the `200` status
- **2026-10-06** `e230985ffcd0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/gocrisp/apis/crisp-app-dock/changes/api/svc-registry/fga/tuples/post.md)

---

[API](https://skmtc.dev/gocrisp/apis/crisp-app-dock.md) - [All operations](https://skmtc.dev/gocrisp/apis/crisp-app-dock/llms.txt) - [OpenAPI document](https://skmtc.dev/gocrisp/apis/crisp-app-dock/revisions/28638f87e7d4?raw)