Sign in
access

Grant one capability at organisation scope.

Changed on

manage-members held at org scope may grant capabilities the grantor does not hold — the escalation path the threat model accepts, and the one that keeps a fresh installation bootstrappable.

post/api/v1/orgs/{org}/grants

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/orgs/{org}/grants
  • Auth: HTTP bearer

Request body

principalstring required

A prefixed UUIDv7, e.g. org_0198….

capabilitystring required

One atom from the permission ADR's CLOSED capability set. The server refuses anything outside it rather than storing a row nothing can ever evaluate, so this is a bounded string rather than an enum only to keep the contract additive as later tickets register their atoms.

Response

The grant mutation result, including an idempotent repeat.

grant_idstring required

A prefixed UUIDv7, e.g. org_0198….

capabilitystring required

One atom from the permission ADR's CLOSED capability set. The server refuses anything outside it rather than storing a row nothing can ever evaluate, so this is a bounded string rather than an enum only to keep the contract additive as later tickets register their atoms.

outcome'created' | 'origin_added' | 'unchanged' required

The only possible mutation results: a new grant row, a new origin on an existing row, or an idempotent repeat that changed nothing.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status