Sign in
access

Create one member access rule.

Changed on

One capability for one person, with a where of projects, environments and keys. The caller needs manage-members covering the complete selector on every project and may delegate only capabilities held there, unless org or instance authority permits unheld grants. Rules are for people: a machine principal is refused. Use replaceRules to edit a grouped rule card atomically.

post/api/v1/orgs/{org}/rules

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/orgs/{org}/rules
  • Auth: HTTP bearer

Request body

principalstring required

A prefixed UUIDv7, e.g. org_0198….

capability'read' | 'edit' | 'publish' | 'pin' | 'reveal' | 'reveal-history' | 'definitions-edit' | 'manage-members' | 'manage-identities' | 'manage-adapters' | 'project-settings' required

The capabilities a member access rule may carry (member-access-rules ADR D2). read ignores key limits; pin cannot be narrowed by keys. publish and manage-members accept key selectors. Member management delegates only within its selector and the caller's held capabilities. manage-identities, manage-adapters and project-settings need a whole project.

Response

The rule as stored.

idstring required

A prefixed UUIDv7, e.g. org_0198….

principal_idstring required

A prefixed UUIDv7, e.g. org_0198….

principal_namestring

Current display name or username of the person holding the rule; not an identifier.

capability'read' | 'edit' | 'publish' | 'pin' | 'reveal' | 'reveal-history' | 'definitions-edit' | 'manage-members' | 'manage-identities' | 'manage-adapters' | 'project-settings' required

The capabilities a member access rule may carry (member-access-rules ADR D2). read ignores key limits; pin cannot be narrowed by keys. publish and manage-members accept key selectors. Member management delegates only within its selector and the caller's held capabilities. manage-identities, manage-adapters and project-settings need a whole project.

other_projectsboolean required

On a project listing, true when the rule also names projects the listing does not show. Always false on the org listing.

created_bystring required

A prefixed UUIDv7, e.g. org_0198….

created_atstring date-time required

RFC 3339 UTC, microsecond precision.

Changes