---
title: "Delegate a narrower child context grant"
method: POST
path: "/context/grants/{grantId}/delegate"
tags: ["Setup · Context grants"]
---

# Delegate a narrower child context grant

`POST /context/grants/{grantId}/delegate`

## Request

- Base URL: `https://api.ziggsai.com`
- URL: `https://api.ziggsai.com/context/grants/{grantId}/delegate`
- Auth: HTTP bearer

Narrowing a grant you got from your own principal mints immediately. Passing a grant whose original owner is a different party creates a grant-request agreement that owner must approve: the response is { status: "pending_approval", agreementId } and no grant is minted yet.

## Path parameters

- `grantId` string, required

## Headers

- `Idempotency-Key` string

## Request body

- DelegateContextGrantDto
  - `holderId` string, required: Who receives the delegated grant
  - `holderKind` 'user' | 'org' | 'agent', required: What kind of holder `holderId` is. Always state it; ids carry no type.
  - `kind` 'read' | 'write' | 'admit': What the child grant confers. Never stronger than the grant it comes from; defaults to the same.
  - `scope` ContextGrantScopeDto, required
    - `kind` 'chat' | 'agreement' | 'org' | 'artifact' | 'task' | 'person', required: What the grant points at. `artifact` is the narrowest: one specific artifact, shared without sharing any chat or agreement it sits in. `task` is a branch of a work graph: the named task and everything under it, now and in future. Holding one is what it means to be in a job: a holder with `write` may create work inside the branch, a holder with only `read` is watching it. `person` names one person by id and is held only at `list`: it lets the holder see which rooms that person is in, never what is in them.
    - `id` string, required: chatId, agreementId, orgId, artifactId, taskId, or a person id
  - `temporal` 'from-now' | 'from-start', required
  - `expiresAt` object
  - `watermarkAt` string: from-now watermark (ISO-8601)

## Response `201`

Created

- GrantDelegateResponseSchema
  - `grant` GrantViewSchema
    - `grantId` string, required
    - `issuerId` string, required: Principal that issued the grant (root owner or delegator).
    - `holderId` string, required
    - `parentGrantId` string, nullable, required: Set when this is an attenuated re-delegation.
    - `agreementId` string, nullable, required: Agreement that conferred the grant, if any.
    - `scope` GrantScopeViewSchema, required
      - `kind` 'chat' | 'agreement' | 'org' | 'artifact' | 'task' | 'person' | 'connection' | 'wallet' | 'consent' | 'inbox', required: Which rail/resource this grant points at.
      - `id` string, required: Id of the scoped resource.
      - `label` string: Resolved human name; populated only by the owner-facing GET /grants read.
    - `caveats` GrantCaveatViewSchema[], required: Bounds on the grant, one array across rails.
      - `type` string, required: Caveat name (allowed_actions, max_amount, temporal, …).
      - `value` object, required: Shape depends on type. max_amount and daily_budget are a number of hundredths of a point.
    - `revoked` boolean, required
    - `expiresAt` string, date-time, nullable, required: ISO-8601, or null for no expiry.
    - `createdAt` string, date-time, required
    - `health` 'active' | 'expired' | 'revoked', required
    - `holderKind` 'user' | 'org' | 'agent': Present on rails that record it; absent means "this rail does not say".
    - `access` 'list' | 'read' | 'write' | 'admit'
    - `basis` GrantBasisSchema
      - `kind` 'creation' | 'publication' | 'membership' | 'acceptance' | 'agreement' | 'vouch', required: The consent object the grant rests on.
      - `id` string, nullable, required: Id of the consent object, if any.
  - `status` string
  - `agreementId` string
  - `ownerId` string

---

[API](https://skmtc.dev/ziggsai/apis/ziggs-developer-api.md) · [All operations](https://skmtc.dev/ziggsai/apis/ziggs-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ziggsai/apis/ziggs-developer-api/revisions/eda79030e072?raw)