GoodMemGoodMem
ReferenceAPIREST APIAccess Policy

Assign a scoped role

POST /v1/access-policy/role-assignments: Assigns one code-defined role to an active principal at INSTANCE or SPACE scope after requiring MANAGE_ACCESS. ROOT is maintained only by ownership workflows.

Assigns one code-defined role to an active principal at INSTANCE or SPACE scope after requiring MANAGE_ACCESS. ROOT is maintained only by ownership workflows.

POST
/v1/access-policy/role-assignments

Authorization

x-api-key<token>

In: header

Request Body

roleAssignmentId?string | null

Optional caller-provided role-assignment UUID.

Example"9f75bfdf-6c08-4ccc-b945-8688d91ef25d"
Formatuuid
principalIdstring

Active principal receiving the role.

Example"70e025f6-76ca-4cbe-b8fc-7dab8e84590a"
Formatuuid
rolestring

Code-defined non-ROOT role to assign.

Value in"ADMIN" | "USER" | "SPACE_VIEWER" | "SPACE_CONTRIBUTOR" | "SPACE_CONTENT_MANAGER" | "SPACE_ADMIN"
assignedResourceRoleAssignmentTarget

INSTANCE or SPACE boundary receiving the assignment.

Response Body

curl -X POST "https://your-goodmem-server.example.com/v1/access-policy/role-assignments" \  -H "Content-Type: application/json" \  -d '{    "roleAssignmentId": "9f75bfdf-6c08-4ccc-b945-8688d91ef25d",    "principalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",    "assignedResource": {      "resourceId": "550e8400-e29b-41d4-a716-446655440000"    }  }'
{
  "roleAssignmentId": "9f75bfdf-6c08-4ccc-b945-8688d91ef25d",
  "principalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",
  "role": "ROOT",
  "assignedResource": {
    "kind": "INSTANCE",
    "resourceId": "550e8400-e29b-41d4-a716-446655440000"
  },
  "assignedAt": 0,
  "assignedById": "114ad558-323d-4b76-85b8-37af103b8650",
  "revokedAt": 0,
  "revokedById": "ab882e21-ea3f-4c29-9040-49be3cc93162"
}
Empty
Empty
Empty
Empty
Empty
Empty
Empty

Access Policy

Browse REST endpoints for authorization checks, direct grants, and scoped role assignments, including inspection, listing, and revocation.

Check effective authorization

POST /v1/access-policy:check: Evaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling.