GoodMemCreate an authorization grant
Creates one direct grant after resolving its typed policy target and requiring MANAGE_ACCESS. Direct grants cannot confer credential-read or ownership-transfer authority. ALL_AUTHENTICATED grants require an assigned-resource selector. MANAGE_ACCESS and MANAGE_USER_ENROLLMENT require a concrete principal and ANY or EXACT; MANAGE_USER_ENROLLMENT with EXACT must target USER.
x-api-key<token>
In: header
grantId?string | null
Optional caller-provided grant UUID.
Example
"f276b9a4-73d6-4e04-95c5-87b974221f92"Format
uuidaudienceGrantAudience
Audience receiving the grant.
Exactly one principal or the all-authenticated audience.
principalIdstring | null
Active HUMAN or SERVICE principal UUID.
Example
"70e025f6-76ca-4cbe-b8fc-7dab8e84590a"Format
uuidExactly one principal or the all-authenticated audience.
allAuthenticatedGrantAudienceAllAuthenticated | null
Set to true to address every authenticated principal.
Example
trueruleAccessPolicyRule
Authorization descriptor to grant.
Response Body
curl -X POST "https://loading/v1/access-policy/grants" \ -H "Content-Type: application/json" \ -d '{ "grantId": "f276b9a4-73d6-4e04-95c5-87b974221f92", "audience": { "principalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a" }, "rule": { "assignedResource": { "resourceId": "550e8400-e29b-41d4-a716-446655440000" } } }'{
"grantId": "f276b9a4-73d6-4e04-95c5-87b974221f92",
"audience": {
"principalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a"
},
"rule": {
"operation": "CREATE_USER",
"selector": "ANY",
"assignedResource": {
"resourceId": "550e8400-e29b-41d4-a716-446655440000"
}
},
"createdAt": 0,
"createdById": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",
"revokedAt": 0,
"revokedById": "114ad558-323d-4b76-85b8-37af103b8650"
}Empty
Empty
Empty
Empty
Empty
Empty
Empty