GoodMemList scoped role assignments
GET /v1/access-policy/role-assignments: Lists assignments attached to one required INSTANCE or SPACE boundary after requiring MANAGE_ACCESS. Continuation tokens are bound to the caller and filters.
Lists assignments attached to one required INSTANCE or SPACE boundary after requiring MANAGE_ACCESS. Continuation tokens are bound to the caller and filters.
In: header
Query Parameters
Required INSTANCE or SPACE kind
"INSTANCE" | "SPACE"Required space UUID; omitted for INSTANCE
Include revoked history
falsePage size; 0 or omission uses the default of 50, maximum 1,000
50int32Opaque continuation token
Header Parameters
Optional waiting budget in milliseconds, measured from REST servlet ingress and shared across all internal gRPC calls. Supply one decimal integer from 1 to 86400000. Omission adds no deadline. Existing shorter deadlines still apply. Expiry returns HTTP 504 before streaming starts; after streaming starts, no successful completion event is sent. Use SSE or opt into GoodMem-Stream-Terminal for an explicit terminal outcome. Retrieval work is cooperatively cancelled. An accepted mutation may still commit after timeout or disconnect; a failed response does not imply rollback.
int641 <= value <= 86400000Response Body
curl -X GET "https://your-goodmem-server.example.com/v1/access-policy/role-assignments?resourceKind=SPACE&resourceId=550e8400-e29b-41d4-a716-446655440000&includeRevoked=true&maxResults=100&nextToken=string" \ -H "GoodMem-Timeout-Ms: 30000"{
"roleAssignments": [
{
"roleAssignmentId": "9f75bfdf-6c08-4ccc-b945-8688d91ef25d",
"principalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",
"assignedResource": {
"resourceId": "550e8400-e29b-41d4-a716-446655440000"
},
"assignedById": "114ad558-323d-4b76-85b8-37af103b8650",
"revokedById": "ab882e21-ea3f-4c29-9040-49be3cc93162"
}
],
"nextToken": "string"
}List authorization grants
GET /v1/access-policy/grants: Lists grants attached to one resource. MANAGE_ACCESS is required on that resource; continuation tokens are bound to the caller and filters.
Revoke an authorization grant
DELETE /v1/access-policy/grants/{id}: Soft-revokes one grant and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS on the target.