AuthGrants
The grants enforcement will apply to requests made with this credential. source is api_key_role when the key is scoped to a role — only that role is checked — and user_roles for a session or a key that inherits its owner's assignments.
- entityType: stringFormat: uuidnullable
Id requiredThe tenant the credential is acting in, which is what enforcement scopes against. For a session, the active tenant, falling back to the user's primary tenant. For an API key this always equals
credential.entityId: a key acts in the tenant recorded on its row (validateApiKey pins the whole entity context to it), and a key with no tenant of its own does not authenticate at all. - permissionsType: array of stringrequired
Union across roles, sorted and deduplicated, except that a role assigned inside a resource group contributes no management permission (role, resource-group and user writes, the resource-group bypass,
api-keys:manage, everyssoverb,entity:update, entity-note, tag, address and contact writes,audit-log:manage,entity:hierarchy,audit-log:hierarchy, billing writes, and every platform-reserved permission such asplatform:*): no gate credits one from a group-scoped assignment. Each entry inrolesstill lists its role's permissions in full. Describes whatrequirePermission-gated routes will allow; routes that also apply entity scoping (checkEntityScopedPermission) intersect these with the acting user's entity-scoped grant for the tenant, which is not represented here. A role's scope records the assignment the grant came from, not a map of where enforcement will honour it: enforcement also reaches descendant entities, and varies by check. - rolesType:requiredProperties: 5
Order is unspecified.
- sourceType: "user_roles" or "api_key_role"enumrequired
.png)