Skip to main content
PUT
Grant workspace roles to a Keycloak role

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Path Parameters

workspace
string
required

Workspace slug.

Maximum string length: 64
Pattern: ^[a-z0-9][a-z0-9-]{0,63}$
keycloak_role
string
required

Keycloak realm role name. URL-encode it.

Required string length: 1 - 255

Body

application/json
roles
enum<string>[]
required

Complete set of workspace roles for this grantee. Replaces any existing grants — send an empty list to revoke.

Per-workspace role grants.

workspace_admin deliberately cannot approve: separation of duties is the point of the matrix, and approval requires a distinct approver identity.

Available options:
workspace_admin,
author,
approver,
simulator,
viewer

Response

Successful Response

workspace
string
required
role_grants
RoleGrantResponse · object[]

Workspace roles granted to Keycloak roles. This is how access is granted.

members
MemberResponse · object[]

Legacy grants made directly to users. Still honoured and revocable, but no new ones can be made — replace them with role grants.