Skip to main content
PUT
Revoke a user's legacy workspace roles

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Path Parameters

workspace
string
required

Workspace slug.

Maximum string length: 64
Pattern: ^[a-z0-9][a-z0-9-]{0,63}$
subject
string
required

Keycloak username whose legacy grant to revoke.

Body

application/json
roles
enum<string>[]
required

Complete set of workspace roles for this grantee. Replaces any existing grants — send an empty list to revoke.

Per-workspace role grants.

workspace_admin deliberately cannot approve: separation of duties is the point of the matrix, and approval requires a distinct approver identity.

Available options:
workspace_admin,
author,
approver,
simulator,
viewer

Response

Successful Response

workspace
string
required
role_grants
RoleGrantResponse · object[]

Workspace roles granted to Keycloak roles. This is how access is granted.

members
MemberResponse · object[]

Legacy grants made directly to users. Still honoured and revocable, but no new ones can be made — replace them with role grants.