Download OpenAPI specification:
Grants registered operations to custom roles. Available only when the Enterprise rbac_basic capability is assembled and licensed.
Requires admin-role:permissions; the legacy admin-authz:grant permission is also accepted during the deprecation window. Built-in roles cannot be modified through this endpoint.
Resource types and operations must be registered. Wildcard resource
types and operations are rejected. Resource identifiers containing *
are rejected for registered sub-resource types (types with a parent),
including partial patterns such as prefix-* and parent/*. Permitted
top-level type-wide grants retain their existing behavior. Other guards,
including the prohibition on type-wide action execution, still apply.
A rejected request preserves existing permissions and creates no partial grants or business audit event. Registry and database failures remain HTTP 500 and do not expose internal exception details.
| id required | string Custom role identifier. |
required | object |
| operations required | Array of strings non-empty |
{- "resource": {
- "type": "resource",
- "id": "owned-resource"
}, - "operations": [
- "view_detail"
]
}{- "error_code": "BknSafe.AdminWrite.SubResourceWildcardForbidden",
- "description": "Wildcard grants are not allowed for sub-resource types. Specify a concrete resource identifier.",
- "error_details": ""
}