SparQDocs
GuidesAPI referencesparqhq.ai
API referenceAccess

Create Grant

POST
/v1/admin/workspaces/{workspace_id}/grants

Not available yet. This operation is part of the published contract and answers 501 not_implemented until it is built. The request and response shapes below are final for this contract version.

Nobody can grant a role with more actions than they hold.

Authorization

HTTPBearer
headerAuthorizationBearer <token>

Bearer credential. API keys look like sqk_<geo>_<key_id>_<secret>: treat them as opaque and never put one in a browser. Older keys without the geo part stay valid until rotated. Find a geo's endpoints through GET /.well-known/sparq-discovery before sending a key.

Path Parameters

workspace_id*Workspace Id
Formatuuid

Header Parameters

Sparq-Workspace?string

For a person signed in to a console with several workspaces: the workspace this call is for, one of their memberships (listMyMemberships). Without it such a person gets workspace_required (400); a workspace they are not a member of is forbidden. It never grants anything, and other callers' credentials ignore it.

Formatuuid
Idempotency-Key?string

Makes a retry safe: the same key, route and body within 24 hours returns the stored response and the same result id. The same key with a different body or route is idempotency_conflict; while the first request runs, idempotency_in_progress.

Length8 <= length <= 128

Request Body

application/json
  1. body

Body of POST /v1/admin/workspaces/{workspace_id}/grants.

principal_type*Principal Type
Value in"credential""member"
principal_id*Principal Id
Length1 <= length <= 200
role*Role

An open set; the documentation lists the built-in roles.

Match^[a-z][a-z0-9_]{0,62}$
project_id?|null
audience_tenant_id?|null
expires_at?|null
environment_id?|

ADR-0011: the one environment the grant covers.

environment_tier?|

ADR-0011: every environment of this tier. With neither this nor environment_id, the grant covers every environment except production.

Response Body

Successful Response

application/json
  1. response
grant_id*Grant Id
Formatuuid
workspace_id*|

Empty only for platform-wide operator grants.

project_id*|null
audience_tenant_id*|null
principal_type*Principal Type
Value in"credential""member""user"
principal_id*Principal Id
role*Role

An open set; the documentation lists the built-in roles.

Match^[a-z][a-z0-9_]{0,62}$
expires_at*|null
credential_id*Credential Id

The credential that created the grant.

Formatuuid
created_at*Created At
Formatdate-time
environment_id?|null
environment_tier?|

An open set: see ADR-0011 for the tiers.

Example Request
curl -X POST 'http://dev-sparq.centralindia.cloudapp.azure.com:8000/v1/admin/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/grants' \  -H 'Content-Type: application/json' \  -d '{  "principal_type": "credential",  "principal_id": "string",  "role": "project_admin"}'
Example Response
{  "grant_id": "a3c1da8e-13c6-4cab-955b-2120b58c2982",  "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9",  "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",  "audience_tenant_id": "0287c3f7-886a-49f4-a73e-03577e798c26",  "principal_type": "credential",  "principal_id": "string",  "role": "project_admin",  "expires_at": "2019-08-24T14:15:22Z",  "credential_id": "13c40afa-2996-4a0c-b2e9-68fba9462242",  "created_at": "2019-08-24T14:15:22Z",  "environment_id": "40ef0e48-a11f-4963-a229-e396c9f7e7c4",  "environment_tier": "string"}

API reference

Every operation in the Sparq API, generated from the published OpenAPI document.

Create Sign In Issuer POST

> **Not available yet.** This operation is part of the published contract and answers `501 not_implemented` until it is built. The request and response shapes below are final for this contract version. Operators only: the identity provider console users sign in with.