Rbac
Package: agentrouter.rbac.v1 Service: RbacService
Endpoints
List roles
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.6.0 (bug fixes): GET /api/rbac/roles?includeApiScope=true also lists the roles an API key can hold, such as api_audit_logs_reader, so an administrator can see which scopes exist. A key gets one of these roles through its scopes, not through a role binding.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
include_api_scope | no | Also return the api-scope built-in roles behind the assignable management key scopes (api_audit_logs_reader, ...). They are read-only here: CreateBinding refuses them, and a key gains one through its scopes (IssueMyKey/UpdateMyKey). |
Response fields:
| Field | Required | Description |
|---|---|---|
roles | no | undocumented |
{"signatures":{"go":"c.Rbac().ListRoles(ctx, \u0026rbacv1.ListRolesRequest{...})","python":"client.rbac.listroles(...)","typescript":"client.rbac.listroles({...})","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/roles\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/roles\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/api/rbac/roles","slug":"list-roles"}Create role
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
slug | no | undocumented |
name | no | undocumented |
description | no | undocumented |
scope_types | no | undocumented |
permissions | no | undocumented |
scope_type | no | Legacy scalar accepted during the migration. scope_types wins when set; "both" maps to the org and project levels. |
Response fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
{"signatures":{"go":"c.Rbac().CreateRole(ctx, \u0026rbacv1.CreateRoleRequest{...})","python":"client.rbac.createrole(...)","typescript":"client.rbac.createrole({...})","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/roles\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"slug\": \"...\",\n \"name\": \"...\",\n \"description\": \"...\",\n \"scope_types\": [],\n \"permissions\": [],\n \"scope_type\": \"...\"\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/roles\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"slug\": \"...\",\n \"name\": \"...\",\n \"description\": \"...\",\n \"scope_types\": [],\n \"permissions\": [],\n \"scope_type\": \"...\"\n }'"},"persona":"Authenticated (API key or session token)","httpVerb":"POST","httpPath":"/api/rbac/roles","slug":"create-role"}Update role
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
permissions | no | undocumented |
{"signatures":{"go":"c.Rbac().UpdateRole(ctx, \u0026rbacv1.UpdateRoleRequest{...})","python":"client.rbac.updaterole(...)","typescript":"client.rbac.updaterole({...})","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/api/rbac/roles/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"permissions\": []\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/api/rbac/roles/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"permissions\": []\n }'"},"persona":"Authenticated (API key or session token)","httpVerb":"PATCH","httpPath":"/api/rbac/roles/{id}","slug":"update-role"}Delete role
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
{"signatures":{"go":"c.Rbac().DeleteRole(ctx, \u0026rbacv1.DeleteRoleRequest{...})","python":"client.rbac.deleterole(...)","typescript":"client.rbac.deleterole({...})","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/roles/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/roles/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"DELETE","httpPath":"/api/rbac/roles/{id}","slug":"delete-role"}List bindings
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request body: None.
Response fields:
| Field | Required | Description |
|---|---|---|
bindings | no | undocumented |
{"signatures":{"go":"c.Rbac().ListBindings(ctx, \u0026rbacv1.ListBindingsRequest{...})","python":"client.rbac.listbindings(...)","typescript":"client.rbac.listbindings({...})","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/bindings\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/bindings\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/api/rbac/bindings","slug":"list-bindings"}Create binding
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
principal_type | no | undocumented |
principal_id | no | undocumented |
role_id | no | undocumented |
permissions | no | undocumented |
scope_type | no | undocumented |
scope_id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
permissions | no | undocumented |
{"signatures":{"go":"c.Rbac().CreateBinding(ctx, \u0026rbacv1.CreateBindingRequest{...})","python":"client.rbac.createbinding(...)","typescript":"client.rbac.createbinding({...})","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/bindings\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"principal_type\": \"...\",\n \"principal_id\": \"...\",\n \"role_id\": \"...\",\n \"permissions\": [],\n \"scope_type\": \"...\",\n \"scope_id\": \"...\"\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/bindings\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"principal_type\": \"...\",\n \"principal_id\": \"...\",\n \"role_id\": \"...\",\n \"permissions\": [],\n \"scope_type\": \"...\",\n \"scope_id\": \"...\"\n }'"},"persona":"Authenticated (API key or session token)","httpVerb":"POST","httpPath":"/api/rbac/bindings","slug":"create-binding"}Update binding
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
role_id | no | undocumented |
permissions | no | undocumented |
scope_type | no | undocumented |
scope_id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
permissions | no | undocumented |
{"signatures":{"go":"c.Rbac().UpdateBinding(ctx, \u0026rbacv1.UpdateBindingRequest{...})","python":"client.rbac.updatebinding(...)","typescript":"client.rbac.updatebinding({...})","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/api/rbac/bindings/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"role_id\": \"...\",\n \"permissions\": [],\n \"scope_type\": \"...\",\n \"scope_id\": \"...\"\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/api/rbac/bindings/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"role_id\": \"...\",\n \"permissions\": [],\n \"scope_type\": \"...\",\n \"scope_id\": \"...\"\n }'"},"persona":"Authenticated (API key or session token)","httpVerb":"PATCH","httpPath":"/api/rbac/bindings/{id}","slug":"update-binding"}Delete binding
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
{"signatures":{"go":"c.Rbac().DeleteBinding(ctx, \u0026rbacv1.DeleteBindingRequest{...})","python":"client.rbac.deletebinding(...)","typescript":"client.rbac.deletebinding({...})","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/bindings/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/bindings/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"DELETE","httpPath":"/api/rbac/bindings/{id}","slug":"delete-binding"}List groups
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request body: None.
Response fields:
| Field | Required | Description |
|---|---|---|
groups | no | undocumented |
{"signatures":{"go":"c.Rbac().ListGroups(ctx, \u0026rbacv1.ListGroupsRequest{...})","python":"client.rbac.listgroups(...)","typescript":"client.rbac.listgroups({...})","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/groups\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/groups\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/api/rbac/groups","slug":"list-groups"}Create group
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
name | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
{"signatures":{"go":"c.Rbac().CreateGroup(ctx, \u0026rbacv1.CreateGroupRequest{...})","python":"client.rbac.creategroup(...)","typescript":"client.rbac.creategroup({...})","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/groups\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"name\": \"...\"\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/groups\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"name\": \"...\"\n }'"},"persona":"Authenticated (API key or session token)","httpVerb":"POST","httpPath":"/api/rbac/groups","slug":"create-group"}List group members
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
members | no | undocumented |
{"signatures":{"go":"c.Rbac().ListGroupMembers(ctx, \u0026rbacv1.ListGroupMembersRequest{...})","python":"client.rbac.listgroupmembers(...)","typescript":"client.rbac.listgroupmembers({...})","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/groups/01H.../members\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/groups/01H.../members\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/api/rbac/groups/{id}/members","slug":"list-group-members"}Add group member
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
user_id | no | undocumented |
{"signatures":{"go":"c.Rbac().AddGroupMember(ctx, \u0026rbacv1.AddGroupMemberRequest{...})","python":"client.rbac.addgroupmember(...)","typescript":"client.rbac.addgroupmember({...})","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/groups/01H.../members\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"user_id\": \"...\"\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/groups/01H.../members\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"user_id\": \"...\"\n }'"},"persona":"Authenticated (API key or session token)","httpVerb":"POST","httpPath":"/api/rbac/groups/{id}/members","slug":"add-group-member"}Remove group member
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
id | no | undocumented |
user_id | no | undocumented |
{"signatures":{"go":"c.Rbac().RemoveGroupMember(ctx, \u0026rbacv1.RemoveGroupMemberRequest{...})","python":"client.rbac.removegroupmember(...)","typescript":"client.rbac.removegroupmember({...})","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/groups/01H.../members/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/groups/01H.../members/01H...\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"DELETE","httpPath":"/api/rbac/groups/{id}/members/{user_id}","slug":"remove-group-member"}Get team access group
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
team_id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
group_id | no | undocumented |
{"signatures":{"go":"c.Rbac().GetTeamAccessGroup(ctx, \u0026rbacv1.GetTeamAccessGroupRequest{...})","python":"client.rbac.getteamaccessgroup(...)","typescript":"client.rbac.getteamaccessgroup({...})","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/teams/01H.../access-group\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl \"${AGENTROUTER_BASE_URL}/api/rbac/teams/01H.../access-group\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/api/rbac/teams/{team_id}/access-group","slug":"get-team-access-group"}Ensure team access group
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
team_id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
group_id | no | undocumented |
{"signatures":{"go":"c.Rbac().EnsureTeamAccessGroup(ctx, \u0026rbacv1.EnsureTeamAccessGroupRequest{...})","python":"client.rbac.ensureteamaccessgroup(...)","typescript":"client.rbac.ensureteamaccessgroup({...})","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/teams/01H.../access-group\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{}'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/teams/01H.../access-group\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{}'"},"persona":"Authenticated (API key or session token)","httpVerb":"POST","httpPath":"/api/rbac/teams/{team_id}/access-group","slug":"ensure-team-access-group"}Delete team access group
Changed in v0.6.0 (behaviour changes): Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
team_id | no | undocumented |
cascade | no | undocumented |
{"signatures":{"go":"c.Rbac().DeleteTeamAccessGroup(ctx, \u0026rbacv1.DeleteTeamAccessGroupRequest{...})","python":"client.rbac.deleteteamaccessgroup(...)","typescript":"client.rbac.deleteteamaccessgroup({...})","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/teams/01H.../access-group\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/teams/01H.../access-group\" \\\n -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"DELETE","httpPath":"/api/rbac/teams/{team_id}/access-group","slug":"delete-team-access-group"}Grant super admin
Changed in v0.9.0 (behaviour changes): Granting or revoking super_admin now fails with Internal, and changes nothing, when its audit record cannot be written.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
user_id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
user_id | no | undocumented |
already_held | no | undocumented |
{"signatures":{"go":"c.Rbac().GrantSuperAdmin(ctx, \u0026rbacv1.GrantSuperAdminRequest{...})","python":"client.rbac.grantsuperadmin(...)","typescript":"client.rbac.grantsuperadmin({...})","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/super-admins\" \\\n -H \"Authorization: Bearer $SESSION_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"user_id\": \"...\"\n }'"},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/api/rbac/super-admins\" \\\n -H \"Authorization: Bearer $SESSION_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"user_id\": \"...\"\n }'"},"persona":"Dashboard user (session token)","httpVerb":"POST","httpPath":"/api/rbac/super-admins","slug":"grant-super-admin"}Revoke super admin
Changed in v0.9.0 (behaviour changes): Granting or revoking super_admin now fails with Internal, and changes nothing, when its audit record cannot be written.
Changed in v0.5.0 (new features): Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
Request fields:
| Field | Required | Description |
|---|---|---|
user_id | no | undocumented |
Response fields:
| Field | Required | Description |
|---|---|---|
user_id | no | undocumented |
already_revoked | no | undocumented |
{"signatures":{"go":"c.Rbac().RevokeSuperAdmin(ctx, \u0026rbacv1.RevokeSuperAdminRequest{...})","python":"client.rbac.revokesuperadmin(...)","typescript":"client.rbac.revokesuperadmin({...})","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/super-admins/01H...\" \\\n -H \"Authorization: Bearer $SESSION_TOKEN\""},"examples":{"go":"// No Go SDK wrapper for RbacService yet -- use the CLI or curl example below.","python":"# No Python SDK wrapper for RbacService yet -- use the CLI or curl example below.","typescript":"// No TypeScript SDK wrapper for RbacService yet -- use the CLI or curl example below.","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/api/rbac/super-admins/01H...\" \\\n -H \"Authorization: Bearer $SESSION_TOKEN\""},"persona":"Dashboard user (session token)","httpVerb":"DELETE","httpPath":"/api/rbac/super-admins/{user_id}","slug":"revoke-super-admin"}