Update administrator permissions

Replaces the administrator's role and policies in a single operation. Each item of policies is a policy in the same format as POST /credentials/{credential_id}/policies: the capabilities it grants and the resources they apply to. The new policies replace all previous ones; if any part of the request is rejected, no changes are applied.

Full-access roles (root and master_admin) have no policies: send an empty policies array with them, or the request returns validation_failed.

Nobody can grant more than they have. When the caller is an administrator (OAuth access token), the limit is that administrator's own permissions: a full-access administrator grants anything, including administrators.* and credentials.*; any other administrator grants only what their own policies grant. A credential grants only the delegable permissions of its own policies, never administrators.* or credentials.*, and never assigns a full-access role. Requests that exceed these limits return delegation_limit_exceeded. An administrator cannot change their own permissions (409, reason: self_modification).

To avoid overwriting a newer version, send the ETag returned by the retrieve administrator permissions operation in the If-Match header. The response includes the new ETag.

Path Parameters

Header Parameters

Response Body

curl -X PUT "https://example.com/administrators/string/permissions" \  -H "Content-Type: application/json" \  -d '{    "policies": [      {        "capabilities": [          "string"        ],        "resources": [          {            "selector": "string",            "type": "string"          }        ]      }    ],    "role": "string"  }'

{  "data": {    "full_access": true,    "object": "administrator_permissions",    "policies": [      {        "capabilities": [          "string"        ],        "id": "string",        "object": "policy",        "published_at": "2019-08-24T14:15:22Z",        "published_by": {          "id": "string",          "kind": "admin"        },        "resources": [          {            "ids": [              "string"            ],            "include_future": true,            "parent": "string",            "selector": "instance",            "type": "instance"          }        ],        "version": 0      }    ],    "revision": "string",    "role": "root"  }}