授予数据库资源访问权限

curl -X PUT 'https://app.memorylake.cn/openapi/memorylake/admin/v1/access/db-connections/4c2da948e33c54f60ddd71e9b47076d4/scope-grants/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "workspace_id": "ca1916805adbcec16aceaaf65c1a4b74"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

curl -X PUT 'https://app.memorylake.cn/openapi/memorylake/admin/v1/access/db-connections/4c2da948e33c54f60ddd71e9b47076d4/scope-grants/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "workspace_id": "ca1916805adbcec16aceaaf65c1a4b74"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

PUT /openapi/memorylake/admin/v1/access/{resource_type}/{resource_id}/scope-grants/{subject_type}/{subject_id}

针对数据库连接、数据源和分析模型的授予访问权限。

`resource_type`	`resource_id` 取值	所需权限
`db-connections`	`connection_id`	`dbconn:assign`（作用于 `connection_id`）或 `member:set_scope`（`subject_type` 为 `members` 时）或 `access_group:manage`（`subject_type` 为 `access-groups` 时）同时需要：`dbconn:assign`（作用于 `connection_id`）或 `access_group:view` 同时需要：`dbconn:read`（作用于 `connection_id`）
`db-datasources`	`datasource_id`	`db_datasource:assign`（作用于 `datasource_id`）或 `member:set_scope`（`subject_type` 为 `members` 时）或 `access_group:manage`（`subject_type` 为 `access-groups` 时）同时需要：`db_datasource:assign`（作用于 `datasource_id`）或 `access_group:view` 同时需要：`db_datasource:read`（作用于 `datasource_id`）
`analysis-models`	`model_id`	`analysis_model:assign`（作用于 `model_id`）或 `member:set_scope`（`subject_type` 为 `members` 时）或 `access_group:manage`（`subject_type` 为 `access-groups` 时）同时需要：`analysis_model:assign`（作用于 `model_id`）或 `access_group:view` 同时需要：`analysis_model:read`（作用于 `model_id`）

路径参数

string

required

资源类型，取上表中的值之一

string

required

资源 ID，取值见上表

string

required

members 或 access-groups

string

required

成员的 principal_id，或用户组 ID

请求头

string

可选。使用相同值重试会重放首次结果。

请求体

string

required

变更原因；记录在审计日志中

string

仅限项目：项目所属的工作空间，以便在访问范围中按名称显示项目

curl -X PUT 'https://app.memorylake.cn/openapi/memorylake/admin/v1/access/db-connections/4c2da948e33c54f60ddd71e9b47076d4/scope-grants/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "reason": "example",
    "workspace_id": "ca1916805adbcec16aceaaf65c1a4b74"
  }'

响应

object

Show Resource Access View 对象

array

可访问该实例的成员和用户组

Show Resource Access Entry 对象

string

显示名称

string

principal_id 或用户组 ID

string

member 或 access_group

array

显式来源允许的操作

string

对于被阻止的条目：scope = 被限定在其他实例；permission = 其角色完全无法查看此资源类型

object

成员：调用方在此处可为其设置的级别

Show Permission Level Options 对象

boolean

调用方能否移除该成员的权限级别（级别 none）

array

调用方可为该成员设置的级别（不含当前级别）

string

当前级别无法降低或移除的原因：outranked 表示该成员的级别不低于调用方；last_manager 表示该成员是最后一个可管理该资源的人；no_permission 表示调用方无法共享该资源

string

在此实例上为该成员设置的权限级别；未设置时省略。可选值：read、write、manage。

integer

用户组：成员数

string

该成员在此实例上可执行的操作，综合所有来源。可选值：read、write、manage。

string

成员：其角色

integer

主体访问范围内此资源类型的实例数

string

成员：all = 不受此资源类型的访问范围限制；instances = 仅限其范围内的实例

array

主体访问该实例的途径

Show Resource Access Source 对象

string

role：成员的角色覆盖所有实例。scope_grant：该实例在主体的访问范围内。access_group：某个用户组的实例列表。parent：在父工作空间上授予。permission_level：在此实例上设置的权限级别。

string

对于 access_group：该用户组

string

对于 access_group：其名称

array

此来源允许的操作；["*"] = 主体全部权限所允许的操作

string

对于 parent：父工作空间 ID

array

对于 permission_level：在此实例上持有的权限级别

integer

可访问该实例的成员

array

无法访问的成员

Show Resource Access Entry 对象

string

显示名称

string

principal_id 或用户组 ID

string

member 或 access_group

array

显式来源允许的操作

string

对于被阻止的条目：scope = 被限定在其他实例；permission = 其角色完全无法查看此资源类型

object

成员：调用方在此处可为其设置的级别

Show Permission Level Options 对象

boolean

调用方能否移除该成员的权限级别（级别 none）

array

调用方可为该成员设置的级别（不含当前级别）

string

在此实例上为该成员设置的权限级别；未设置时省略。可选值：read、write、manage。

integer

用户组：成员数

string

该成员在此实例上可执行的操作，综合所有来源。可选值：read、write、manage。

string

成员：其角色

integer

主体访问范围内此资源类型的实例数

string

成员：all = 不受此资源类型的访问范围限制；instances = 仅限其范围内的实例

array

主体访问该实例的途径

Show Resource Access Source 对象

string

对于 access_group：该用户组

string

对于 access_group：其名称

array

此来源允许的操作；["*"] = 主体全部权限所允许的操作

string

对于 parent：父工作空间 ID

array

对于 permission_level：在此实例上持有的权限级别

array

调用方可在此实例上设置的权限级别；调用方无法共享该实例时为空

string

实例 ID；工作空间 Actor 和 Agent 为 <workspace_id>/<id>

string

资源类型

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

错误

出错时返回 success: false、message 和 error_code。全部错误码见错误码。

状态码	含义
`400`	参数或请求体无效
`401`	API Key 缺失、无效、已停用或已过期
`403`	该 Key 无权执行此操作
`404`	资源不存在
`409`	请求与当前状态冲突，例如重复或已达上限
`422`	请求体或参数未通过校验
`429`	请求过多，请按 `Retry-After` 等待后重试
`500`	服务端错误
`503`	暂时不可用，请稍后重试

MemoryLake API

Memory Router API

路径参数

请求头

请求体

响应

错误

​路径参数

​请求头

​请求体

​响应

​错误

路径参数

请求头

请求体

响应

错误