设置权限级别 - MemoryLake 中国站

curl -X PUT 'https://app.memorylake.cn/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/permission-levels/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "level": "read",
    "reason": "example",
    "workspace_id": "5bf25dc12466a4a9059dac4c35873ec7"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

curl -X PUT 'https://app.memorylake.cn/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/permission-levels/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "level": "read",
    "reason": "example",
    "workspace_id": "5bf25dc12466a4a9059dac4c35873ec7"
  }'

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

PUT /openapi/memorylake/admin/v1/access/{resource_type}/{resource_id}/permission-levels/{subject_type}/{subject_id}

设置成员或用户组在该资源上持有的权限级别。可设置哪些级别，请先调用列出可选权限级别。

`resource_type`	`resource_id` 取值	所需权限
`workspaces`	`workspace_id`	`workspace:assign`（作用于 `workspace_id`）同时需要：`workspace:read`（作用于 `workspace_id`）
`projects`	`project_id`	`project:assign`（作用于 `project_id`）同时需要：`project:read`（作用于 `project_id`）
`actors`	`actor_id`	`actor:assign`（作用于 `actor_id`）同时需要：`actor:read`（作用于 `actor_id`）
`agents`	`agent_id`	`agent:assign`（作用于 `agent_id`）同时需要：`agent:read`（作用于 `agent_id`）
`skills`	`skill_id`	`skill:assign`（作用于 `skill_id`）同时需要：`skill:read`（作用于 `skill_id`）
`boundaries`	`boundary_id`	`boundary:assign`（作用于 `boundary_id`）同时需要：`boundary:read`（作用于 `boundary_id`）
`workspaces/{workspace_id}/actors`	`actor_id`	`workspace_actor:assign`（作用于 `workspace_id}/{actor_id`）同时需要：`workspace_actor:read`（作用于 `workspace_id}/{actor_id`）
`workspaces/{workspace_id}/agents`	`agent_id`	`workspace_agent:assign`（作用于 `workspace_id}/{agent_id`）同时需要：`workspace_agent:read`（作用于 `workspace_id}/{agent_id`）

如果改动会让某人获得管理员角色，或会缩小管理员能访问的范围，还需要由团队所有者或管理员操作。

路径参数

string

required

资源类型，取上表中的值之一

string

required

资源 ID，取值见上表

string

required

members（用户组不能持有权限级别）可选值：members、access-groups。

string

required

成员的 principal_id

请求头

string

可选。使用相同值重试会重放首次结果。

请求体

string

required

该成员在此实例上的最终权限级别。none 会移除在此处设置的所有级别——它不是拒绝：该成员仍保留其角色、访问范围或用户组所赋予的权限。并非每种类型都支持全部级别（数据库连接仅支持 read 和 manage）；访问视图中的 grantable_levels 列出了可用级别。可选值：read、write、manage、none。

string

required

变更原因；记录在审计日志中

string

仅限项目：项目所属的工作空间，以便在访问范围中按名称显示项目

curl -X PUT 'https://app.memorylake.cn/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd/permission-levels/members/89914667f74821b220f374d323f0f4b0' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Idempotency-Key: 7c1d2e3f-0a9b-4c8d-b7e6-f5a4d3c2b1a0' \
  -H 'Content-Type: application/json' \
  -d '{
    "level": "read",
    "reason": "example",
    "workspace_id": "5bf25dc12466a4a9059dac4c35873ec7"
  }'

响应

object

Show Resource Access View 对象

array

可访问该实例的成员和用户组

Show Resource Access Entry 对象

string

显示名称

string

principal_id 或用户组 ID

string

member 或 access_group

array

显式来源允许的操作

string

对于被阻止的条目：scope = 被限定在其他实例；permission = 其角色完全无法查看此资源类型

object

成员：调用方在此处可为其设置的级别

Show Permission Level Options 对象

boolean

调用方能否移除该成员的权限级别（级别 none）

array

调用方可为该成员设置的级别（不含当前级别）

string

当前级别无法降低或移除的原因：outranked 表示该成员的级别不低于调用方；last_manager 表示该成员是最后一个可管理该资源的人；no_permission 表示调用方无法共享该资源

string

在此实例上为该成员设置的权限级别；未设置时省略。可选值：read、write、manage。

integer

用户组：成员数

string

该成员在此实例上可执行的操作，综合所有来源。可选值：read、write、manage。

string

成员：其角色

integer

主体访问范围内此资源类型的实例数

string

成员：all = 不受此资源类型的访问范围限制；instances = 仅限其范围内的实例

array

主体访问该实例的途径

Show Resource Access Source 对象

string

role：成员的角色覆盖所有实例。scope_grant：该实例在主体的访问范围内。access_group：某个用户组的实例列表。parent：在父工作空间上授予。permission_level：在此实例上设置的权限级别。

string

对于 access_group：该用户组

string

对于 access_group：其名称

array

此来源允许的操作；["*"] = 主体全部权限所允许的操作

string

对于 parent：父工作空间 ID

array

对于 permission_level：在此实例上持有的权限级别

integer

可访问该实例的成员

array

无法访问的成员

Show Resource Access Entry 对象

string

显示名称

string

principal_id 或用户组 ID

string

member 或 access_group

array

显式来源允许的操作

string

对于被阻止的条目：scope = 被限定在其他实例；permission = 其角色完全无法查看此资源类型

object

成员：调用方在此处可为其设置的级别

Show Permission Level Options 对象

boolean

调用方能否移除该成员的权限级别（级别 none）

array

调用方可为该成员设置的级别（不含当前级别）

string

在此实例上为该成员设置的权限级别；未设置时省略。可选值：read、write、manage。

integer

用户组：成员数

string

该成员在此实例上可执行的操作，综合所有来源。可选值：read、write、manage。

string

成员：其角色

integer

主体访问范围内此资源类型的实例数

string

成员：all = 不受此资源类型的访问范围限制；instances = 仅限其范围内的实例

array

主体访问该实例的途径

Show Resource Access Source 对象

string

对于 access_group：该用户组

string

对于 access_group：其名称

array

此来源允许的操作；["*"] = 主体全部权限所允许的操作

string

对于 parent：父工作空间 ID

array

对于 permission_level：在此实例上持有的权限级别

array

调用方可在此实例上设置的权限级别；调用方无法共享该实例时为空

string

实例 ID；工作空间 Actor 和 Agent 为 <workspace_id>/<id>

string

资源类型

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "allowed": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "allowed_count": 1,
    "blocked": [
      {
        "name": "Example name",
        "subject_id": "e9225468996bae25743a2b64eeb19cc7",
        "subject_type": "member",
        "actions": [
          "example"
        ],
        "blocked_by": "scope",
        "level_options": {
          "can_set_none": true,
          "settable_levels": [
            "example"
          ],
          "blocked_reason": "outranked",
          "current_level": "read"
        },
        "member_count": 1,
        "permission_level": "read",
        "role": "tenant_member",
        "scope_grant_count": 1,
        "scope_mode": "all",
        "sources": [
          {
            "type": "role",
            "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366",
            "access_group_name": "Example access group",
            "actions": [],
            "parent_id": "ba8581988563142580f3237fbf400514",
            "permission_levels": []
          }
        ]
      }
    ],
    "grantable_levels": [
      "example"
    ],
    "instance_id": "a88bb6c846106e751d8cf36bdeb592fe",
    "resource_type": "example"
  }
}

​路径参数

​请求头

​请求体

​响应

路径参数

请求头

请求体

响应