CorebanqCorebanq Developer Docs
RBACv1

Grant an API permission

Grants an actor (user or role) the right to call a registered endpoint, with optional per-period rate limits. Idempotent on the `(api_endpoint_id, actor_id)` pair, and only on that pair: if a grant for it already exists, the stored row is returned unchanged with 201 and the rest of the request body is ignored — including `type` and every rate limit. So re-posting with a new `rate_limit_per_minute` answers 201 while the old limit stays in force, and posting `type: "role"` over an existing `user` grant returns the user row instead of creating a role grant. Use `POST /v1/rbac/api-permissions/{id}` to change an existing grant.

POST
/v1/rbac/api-permissions

Authorization

bearerAuth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Body of POST /v1/rbac/api-permissions (create). For the update route see APIPermissionUpdateInput — the two read the same fields but write them with different rules. An OMITTED rate limit is not absent in the stored row: storage.processRateLimit turns a nil pointer into -1, so the row and every later read echo -1, never 0 and never a missing key. Both 0 and -1 mean "no limit" to the enforcer (checkRateLimitsForUserOrIP skips the type). active is a plain bool with no server default of true: omitting it stores active=false, i.e. the grant is created switched off.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/rbac/api-permissions" \  -H "Content-Type: application/json" \  -d '{    "api_endpoint_id": "fb253d37-e680-42f3-827b-b3200c221269",    "actor_id": "04f37679-bfbf-4906-b749-01756515cecf",    "type": "user"  }'
{
  "api_endpoint_id": "fb253d37-e680-42f3-827b-b3200c221269",
  "actor_id": "04f37679-bfbf-4906-b749-01756515cecf",
  "type": "user",
  "api_endpoint": {
    "endpoint": "/v1/accounts/%",
    "method": "GET",
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "created_at": "2019-08-24T14:15:22Z",
    "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4",
    "modified_at": "2019-08-24T14:15:22Z",
    "modified_by": "e8d4374d-93a1-4e98-a6c6-fdcf00c5059f",
    "active": true,
    "metadata": {}
  },
  "rate_limit_per_minute": 0,
  "rate_limit_per_hour": 0,
  "rate_limit_per_day": 0,
  "rate_limit_per_week": 0,
  "rate_limit_per_month": 0,
  "rate_limit_per_year": 0,
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4",
  "modified_at": "2019-08-24T14:15:22Z",
  "modified_by": "e8d4374d-93a1-4e98-a6c6-fdcf00c5059f",
  "active": true,
  "metadata": {}
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 429,
  "message": "Global rate limit exceeded",
  "code": "Global rate limit exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "overall_status": "unhealthy",
  "message": "Service is shutting down",
  "timestamp": "2026-08-27T15:04:05Z"
}

POSTGrant a record permission

Grants an actor (user or role) a permission mask on a record type, optionally scoped to a single record id. Returns the standard success envelope, not the created entity.

POSTUpdate an API permission

Update, not create: the path id names the existing API permission and the body replaces its actor, endpoint, type and rate limits. Returns 200.