CorebanqCorebanq Developer Docs
RBACv1

Update an API endpoint

Replaces the route, method, active flag and metadata of a registered endpoint. The path id wins over any id in the body. This is a full replacement: an omitted field is written as its zero value, so send every field — see APIEndpointReplaceInput.

PUT
/v1/rbac/endpoints/{id}

Authorization

bearerAuth
AuthorizationBearer <token>

In: header

Path Parameters

id*string

API endpoint id

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Body of PUT /v1/rbac/endpoints/{id}. A FULL REPLACEMENT, not a patch: the handler assigns all four fields onto the stored row from the decoded body, and the Go fields are non-pointer, so an omitted field is written as its zero value. Sending only {"endpoint", "method"} answers 200 and silently sets active to false and wipes metadata. Send every field, including the ones you are not changing.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PUT "https://example.com/v1/rbac/endpoints/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Content-Type: application/json" \  -d '{    "endpoint": "/v1/accounts/%",    "method": "GET",    "active": true,    "metadata": {}  }'
{
  "endpoint": "/v1/accounts/%",
  "method": "GET",
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4",
  "modified_at": "2019-08-24T14:15:22Z",
  "modified_by": "e8d4374d-93a1-4e98-a6c6-fdcf00c5059f",
  "active": true,
  "metadata": {}
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}
{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 429,
  "message": "Global rate limit exceeded",
  "code": "Global rate limit exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "overall_status": "unhealthy",
  "message": "Service is shutting down",
  "timestamp": "2026-08-27T15:04:05Z"
}

PUTUpdate a record permission

Replaces the permission mask and the active flag of an existing record permission. Only these two fields are read from the body; the actor, record type and record id cannot be changed. Both are a full replacement: an omitted field is written as its zero value, so send both — see RecordPermissionUpdateInput.

DELDelete an API permission

Revokes the API permission and invalidates the actor's permission cache.