Skip to content
CantoraAPI documentation
POST
/v1/organizations/{organizationId}/service-principals/{principalId}/grants

Create a Grant for an Organization-scoped ServicePrincipal

Add one fixed built-in role at an exact scope no wider than the ServicePrincipal's immutable structural scope.

Authentication

Send an API key as a Bearer token in the Authorization header.

Parameters

NameLocationRequiredDescription
organizationIdpathYes
The Organization to address.
stringA Cantora Organization identifier, prefixed with `org_`.
  • maximum length 64
  • pattern ^org_[\s\S]+$
principalIdpathYes
The Principal to address.
stringA Cantora Principal identifier, prefixed with `principal_`.
  • maximum length 64
  • pattern ^principal_[\s\S]+$

Request body

Required.

application/json
ServicePrincipalGrantCreateRequest

Responses

201ServicePrincipalGrantCreated
application/json
ServicePrincipalGrantCreatedEncoded
400The request path, headers, query, or JSON body did not satisfy the published schema
401Unauthorized
application/json
UnauthorizedEncoded
403Forbidden
application/json
ForbiddenEncoded
404NotFound
application/json
NotFoundEncoded
409Conflict
application/json
ConflictEncoded

Reusable schemas

ServicePrincipalGrantCreatedEncoded

object
  • unknown properties allowed false
grantIdrequired
stringThe Grant identifier.
  • maximum length 64
  • pattern ^grant_[\s\S]+$
principalIdrequired
stringThe Principal identifier.
  • maximum length 64
  • pattern ^principal_[\s\S]+$
rolerequired
MachineGrantRoleThe Organization role granted to the provisioned identity.
scoperequired
PrincipalScopeThe immutable structural scope of this machine identity.
grantedByPrincipalIdrequired
stringThe Principal that created this Grant.
  • maximum length 64
  • pattern ^principal_[\s\S]+$
createdAtrequired
stringWhen the resource was created, in UTC.
  • format date-time
expiresAtrequired
When the resource expires, in UTC, or null when it does not expire.
  • format date-time
Any of
string
null
revokedAtrequired
When the resource was revoked, in UTC, or null while it remains active.
  • format date-time
Any of
string
null

UnauthorizedEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Unauthorized"
reasonrequired
stringA safe explanation of why the credential was rejected.

ForbiddenEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Forbidden"
permissionrequired
stringThe permission required by the refused operation.

NotFoundEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "NotFound"
resourcerequired
stringThe resource type relevant to the error.
idrequired
stringThe identifier supplied for the resource that was not found.

ConflictEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Conflict"
resourcerequired
stringThe resource type relevant to the error.
reasonrequired
stringA safe explanation of the state conflict.

ServicePrincipalGrantCreateRequest

object
  • unknown properties allowed false
rolerequired
The Organization role granted to the provisioned identity.
All of
MachineGrantRole
The fixed built-in role this Grant carries.
scoperequired
PrincipalScopeThe immutable structural scope of this machine identity.
expiresAtrequired
When the Grant expires, in UTC, or null when it does not expire.
  • format date-time
Any of
string
null

MachineGrantRole

string
  • allowed values "admin", "developer", "viewer", "configurationDeployer"

PrincipalScope

Any of
OrganizationScope
ProjectScope
EnvironmentScope
TenantScope

OrganizationScope

object
  • unknown properties allowed false
levelrequired
stringThe tenancy level of this structural scope.
  • allowed values "organization"
organizationIdrequired
stringThe Organization identifier.
  • maximum length 64
  • pattern ^org_[\s\S]+$

ProjectScope

object
  • unknown properties allowed false
levelrequired
stringThe tenancy level of this structural scope.
  • allowed values "project"
organizationIdrequired
stringThe Organization identifier.
  • maximum length 64
  • pattern ^org_[\s\S]+$
projectIdrequired
stringThe Project identifier.
  • maximum length 64
  • pattern ^proj_[\s\S]+$

EnvironmentScope

object
  • unknown properties allowed false
levelrequired
stringThe tenancy level of this structural scope.
  • allowed values "environment"
organizationIdrequired
stringThe Organization identifier.
  • maximum length 64
  • pattern ^org_[\s\S]+$
projectIdrequired
stringThe Project identifier.
  • maximum length 64
  • pattern ^proj_[\s\S]+$
environmentIdrequired
stringThe Environment identifier.
  • maximum length 64
  • pattern ^env_[\s\S]+$

TenantScope

object
  • unknown properties allowed false
levelrequired
stringThe tenancy level of this structural scope.
  • allowed values "tenant"
organizationIdrequired
stringThe Organization identifier.
  • maximum length 64
  • pattern ^org_[\s\S]+$
projectIdrequired
stringThe Project identifier.
  • maximum length 64
  • pattern ^proj_[\s\S]+$
environmentIdrequired
stringThe Environment identifier.
  • maximum length 64
  • pattern ^env_[\s\S]+$
tenantIdrequired
stringThe Tenant identifier.
  • maximum length 64
  • pattern ^tenant_[\s\S]+$