Create Capability Grant

post

https://staging.ankatech.co/api/v3/admin/tenants/{tenantId}/capability-grants

Wildcard grants (assetId null) require allowWildcardAsset=true per G-4. Every FK (actorId, exchangeContextId, constraintPolicyId) is validated to belong to the path tenant — cross-tenant probing is rejected.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

tenantId

uuid

required

Body Params

actorId

uuid

required

Cryptographic Actor that the grant authorises

capabilities

array of strings

required

length between 0 and 6

Capability strings (e.g. ["ENCRYPT","DECRYPT"] or ["REENCRYPT"])

capabilities*

assetKids

array of strings

required

length between 0 and 2

KID strings. 1 element for atomic ops; 2 elements for REENCRYPT/RESIGN, submitted source-first as [source, target] — a recording convention, not an enforced direction (the runtime matches with containsAll). Empty list = wildcard (requires allowWildcardAsset=true).

assetKids*

exchangeContextId

uuid

Optional Exchange Context this grant is bound to

constraintPolicyId

uuid

Optional Constraint Policy to attach

allowWildcardAsset

boolean

Defaults to false

Opt-in flag required when assetKids is empty (G-4 safety gate). Optional: omitting it is equivalent to false, which denies a wildcard grant.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201Grant created

400Validation failure: missing allowWildcardAsset, invalid capability, or FK does not belong to tenant

403Tenant boundary violation or missing scope

409Duplicate grant (same 5-dimensional key already exists)