Resource role bindings

Operations of the Space Registry API. Paths are relative to your deployment's API host.

GET /api/space-registry-api/resource-role-bindings

Every binding this organization has DECLARED

Enumerating is not resolving: this returns the rows as stated, several per role if several spaces state one, and marks none of them as in force. Ask /resolve for that — a winner computed here would be a second implementation of the precedence ladder. Roles are an OPEN vocabulary, so without this a consumer must know a role name before it can ask about it. Platform-fenced rows are not included. An empty list is an answer, never a default.

Authentication: bearer token (Authorization: Bearer <token>)

PUT /api/space-registry-api/resource-role-bindings

State the binding at one space (org-admin)

An INSTANCE target (one with no revision plane) must exist and belong to the binding's organization, or the write is refused and nothing is stored. Only team, credential-binding and connection instance targets can be verified; any other instance kind is refused with 422 SPACE_INSTANCE_TARGET_KIND_UNSUPPORTED. 404 SPACE_INSTANCE_TARGET_NOT_FOUND: no such target, or one that belongs to another organization (indistinguishable by design). 422 SPACE_INSTANCE_TARGET_OWNER_MISMATCH: the target states an owner other than the binding's. 503 SPACE_INSTANCE_TARGET_UNVERIFIABLE: the owner could not be determined, so the write fails closed; retry. A credential-binding pointer names a credential binding, verified at write time: 409 CREDENTIAL_POINTER_PROVIDER_MISMATCH: the credential belongs to another provider than the role. 409 CREDENTIAL_POINTER_INELIGIBLE (details.reason: org_mismatch, revoked, owner_mismatch, owner_not_on_ladder, subject_bound_elsewhere): the credential may not be the default at this space — it must be owned by the pointer's space or one of its ancestors. 404 SPACE_INSTANCE_TARGET_NOT_FOUND: no such credential, or another organization's. 403 CREDENTIAL_POINTER_WRITER_CONTEXT_REQUIRED: the writer carries no forwardable context (the as-code reconciler cannot state a pointer); permanent, so retrying cannot help. 503 SPACE_INSTANCE_TARGET_UNVERIFIABLE: the credential broker could not be asked; nothing was written. 400: ownerSpaceRef or roleKey is not a well-formed key. 403 SPACE_CROSS_ORG_ACCESS_FORBIDDEN: the owner space names an organization other than the request's, or a platform space; decided from the key alone, so the answer is the same whether or not anything is stated there. 403 SPACE_ORG_ADMIN_REQUIRED: the caller holds no write authority over the organization's bindings. A refused call writes nothing and records nothing. A credential-binding role is a credential pointer and has its own address rules: 400 CREDENTIAL_POINTER_QUALIFIER_REFUSED: the role key states a qualifier. 400 CREDENTIAL_POINTER_OWNER_TIER_REFUSED: the owner space is not a tenant's user, project or org space. 403 CREDENTIAL_POINTER_SELF_ONLY: a pointer at a user space (a personal default) is stated by that user alone; an org admin may not state another user's default.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json SetResourceRoleBindingDto

DELETE /api/space-registry-api/resource-role-bindings

Remove the binding stated at one space (org-admin)

Un-shadows the ancestor binding, if any. Idempotent: a space that already states nothing is already in the requested state. 400: ownerSpaceRef or roleKey is not a well-formed key. 403 SPACE_CROSS_ORG_ACCESS_FORBIDDEN: the owner space names an organization other than the request's, or a platform space; decided from the key alone, so the answer is the same whether or not anything is stated there. 403 SPACE_ORG_ADMIN_REQUIRED: the caller holds no write authority over the organization's bindings. A refused call writes nothing and records nothing. A credential-binding role is a credential pointer and has its own address rules: 400 CREDENTIAL_POINTER_QUALIFIER_REFUSED: the role key states a qualifier. 400 CREDENTIAL_POINTER_OWNER_TIER_REFUSED: the owner space is not a tenant's user, project or org space. 403 CREDENTIAL_POINTER_SELF_ONLY: a pointer at a user space (a personal default) is stated by that user alone; an org admin may not state another user's default.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/space-registry-api/resource-role-bindings/disable

State at one space that NOTHING plays this role (org-admin)

The opposite intention from DELETE, and no longer the same effect. DELETE un-shadows the ladder, so the organisation then receives whatever an ancestor states — or, now, the biome's managed default. This states that the answer IS nothing and stops the resolve, which is the only way to refuse a default. Idempotent, and it replaces a pin stated at the same space without needing it deleted first. 400: ownerSpaceRef or roleKey is not a well-formed key. 403 SPACE_CROSS_ORG_ACCESS_FORBIDDEN: the owner space names an organization other than the request's, or a platform space; decided from the key alone, so the answer is the same whether or not anything is stated there. 403 SPACE_ORG_ADMIN_REQUIRED: the caller holds no write authority over the organization's bindings. A refused call writes nothing and records nothing. A credential-binding role is a credential pointer and has its own address rules: 400 CREDENTIAL_POINTER_QUALIFIER_REFUSED: the role key states a qualifier. 400 CREDENTIAL_POINTER_OWNER_TIER_REFUSED: the owner space is not a tenant's user, project or org space. 403 CREDENTIAL_POINTER_SELF_ONLY: a pointer at a user space (a personal default) is stated by that user alone; an org admin may not state another user's default.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json DisableResourceRoleBindingDto

GET /api/space-registry-api/resource-role-bindings/resolve

The binding in force for a role, resolved through the space ladder

Most specific wins. configured: false means the OWNER has stated nothing anywhere on the ladder — an answer, never a defaulted value. Read source for WHY: the organisation may have stated nothing and still have a working answer, because the biome that owns the role ships a managed default. effectiveTarget is what is in force either way.

Authentication: bearer token (Authorization: Bearer <token>)