authz
issue, inspect, and revoke permission grants
This page holds the operation for reading the permission grants you have received. A grant records which connector you may use, with which preset (allowed actions), and how far (its scope). The admin-facing grant-scope and access-policy surfaces are also summarized briefly below. The operational flow of granting and revoking permissions is in the member management guide.
1 operations — issue, inspect, and revoke permission grants
GET /api/v1/tenants/{tenantID}/me/grants
authorizationGetApiV1TenantsByTenantIDMeGrants
자기 user_id 로 발급된 active grant 들을 시간 역순으로 조회.
- 호출 권한: tenant_member
| Language | Call |
|---|---|
| node | sdk.gateway(…) — resource model — see the package's TypeScript definitions for arguments and return types |
| go | client.Authz().AuthorizationGetApiV1TenantsByTenantIDMeGrants(ctx, axhub.OperationParams{PathParams: …, Query: …, Body: …}) |
| java | client.authz().authorizationGetApiV1TenantsByTenantIDMeGrants(pathParams, query, body) — async: authorizationGetApiV1TenantsByTenantIDMeGrantsAsync(…) → CompletableFuture |
| kotlin | client.authz.authorizationGetApiV1TenantsByTenantIDMeGrants(pathParams, query, body) — suspend |
| python | client.authz.authorization_get_api_v1_tenants_by_tenant_id_me_grants(path_params=…, query=…, body=…) — AsyncAxHubClient awaits the same name |
| ruby | client.authz.authorization_get_api_v1_tenants_by_tenant_id_me_grants(path_params: …, query: …, body: …) |
| generic | request("authorizationGetApiV1TenantsByTenantIDMeGrants", pathParams, query, body) |
Path parameters — pass via pathParams
| Name | Type | Description |
|---|---|---|
tenantID required | string | 테넌트 UUID |
Response — 200 · OK
Array response → the SDK wraps it as {"value": [...]}. Element fields:
| Name | Type | Description |
|---|---|---|
connectorId (wire: connector_id) | string | |
createdAt (wire: created_at) | string | |
expiresAt (wire: expires_at) | string | |
grantedAt (wire: granted_at) | string | |
grantedBy (wire: granted_by) | string | |
id | string | |
policyIds (wire: policy_ids) | array<string> | |
presetId (wire: preset_id) | string | |
reason | string | |
revokedAt (wire: revoked_at) | string | |
revokedBy (wire: revoked_by) | string | |
scopeResourcePaths (wire: scope_resource_paths) | array<string> | 이 grant 가 닿을 수 있는 대상 목록(schema/table). 빈 배열/생략 = 커넥터 전체 (spec 172). |
source | string | |
status | string | Status 는 active / revoked / expired. |
subjectId (wire: subject_id) | string | |
subjectKind (wire: subject_kind) | string | |
tenantId (wire: tenant_id) | string | |
updatedAt (wire: updated_at) | string |
Error statuses: 401 403 500 — Error handling
Grant scope and access policies (admin surface)
grant 는 subject×connector×preset 에 범위(scope_resource_paths) 축이 더해진 4축이다 (spec 172). 범위는 생성 시 지정하거나 tenant_admin 이 PUT /api/v1/tenants/{tenantID}/grants/{grantID}/scope (authorizationPutApiV1TenantsByTenantIDGrantsByGrantIDScope) 로 통째 교체한다 — schema/table 문자열 배열, 최대 200개(중복 제거), 빈 배열이면 커넥터 전체로 되돌린다. 회수·만료된 grant 는 409.
행·열 접근 정책(access-policy)은 /api/v1/tenants/{tenantID}/access-policies CRUD 로 관리한다. 정책마다 resource_path(적용 대상 schema/table — 비면 커넥터 전체, spec 169)·connector_id(소속 커넥터 — 비면 커넥터 무관, spec 171)를 가질 수 있다. 활성 grant 가 참조 중인 정책 삭제는 409 policy_in_use (spec 168). 범위·정책이 Gateway 호출에서 어떻게 집행되는지는 gateway 에 있다.