Skip to main content
POST
cURL
The same declarative bulk upsert as Assign Permissions, applied to the resources that live outside the Catalog: secrets and live connections. Each assignment is a cross product of recipients and resources, and permission_level: null revokes.

Request body

notify_members and message are accepted by this endpoint but do not send email. Grants take effect regardless; recipients are simply not notified.
Each object in assignments:

What the levels mean here

Secrets and live connections do not use the Catalog meaning of the levels. Secret grants are enforced once secret permissions are enabled for your workspace.
The value of a secret is never readable through the API at any level, including manager. Only pipeline and notebook runtimes resolve it.

Share a secret with a group

Scope a live connection to specific tools

tools narrows what the recipient may call. It is validated against each connection’s current available set: a name the connection does not expose is rejected with Connection '<slug>' has no available tools named: ….
Three rules govern tools, and all three return 400 when broken:
  • It requires at least one live connection in the same assignment. A block with tools and only secrets is an error.
  • It cannot be combined with manager, since a manager always holds the full set.
  • Every name must be currently available on every connection in the same assignment.
Omitting tools is not the same as listing every tool. Omitted means “whatever is available”, and it keeps tracking the connection as tools are added or removed. An explicit list is a fixed subset, and tools: [] grants no tools at all. Re-assigning an existing scoped grant without tools resets it to the full set.
Removing a tool from a live connection’s available set strips it from every grant that named it. Adding the tool back later does not restore those grants: you have to reassign them.

Errors

Authorizations

x-api-key
string
header
required

API Key authentication. Format: 'x-api-key: api_key'

Body

assignments
object[]
required
write-only
notify_members
boolean
default:false
write-only
message
string
write-only

Response

201 - application/json
created
object[]
required
read-only
updated
object[]
required
read-only
revoked
object[]
required
read-only