Skip to main content
GET
Generate role-binding manifests for a resource or subject

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

resourceType
enum<string>

By-resource mode: use with resourceId (XOR subjectType+subjectId). Only resource types that role-binding names support.

Available options:
cluster,
workspace,
secret-group,
tenant,
mlf-project,
repository,
provider-integration,
provider-account,
tracing-project,
agent,
agent-app,
mcp-server
Example:

"workspace"

resourceId
string

By-resource mode: system-generated unique identifier for the resource.

Example:

"hoqc0a1ryvmwf5f0ka0zdymf"

subjectType
enum<string>

By-subject mode: use with subjectId. Same subject types as list grants (user, team, agent, virtualaccount).

Available options:
user,
team,
agent,
virtualaccount
Example:

"user"

subjectId
string

By-subject mode: system-generated unique identifier for the subject.

Example:

"z9rcvwtau3g0m4o5kjoarlt0"

includeOnlyTenantRoles
boolean

When true and the subject is a user or team, keep only grants on the tenant resource. Ignored for other subject types and for resource mode. Default false.

Example:

true

Response

200 - application/json

Role-binding manifests, one per role.

data
RoleBindingManifest · object[]
required

Role-binding manifests equivalent to AUTH_API grants on the resource or subject, one per role.