Replace a manager's roles
PUT
/api/v1/managers/{id}/roles
prm_roles_manage
Replaces the whole set. A caller may only grant roles whose permissions are a subset of their own, so this cannot be used to escalate.
This takes effect on every API token that manager holds, immediately and silently. A token's authority is its owner's live permissions intersected with its own scope, so removing a role here shrinks every integration running as that person with no notification and no change to the token record.
At a glance
- Authentication
- Staff token or session
- Requires permission
-
prm_roles_manageManage roles & permissions - Rate limit
t_mutate
Parameters
| Parameter | Description |
|---|---|
idrequired
path · integer
|
Manager id. |
role_idsrequired
body · array
|
The complete new set of role ids. |
Errors
| Code | When it is returned |
|---|---|
ERR_FORBIDDEN403
|
the caller holds an API token — this route refuses machine credentials |