Change the access level on an item grant
Sets a new access level on one existing grant for this item and records an access-updated event. Requires `full` on the item, with the `resources:write` scope for API keys. A grant id that is malformed or does not belong to this item is not found. Send an `Idempotency-Key` header to make retries safe; a replay within the window returns the original response.
Authorization
apiKey Workspace API key created in Workspace settings → API keys. Scopes on the key bound what it can read and write.
In: header
Path Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X PATCH "https://example.com/v1/workspaces/string/items/string/access/string" \ -H "Content-Type: application/json" \ -d '{ "accessLevel": "view" }'{ "data": { "id": "string" }}{ "_tag": "ApiNotFound", "error": "not_found", "message": "That item does not exist, or this key cannot see it.", "status": 404}{ "_tag": "ApiNotFound", "error": "not_found", "message": "That item does not exist, or this key cannot see it.", "status": 404}Grant people, roles, or guests access to an item
Adds grants for the listed invitees at one access level: existing users and workspace roles are granted immediately, while an email with no matching user becomes a pending item-scoped invite that expires after 30 days and is emailed out. Requires `full` on the item, and an API key additionally needs the `resources:write` scope. Every invitee is resolved and validated before the first write, so an unknown user or role rejects the whole batch rather than half-applying it. Send an `Idempotency-Key` header to make retries safe; a replay within the window returns the original response.
Revoke an item grant or pending invite
Deletes the grant or, when the id refers to a pending item invite instead, revokes that invite and cancels its queued email. Requires `full` on the item, with the `resources:write` scope for API keys. When neither a grant nor a pending invite matches, the request is not found rather than recording a phantom revocation. Send an `Idempotency-Key` header to make retries safe; a replay within the window returns the original response.