curl --request PUT \
--url https://api.studio.prisme.ai/v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"privileges": {
"accessManager": {
"enabled": true,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": [
"<string>"
]
},
"apiKeys": {
"allowedPermissions": [
"<string>"
],
"allowedScopes": [
"<string>"
]
}
}
}
}
'const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
privileges: {
accessManager: {
enabled: true,
serviceAccounts: {defaultRoleSlug: '<string>', allowedRoleSlugs: ['<string>']},
apiKeys: {allowedPermissions: ['<string>'], allowedScopes: ['<string>']}
}
}
})
};
fetch('https://api.studio.prisme.ai/v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.studio.prisme.ai/v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges"
payload = { "privileges": { "accessManager": {
"enabled": True,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": ["<string>"]
},
"apiKeys": {
"allowedPermissions": ["<string>"],
"allowedScopes": ["<string>"]
}
} } }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text){
"orgSlug": "<string>",
"workspaceId": "<string>",
"privileges": {
"accessManager": {
"enabled": true,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": [
"<string>"
]
},
"apiKeys": {
"allowedPermissions": [
"<string>"
],
"allowedScopes": [
"<string>"
]
}
}
},
"id": "<string>",
"workspaceSlug": "<string>",
"createdBy": "<string>",
"updatedBy": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>"
}{
"orgSlug": "<string>",
"workspaceId": "<string>",
"privileges": {
"accessManager": {
"enabled": true,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": [
"<string>"
]
},
"apiKeys": {
"allowedPermissions": [
"<string>"
],
"allowedScopes": [
"<string>"
]
}
}
},
"id": "<string>",
"workspaceSlug": "<string>",
"createdBy": "<string>",
"updatedBy": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>"
}{
"error": "AuthenticationError",
"message": "Unauthenticated"
}{
"error": "ForbiddenError",
"message": "Forbidden"
}{
"error": "ObjectNotFound",
"message": "<string>"
}Set Org Workspace Privileges
Set workspace privileges for an organization. Creates or updates.
Requires the orgs:workspace-privileges:manage permission, held by
Owner and SuperAdmin by default. Any role granted this permission via
a custom role or org API key also has access. The default Admin role
does not — trust grants are an Owner-level decision.
Models “this org trusts this workspace to act inside this org” — the caller does NOT need to own, install, or have any access relationship with the target workspace beyond the workspace existing.
workspaceIdOrSlug accepts either a raw workspace ID, or
slug:<slug> for slug-based lookup. The workspace MUST exist at PUT
time — used as a typo guard and to capture the canonical ID. The
caller’s authorization is enforced BEFORE workspace resolution, so
non-authorized callers always get 403 (never 404).
curl --request PUT \
--url https://api.studio.prisme.ai/v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"privileges": {
"accessManager": {
"enabled": true,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": [
"<string>"
]
},
"apiKeys": {
"allowedPermissions": [
"<string>"
],
"allowedScopes": [
"<string>"
]
}
}
}
}
'const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
privileges: {
accessManager: {
enabled: true,
serviceAccounts: {defaultRoleSlug: '<string>', allowedRoleSlugs: ['<string>']},
apiKeys: {allowedPermissions: ['<string>'], allowedScopes: ['<string>']}
}
}
})
};
fetch('https://api.studio.prisme.ai/v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.studio.prisme.ai/v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges"
payload = { "privileges": { "accessManager": {
"enabled": True,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": ["<string>"]
},
"apiKeys": {
"allowedPermissions": ["<string>"],
"allowedScopes": ["<string>"]
}
} } }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text){
"orgSlug": "<string>",
"workspaceId": "<string>",
"privileges": {
"accessManager": {
"enabled": true,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": [
"<string>"
]
},
"apiKeys": {
"allowedPermissions": [
"<string>"
],
"allowedScopes": [
"<string>"
]
}
}
},
"id": "<string>",
"workspaceSlug": "<string>",
"createdBy": "<string>",
"updatedBy": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>"
}{
"orgSlug": "<string>",
"workspaceId": "<string>",
"privileges": {
"accessManager": {
"enabled": true,
"serviceAccounts": {
"defaultRoleSlug": "<string>",
"allowedRoleSlugs": [
"<string>"
]
},
"apiKeys": {
"allowedPermissions": [
"<string>"
],
"allowedScopes": [
"<string>"
]
}
}
},
"id": "<string>",
"workspaceSlug": "<string>",
"createdBy": "<string>",
"updatedBy": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>"
}{
"error": "AuthenticationError",
"message": "Unauthenticated"
}{
"error": "ForbiddenError",
"message": "Forbidden"
}{
"error": "ObjectNotFound",
"message": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Workspace ID, or slug:<workspaceSlug> for slug addressing.
Body
Workspace privileges configuration for privileged module access
Hide child attributes
Hide child attributes
Configuration for access-manager module privileges
Hide child attributes
Hide child attributes
Whether access-manager module is enabled for this workspace
Service account minting gates. Omit if the workspace does not use serviceAccount instructions.
API key minting gates. Omit if the workspace does not use apiKey instructions.
Hide child attributes
Hide child attributes
Fully-qualified permission patterns the workspace may attach to API keys. Trailing * matches any suffix.
Fully-qualified scope patterns the workspace may attach to API keys. Trailing * matches any suffix.
Response
Privileges updated
Org-specific workspace privileges configuration
Organization that owns these privilege settings
Canonical workspace ID. The authoritative key — immutable across slug renames.
Workspace privileges configuration for privileged module access
Hide child attributes
Hide child attributes
Configuration for access-manager module privileges
Hide child attributes
Hide child attributes
Whether access-manager module is enabled for this workspace
Service account minting gates. Omit if the workspace does not use serviceAccount instructions.
API key minting gates. Omit if the workspace does not use apiKey instructions.
Hide child attributes
Hide child attributes
Fully-qualified permission patterns the workspace may attach to API keys. Trailing * matches any suffix.
Fully-qualified scope patterns the workspace may attach to API keys. Trailing * matches any suffix.
Workspace slug captured at write time and refreshed on each upsert. Denormalized — never used as a lookup key. May be stale relative to the workspace's current slug between writes; treat as advisory for display only.
Was this page helpful?