Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
The tenant tree the caller may grant access on
The tree the access-matrix editor renders: the tenant, the
subscriptions the caller reaches and the projects beneath them (sorted by name, then
id), each node with the role ids the caller may grant THERE (grantableRoleIds) and,
when a role assignable there is not grantable, why (reason). Grantability is the server's own rule --
reach, iam: manage at the node, rank and permission domination at the node, a
tenant owner for the tenant node, the role's assignableScopes -- so the client never
derives it. roles lists every role of the tenant (built-in and custom).
Errors: 401 unauthenticated; 403 when the caller has no iam: manage anywhere in
the tenant; 404 when the tenant is not reached.
Idempotency/Concurrency: Safe read; no state change.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
tenantId*stringThe tenant id.
The grantable tenant tree.
application/json- response
The tenant tree the caller may grant access on.
tenant*One node of the grantable tree.
subscriptions*array<>roles*array<>curl -X GET "https://example.com/tenants/string/iam/access-targets"{ "tenant": { "id": "string", "name": "string", "grantableRoleIds": [ "string" ], "reason": "TENANT_OWNER_REQUIRED" }, "subscriptions": [ { "id": "string", "name": "string", "grantableRoleIds": [ "string" ], "reason": "TENANT_OWNER_REQUIRED", "projects": [ { "id": "string", "name": "string", "grantableRoleIds": [ "string" ], "reason": "TENANT_OWNER_REQUIRED" } ] } ], "roles": [ { "id": "string", "name": "string", "builtIn": true, "assignableScopes": [ "tenant" ] } ]}