Dry run — OpenStack credentials a grant change would revoke

Answers which of the member's ACTIVE OpenStack API credentials the platform would delete if the proposed change were made: a credential dies when the roles baked into it are no longer all held (implied roles included) on its project under the member's projected Keystone roles. Nothing is changed: the change is applied inside a rolled-back savepoint — no grant, no cloud call, no event. change: disable / remove (the member loses every role: every active credential is listed). A change of the member's access matrix is previewed by POST /tenants/{tenantId}/iam/users/{userId}/access/actions/preview-openstack-credential-impact. Only credentials the member's current projection covers are listed (one already uncovered is deleted by the next reconcile regardless of this change). Authorization: the same as the change itself — iam: manage on the scope (owner); 403 otherwise. Errors: 401; 403; 404 unknown scope or user; 422 validation.