Skip to main content
POST
Grant permissions

Authorizations

Authorization
string
header
required

Bearer token in the Authorization header. Management routes accept a session token or a personal API key (abu_). Agent-facing access.* routes require an agent session token (abs_).

Headers

X-Abadge-Org-Id
string

Active organization. Required when the caller belongs to more than one org; otherwise resolved automatically.

Body

application/json

Target exactly one of an item or a profile.

agentId
string
required
itemId
string
required
capabilities
enum<string>[]
required
Minimum array length: 1

Canonical capabilities are read and use. The remaining values are legacy aliases that normalize to read/use server-side.

Available options:
read,
use,
read_ciphertext,
reveal_plaintext,
mount_env,
mount_file
expiresAt
string<date-time>

Response

Grants created

permissions
object[]
required
nextCursor
string | null