Apply application permission policy¶

Save the complete application permission policy for a role. Saving replaces the role’s existing application permission policy, so confirm the policy content and role status first.

PUT https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/application-policy

Preparation before calling¶

First select a role and confirm that its policy can be modified. Then view the permission schema to choose supported actions, resource types, and grant scopes. Finally, view the role permission view and prepare the complete change based on the current policy state.

Prepare a personal access token with the required permissions for the target workspace and the target workspace ID.

Request parameters¶

Input example

curl -X PUT "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/application-policy" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d "{
    \"schema_version\": \"$SCHEMA_VERSION\",
    \"expected_policy_version\": 1,
    \"expected_role_lifecycle_version\": 1,
    \"request_id\": \"req-001\",
    \"statements\": [
      {
        \"action_id\": \"workflow.read\",
        \"resource_type\": \"workflow\",
        \"scope_mode\": \"all\"
      }
    ]
  }"

Parameter description

Path parameters

Parameter	Type	Required	Description
`workspace_id`	string	Yes	Target workspace ID.
`role_id`	string	Yes	ID of the role whose policy is updated.

Request body

Parameter	Type	Required	Description
`schema_version`	string	Yes	Version of the permission schema used by this policy.
`expected_policy_version`	integer	No	Policy version used for concurrency checks; cannot be less than 0.
`expected_role_lifecycle_version`	integer	Yes	Current role lifecycle version; must be greater than 0.
`request_id`	string	Yes	Caller-generated idempotency request ID.
`statements`	object array	Yes	Complete policy statements to save. An empty array saves an empty policy.
`statements[].statement_id`	string	No	Statement ID. The service generates one when omitted.
`statements[].action_id`	string	Yes	Action ID in the permission schema.
`statements[].resource_type`	string	Yes	Resource type that matches the action.
`statements[].scope_mode`	string	Yes	Resource scope: `all` or `resources`.
`statements[].resource_id`	string	No	Resource ID used when `scope_mode` is `resources`.
`statements[].condition_hash`	string	No	Hash of the condition expression.
`statements[].target_action_id`	string	No	Target action ID when granting a permission.
`statements[].grant_scope_mode`	string	No	Delegable scope: `all` or `resources`.
`statements[].grant_delegatable`	boolean	No	Whether further delegation is allowed.

Successful response¶

On success, the policy is saved as requested and a new policy version is returned. Replaying the same request ID with identical content does not increment the version again.

Response example

{
  "code": "OK",
  "msg": "OK",
  "data": {
    "role_id": "role-001",
    "policy_version": 2,
    "idempotent_replay": false,
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}

Field details

Field	Type	Description
`code`	string	`OK` on success.
`msg`	string	`OK` on success.
`data.role_id`	string	ID of the role whose policy was updated.
`data.policy_version`	integer	Policy version after saving.
`data.idempotent_replay`	boolean	Whether this is an idempotent replay of the same request.
`data.request_id`	string	Request correlation ID.
`data.trace_id`	string	Trace ID.

Error response¶

Response example

{
  "code": "ErrParamInvalid",
  "msg": "Invalid request parameters",
  "data": null
}

Field details

Field	Type	Description
`code`	string	Error code.
`msg`	string	Error message.
`data`	null	—

Last updated on Sep 3, 2026