# Apply application permission policy

```{raw} html
<div class="mo-api-page-show-toc" aria-hidden="true"></div>
```

Save the complete application permission policy for a role. Saving replaces the role's existing application permission policy, so confirm the policy content and role status first.

```text
PUT https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/application-policy
```

## Preparation before calling

First [select a role](../roles/list-roles.md#select-a-role) and confirm that its policy can be modified. Then [view the permission schema](get-permission-schema.md#select-policy-inputs) to choose supported actions, resource types, and grant scopes. Finally, [view the role permission view](../roles/get-role-permission-view.md#confirm-the-current-policy-state) and prepare the complete change based on the current policy state.

Prepare a [personal access token](../../../../../guides/genesis/api-keys.md) with the required permissions for the target workspace and the [target workspace ID](../../../../../guides/ai-studio/resource-center/workspace.md#copy-a-workspace-id).

## Request parameters

:::::::{div} mo-api-tabs
::::::{tab-set}
:::::{tab-item} Input example

```bash
curl -X PUT "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/application-policy" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d "{
    \"schema_version\": \"$SCHEMA_VERSION\",
    \"expected_policy_version\": 1,
    \"expected_role_lifecycle_version\": 1,
    \"request_id\": \"req-001\",
    \"statements\": [
      {
        \"action_id\": \"workflow.read\",
        \"resource_type\": \"workflow\",
        \"scope_mode\": \"all\"
      }
    ]
  }"
```

:::::
:::::{tab-item} Parameter description

### Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | string | Yes | Target workspace ID. |
| `role_id` | string | Yes | ID of the role whose policy is updated. |

### Request body

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `schema_version` | string | Yes | Version of the permission schema used by this policy. |
| `expected_policy_version` | integer | No | Policy version used for concurrency checks; cannot be less than 0. |
| `expected_role_lifecycle_version` | integer | Yes | Current role lifecycle version; must be greater than 0. |
| `request_id` | string | Yes | Caller-generated idempotency request ID. |
| `statements` | object array | Yes | Complete policy statements to save. An empty array saves an empty policy. |
| `statements[].statement_id` | string | No | Statement ID. The service generates one when omitted. |
| `statements[].action_id` | string | Yes | Action ID in the permission schema. |
| `statements[].resource_type` | string | Yes | Resource type that matches the action. |
| `statements[].scope_mode` | string | Yes | Resource scope: `all` or `resources`. |
| `statements[].resource_id` | string | No | Resource ID used when `scope_mode` is `resources`. |
| `statements[].condition_hash` | string | No | Hash of the condition expression. |
| `statements[].target_action_id` | string | No | Target action ID when granting a permission. |
| `statements[].grant_scope_mode` | string | No | Delegable scope: `all` or `resources`. |
| `statements[].grant_delegatable` | boolean | No | Whether further delegation is allowed. |

:::::
::::::
:::::::

## Successful response

On success, the policy is saved as requested and a new policy version is returned. Replaying the same request ID with identical content does not increment the version again.

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "code": "OK",
  "msg": "OK",
  "data": {
    "role_id": "role-001",
    "policy_version": 2,
    "idempotent_replay": false,
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | `OK` on success. |
| `msg` | string | `OK` on success. |
| `data.role_id` | string | ID of the role whose policy was updated. |
| `data.policy_version` | integer | Policy version after saving. |
| `data.idempotent_replay` | boolean | Whether this is an idempotent replay of the same request. |
| `data.request_id` | string | Request correlation ID. |
| `data.trace_id` | string | Trace ID. |

:::::
::::::
:::::::

## Error response

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "code": "ErrParamInvalid",
  "msg": "Invalid request parameters",
  "data": null
}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | Error code. |
| `msg` | string | Error message. |
| `data` | null | — |

:::::
::::::
:::::::