Role binding and temporary grant API

Creates a scoped role binding for a principal.

Requires access:write. Send principal with type and ID, role_id, and a supported scope object. Returns 201 with binding ID and revision.

To bind the platform team to the payments project, send this body:

{
  "principal": { "type": "team", "id": "team_platform" },
  "role_id": "role_project_operator",
  "scope": { "type": "project", "id": "prj_payments" }
}

An invalid scope or a role the caller cannot delegate returns 403 or 422 without an effective grant. Bindings combine permissions; there is no implicit deny created by adding a narrower role.

Removes the selected role binding.

Requires the binding ETag in If-Match. Removes that grant, not other independent bindings for the principal.

Creates a temporary grant request awaiting approval.

Send principal, role, scope, required reason, and expires_at. The expiry must be in the future and within organization policy. Returns 201 with grant ID and awaiting_approval; the grant does not authorize requests before approval.

Approves the selected temporary grant revision.

Requires access:approve, the grant ETag, and approver eligibility. Self-approval is rejected under default policy. A stale or expired request cannot be approved.

Lists visible role bindings with standard pagination. Requires access:read.

Returns the temporary grant state and review details.

Requires access:read within the relevant administrative scope. Grant states are awaiting_approval, active, rejected, expired, or revoked. The result includes authoritative expiry and review actor.

Simulates a principal's effective access without performing the action.

Requires authorized access review and accepts principal, resource ID, action, and optional API-key ID. It returns the contributing bindings and unmet policy conditions without performing the action.

Revokes a temporary grant for subsequent requests.

Requires the current ETag and a reason. Revocation prevents new actions relying on that grant. It does not terminate guest shells or cancel accepted operations automatically.

For emergency cleanup, follow grant expiry and revocation to cancel eligible operations and revoke managed console connections. Use Simulate access to check whether another binding still authorizes the principal.

Returns principal, role, scope, revision, and effective binding state. A missing or invisible binding returns 404.