Change the scopes of the current Admin's interactive system-managed connection.

PUT

/api/admin/agent-grants/{id}/self-service-scopes

Code sample: Shell / cURL

curl --request PUT \
  --url https://auth.example.com/api/admin/agent-grants/example/self-service-scopes \
  --header 'Content-Type: application/json' \
  --cookie authrim_admin_session=<authrim_admin_session> \
  --data '{ "scopes": [ "agent:read" ] }'

Human session only. The authenticated Admin must be both grantor and delegator. The server rechecks the public client’s registered scopes and the Admin’s live RBAC ceiling, generates a new immutable Task Set and masked single-tenant Scope Policy, replaces both consent records, increments Grant generation and consent version, and queues prior token families for revocation in one DB_ADMIN transaction.

Authorizations

• adminSessionCookie

Parameters

Path Parameters

id

required

string

/^aag_/

Agent Grant identifier.

Request Body ^required

Media type application/json

object

scopes

required

Array<string>

>= 1 items <= 3 items unique items

Allowed values: agent:read agent:user-data:read agent:write

key

additional properties

Responses

200

Current connection and whether its immutable authorization snapshot changed.

Media type application/json

object

grant

required

object

id

required

string

tenant_id

required

string

client_id

required

string

machine_principal_id

required

string | null

grantor_id

required

string

delegator_id

required

string

permissions

required

Array<string>

unique items

scopes

required

Array<string>

unique items

Allowed values: agent:read agent:user-data:read agent:write agent:execute agent:admin

authorization_details

Array<object> | null

object

key

additional properties

resolved_scope_constraints

required

object

key

additional properties

purpose

string | null

management_mode

required

System_managed identifies the immutable internal Grant generated by interactive self-service authorization; its Task Set and Scope Policy are not edited directly.

string

Allowed values: managed system_managed

consent_version

required

integer

>= 1

generation

required

integer

>= 1

status

required

string

Allowed values: active suspended revoked

delegation_mode

required

string

Allowed values: user_consent admin_pre_authorized task_approved

task_set_id

required

string | null

task_set_version

required

integer | null

>= 1

scope_policy_id

required

string | null

scope_policy_version

required

integer | null

>= 1

resolved_tools

required

Array<object> | null

object

key

additional properties

access_snapshot_hash

required

string | null

consent_current

Present on detail responses after both authorization records are checked.

boolean

expires_at

required

integer | null format: int64

last_used_at

required

integer | null format: int64

created_at

required

integer format: int64

updated_at

required

integer format: int64

revoked_at

required

integer | null format: int64

revoked_by

required

string | null

key

additional properties

changed

required

boolean

token_families_pending_revocation

integer

key

additional properties

Example

{
  "grant": {
    "scopes": [
      "agent:read"
    ],
    "management_mode": "managed",
    "status": "active",
    "delegation_mode": "user_consent"
  }
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

409

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}