Apply application permission policy¶

Save the complete application permission policy for a role. Saving replaces the role’s existing application permission policy, so confirm the policy content and role status first.

HTTP
PUT $CLOUDSIGMA_API_BASE/workspaces/{workspace_id}/iam/roles/{role_id}/application-policy

Before you call this API¶

Configure the regional API endpoint and authentication, and select the target workspace.

First select a role and confirm that its policy can be modified. Then view the permission schema to choose supported actions, resource types, and grant scopes. Finally, view the role permission view and prepare the complete change based on the current policy state.

Request parameters¶

Input examples

Shell
curl -X PUT "$CLOUDSIGMA_API_BASE/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/application-policy" \
  -H "X-API-Key: $CLOUDSIGMA_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d "{
    \"schema_version\": \"$SCHEMA_VERSION\",
    \"expected_policy_version\": 1,
    \"expected_role_lifecycle_version\": 1,
    \"request_id\": \"req-001\",
    \"statements\": [
      {
        \"action_id\": \"workflow.read\",
        \"resource_type\": \"workflow\",
        \"scope_mode\": \"all\"
      }
    ]
  }"

Parameter description

Path parameters

Parameter	Type	Required	Description
`workspace_id`	string	Yes	Target workspace ID.
`role_id`	string	Yes	ID of the role whose policy is updated.

Request body

Parameter	Type	Required	Description
`schema_version`	string	Yes	Version of the permission schema used by this policy.
`expected_policy_version`	integer	No	Policy version used for concurrency checks; cannot be less than 0.
`expected_role_lifecycle_version`	integer	Yes	Current role lifecycle version; must be greater than 0.
`request_id`	string	Yes	Caller-generated idempotency request ID.
`statements`	object array	Yes	Complete policy statements to save. An empty array saves an empty policy.
`statements[].statement_id`	string	No	Statement ID. The service generates one when omitted.
`statements[].action_id`	string	Yes	Action ID in the permission schema.
`statements[].resource_type`	string	Yes	Resource type that matches the action.
`statements[].scope_mode`	string	Yes	Resource scope: `all` or `resources`.
`statements[].resource_id`	string	No	Resource ID used when `scope_mode` is `resources`.
`statements[].condition_hash`	string	No	Hash of the condition expression.
`statements[].target_action_id`	string	No	Target action ID when granting a permission.
`statements[].grant_scope_mode`	string	No	Delegable scope: `all` or `resources`.
`statements[].grant_delegatable`	boolean	No	Whether further delegation is allowed.

Successful response¶

On success, the policy is saved as requested and a new policy version is returned. Replaying the same request ID with identical content does not increment the version again.

Response example

JSON
{
  "code": "OK",
  "msg": "OK",
  "data": {
    "role_id": "role-001",
    "policy_version": 2,
    "idempotent_replay": false,
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}

Field details

Field	Type	Description
`code`	string	`OK` on success.
`msg`	string	`OK` on success.
`data.role_id`	string	ID of the role whose policy was updated.
`data.policy_version`	integer	Policy version after saving.
`data.idempotent_replay`	boolean	Whether this is an idempotent replay of the same request.
`data.request_id`	string	Request correlation ID.
`data.trace_id`	string	Trace ID.

Error response¶

Response example

JSON
{
  "code": "ErrParamInvalid",
  "msg": "Invalid request parameters",
  "data": null
}

Field details

Field	Type	Description
`code`	string	Error code.
`msg`	string	Error message.
`data`	null	—

Last updated on Sep 15, 2026