Set Oauth Client Resource Grants
Replace one credential's instance-grant allow-list for one resource type.
The only writer of OAuthClientResourceGrant rows besides the auto-grant-on-create hook (see CreatableMixin.create) - without it a credential holding a scope but no grant rows reads nothing at all, which is the spec's deliberate default-deny state.
The supplied ids are not validated against the organisation: the org floor is enforced independently of and prior to instance grants (see the design spec's verification list), so a granted id belonging to another org still resolves to 404 for this credential.
A credential belonging to a different organisation is a 404, not a 403 - matching revoke_oauth_client's own opacity for the same case.
Authorization
OAuth2AuthorizationCodeBearer In: header
Path Parameters
uuiduuidQuery Parameters
trueRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Instance-grant allow-list for one resource type of one credential.
resource_ids is required and explicitly nullable, never defaulted -
per the spec, unrestricted must be a deliberate write:
null-> the unrestricted-within-org sentinel row,[]-> deny-all (zero rows for this pair),[...]-> allow-listed to exactly those instance ids.
Response Body
application/json
curl -X PUT "https://example.com/v1/organisations/497f6eca-6276-4993-bfeb-53cbbbba6f08/oauth-clients/497f6eca-6276-4993-bfeb-53cbbbba6f08/resource-grants" \ -H "Content-Type: application/json" \ -d '{ "resource": "string", "resource_ids": [ "f3aaf7b6-b51a-43c8-8627-9e1a7630b22a" ] }'{ "detail": [ { "loc": [ "string" ], "msg": "string", "type": "string" } ]}