Skip to main content
POST
Grant a record to a Service Account

Authorizations

Authorization
string
header
required

Human personal access token (sk-actrl-pat-...).

Headers

x-account-id
string<uuid>
required

Account scope used for permission resolution. It must own the target resource.

Idempotency-Key
string

Stable key for safely retrying this write. Reuse the same key only with the same request body; results are retained for 24 hours and conflicting reuse returns 409.

Path Parameters

id
string
required

Body

application/json
recordId
string<uuid>
required

Record shared with the Service Account.

wrappedDek
object
required

Record key encrypted for the Service Account.

saIdentityPublicKeyB64
string
required

Service Account public key used to encrypt the record key.

dekVersion
integer
required

Record DEK version read before opening its source wrapper.

Required range: x >= 1
sourceWrappedDek
object
required

Exact encrypted source wrapper opened by the client; never plaintext key material.

sourceProjectKeyVersion
integer

Required only when the source is the project copy; omit for an individual wrapper.

Required range: x >= 1

Response

Record granted to the Service Account.

ok
enum<boolean>
required
Available options:
true
data
object
required