Set permissions

/v1/workflows/{id}/permissions

Each field present replaces the stored one; absent fields stay (budgets: null clears a cap). locks can be set only by a team admin over the workflow (project owner or admin, company owner or admin) — anyone else gets 403 and nothing is written.

Authorizations

Authorizationstringheaderrequired

Bearer token: Authorization: Bearer ozk_…. ozk_ platform API key (Authorization: Bearer ozk_…)

Path parameters

idstringrequired

Saved workflow id (a bot you own)

Body

application/json
text/yaml

classesobject

Stored preset per permission class; a class absent here falls back to the bot YAML / default

locksenum<string>[]

Admin locks: a locked class forces the bot’s own allow up to ask

budget_usd_runnumber | null

Per-run spend cap in USD; null = none

Required range: x >= 0

budget_usd_monthnumber | null

Monthly spend cap in USD; null = none

Required range: x >= 0

Response

The policy now stored Response format negotiates via the format field, an Accept header (application/json, text/yaml, text/markdown, text/plain), or the request Content-Type mirror; default JSON.

application/json
text/yaml
text/markdown
text/plain

classesobject

Stored preset per permission class; a class absent here falls back to the bot YAML / default

locksenum<string>[]

Admin locks: a locked class forces the bot’s own allow up to ask

budget_usd_runnumber | null

Per-run spend cap in USD; null = none

Required range: x >= 0

budget_usd_monthnumber | null

Monthly spend cap in USD; null = none

Required range: x >= 0

invalid_json — body is not valid JSON or YAML; invalid_format — format must be one of json, yaml, markdown, text

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

unauthorized — missing, invalid or revoked ozk_ key

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

lock_admin_required — only a team admin over the workflow can set locks; nothing was written

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

workflow_not_found — no saved workflow with that id for this account (foreign and missing ids answer alike); not_found — no route for this method on this path: every other method answers it

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

invalid_params — a field failed validation; nothing was written

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

import os import requests response = requests.put( "https://api.plungeai.com/v1/workflows/{id}/permissions", headers={"Authorization": f"Bearer {os.environ['PLUNGE_API_KEY']}"}, json={}, ) if not response.ok: raise SystemExit(f"{response.status_code} {response.headers.get('X-Error-Code')}") print(response.json())

const response = await fetch('https://api.plungeai.com/v1/workflows/{id}/permissions', { method: 'PUT', headers: { Authorization: `Bearer ${process.env.PLUNGE_API_KEY}`, 'Content-Type': 'application/json', }, body: JSON.stringify({}), }) if (!response.ok) throw new Error(`${response.status} ${response.headers.get('X-Error-Code')}`) console.log(await response.json())

import java.net.URI; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; public class Main { public static void main(String[] args) throws Exception { HttpClient client = HttpClient.newHttpClient(); HttpRequest request = HttpRequest.newBuilder() .uri(URI.create("https://api.plungeai.com/v1/workflows/{id}/permissions")) .header("Authorization", "Bearer " + System.getenv("PLUNGE_API_KEY")) .header("Content-Type", "application/json") .PUT(HttpRequest.BodyPublishers.ofString("{}")) .build(); HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString()); if (response.statusCode() >= 400) { System.out.println(response.statusCode() + " " + response.headers().firstValue("X-Error-Code").orElse("")); return; } System.out.println(response.body()); } }

Authorizations

Path parameters

Body

Response

Planned: TI-33

Planned: TI-34