Update a grant's role and scope

PUT 
/rbac/grants/:identifier

Full-replace (PUT) semantics: atomically replaces both the role and scope with the values supplied. To update only one dimension, resend the current value for the other.

Guards:

• Only Admins may mutate Admin grants (old role = Admin or new role = Admin requires the caller to hold an Admin grant).
• Demoting the entity's last Admin is rejected (RBAC_CANNOT_REVOKE_LAST_OWNER).
• Admin role cannot be given a non-empty scope (RBAC_SCOPED_OWNER_FORBIDDEN).
• Sub-account IDs must all belong to the entity (RBAC_SUB_ACCOUNT_NOT_IN_ENTITY).

Returns a flat RbacGrantForDisplay (same shape as POST). Sends an access-updated notification email to the recipient.

Requires GRANT_UPDATE permission.

Request

Responses

200

Grant updated

400

Validation error (invalid UUID, scope exceeds 500)

401

Missing/invalid JWT or entity selection

403

GRANT_UPDATE permission missing, or caller is not an Admin when mutating an Admin grant (RBAC_PERMISSION_DENIED)

404

Grant or role not found (RBAC_GRANT_NOT_FOUND / RBAC_ROLE_NOT_FOUND)

409

RBAC_GRANT_ALREADY_REVOKED — grant is soft-deleted; RBAC_CANNOT_REVOKE_LAST_OWNER — demoting entity's last Admin; RBAC_SCOPED_OWNER_FORBIDDEN — Admin role with non-empty scope; RBAC_SUB_ACCOUNT_NOT_IN_ENTITY — publicId not in entity