Skip to main content
PUT
Add or update a tenant principal

Authorizations

Authorization
string
header
required

Firebase Auth JWT issued by Google Identity Platform. Obtain a token by signing in at your app domain and calling firebase.auth().currentUser.getIdToken().

Path Parameters

tenant_id
string
required

Tenant identifier.

principal_id
string
required

Principal ID in oidc:{projectId}#{uid} format.

Body

application/json
tenancy_role
enum<string> | null

Set to null to remove the tenancy role.

Available options:
account_admin,
billing_admin,
account_viewer
api_functional_role
enum<string> | null

Set to null to remove the data-access role.

Available options:
tenant_owner,
tenant_admin,
tenant_editor,
tenant_proposer,
tenant_reader
principal_type
enum<string>

Defaults to human on first upsert. Required when registering a service account or AI agent.

Available options:
human,
service_account,
ai_agent
allow_counterparty_access
boolean

Grants or revokes counterparty read access for this principal. Setting true requires the caller to have principal_type human.

Response

Principal updated or created.

tenant_id
string
principal_id
string
tenancy_role
enum<string> | null

Account-level role. Controls membership administration (adding/removing principals, billing).

Available options:
account_admin,
billing_admin,
account_viewer
api_functional_role
enum<string> | null

Data-access role. Controls what the principal may do with subjects and grants. Ranked hierarchy — higher rank implies lower-rank permissions.

Available options:
tenant_owner,
tenant_admin,
tenant_editor,
tenant_proposer,
tenant_reader
principal_type
enum<string>

The kind of principal. Defaults to human. Used to enforce human-only constraints (e.g. tenant_owner, allow_counterparty_access).

Available options:
human,
service_account,
ai_agent
allow_counterparty_access
boolean

When true, this principal may call counterparty-facing endpoints (accessible-subjects, grant-path snapshot reads). Defaults to false. May only be set to true by a human account_admin.

status
enum<string>
Available options:
active,
revoked
created_at
string<date-time>