Address GroupsUpdate a folder grant

Update a folder grant

Changes the permissions of an existing grant. Accepts role (viewer|contributor), which sets view/transfer as a whole, or individual legacy flags. canCreateAddress isn't part of the role and is changed separately. The response contains role.

curl -X PATCH "https://policy-engine-rest.ezig.workers.dev/api/v1/vaults/demo_vault/address-groups/example_string/grants/example_string" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
  "role": "viewer",
  "canView": true,
  "canTransfer": true,
  "canCreateAddress": true
}'
{
  "id": "cmr3f41z20001psp7phmyapw3",
  "vaultId": "example_string",
  "subjectType": "user",
  "subjectUserId": "example_string",
  "subjectGroupId": "example_string",
  "targetType": "address",
  "targetAddressId": "123 Main St",
  "targetGroupId": "example_string",
  "role": "viewer",
  "canView": true,
  "canTransfer": true,
  "canCreateAddress": true,
  "grantorId": "example_string",
  "status": "active",
  "createdAt": "2026-07-02T11:25:15.134000Z",
  "updatedAt": "2026-07-02T11:25:15.134000Z",
  "subject": {
    "id": "example_string",
    "name": "John Doe",
    "username": "John Doe",
    "image": "example_string",
    "color": "example_string",
    "emoji": "example_string"
  },
  "subjectGroup": {
    "id": "example_string",
    "name": "John Doe"
  }
}
PATCH
/api/v1/vaults/{code}/address-groups/{id}/grants/{grantId}
PATCH
Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token
Bearer Tokenstring
Required

Session token. Mobile/services. The web uses a cookie.

Session token. Mobile/services. The web uses a cookie.
API Key (cookie: session_token)
session_tokenstring
Required

API key (sent in cookie)

Content-Typestring
Required

The media type of the request body

Options: application/json
rolestring

viewer sees the address, balances, and history; contributor can additionally INITIATE transfers. IMPORTANT: contributor means access, not a guarantee. The transfer still goes through policies and can be forbidden or sent for signing. There is no "manager" role: the manager is the object's creator, there's always exactly one, and it isn't granted. That's why the permission to create addresses in a shared folder isn't granted either: it's a property of ownership

Options: viewer, contributor
canCreateAddressboolean

A separate permission to "create NEW addresses in this folder." It isn't part of the role: the role describes access to what's already in the folder

Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token. Session token. Mobile/services. The web uses a cookie.

path
parameterstring
Required

API Key for authentication. Provide your API key in the cookie.

Path Parameters

codestring
Required

Unique Vault code (slug)

Example:
demo_vault

Body

application/json
rolestring

viewer sees the address, balances, and history; contributor can additionally INITIATE transfers.

IMPORTANT: contributor means access, not a guarantee. The transfer still goes through policies and can be forbidden or sent for signing.

There is no "manager" role: the manager is the object's creator, there's always exactly one, and it isn't granted. That's why the permission to create addresses in a shared folder isn't granted either: it's a property of ownership

Allowed values:viewercontributor
canCreateAddressboolean

A separate permission to "create NEW addresses in this folder." It isn't part of the role: the role describes access to what's already in the folder

Responses

idstring
Required

cuid

vaultIdstring
Required
subjectTypestring
Required
Allowed values:usergroup
subjectUserIdstring
Required
subjectGroupIdstring
Required
targetTypestring
Required
Allowed values:addressaddress_group
targetAddressIdstring
Required
targetGroupIdstring
Required
rolestring
Required

viewer sees the address, balances, and history; contributor can additionally INITIATE transfers.

IMPORTANT: contributor means access, not a guarantee. The transfer still goes through policies and can be forbidden or sent for signing.

There is no "manager" role: the manager is the object's creator, there's always exactly one, and it isn't granted. That's why the permission to create addresses in a shared folder isn't granted either: it's a property of ownership

Allowed values:viewercontributor
canViewboolean
Required
canTransferboolean
Required
canCreateAddressboolean
Required

Deprecated: this permission isn't granted, always false for new grants

grantorIdstring
Required
statusstring
Required
Allowed values:activerevoked
createdAtstring
Required
updatedAtstring
Required
subjectstring

User subject card (null for a group)

subjectGroupstring