Skip to main content
PUT
Update Workspace Group

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Workspace keys must allow every workspace checked by the request. OAuth access depends on the user’s roles and resource access.
  • Default request: With a user OAuth token, setting custom_role_id also requires Edit Workspace Settings on the workspace.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

team_id
string
required
group_id
string
required

Body

application/json
role
enum<string>

The built-in role this group's members get on the workspace. Required unless custom_role_id is set; then it may be omitted, and if given it must equal that custom role's base role. Other grants on the workspace — other groups' bindings and direct user memberships — are left untouched. One binding row carries exactly one grant, so a built-in role replaces whatever this group held on this workspace, including a custom role.

Available options:
TEAM_USER_ROLE_UNSPECIFIED,
TEAM_USER_ROLE_AGENT,
TEAM_USER_ROLE_MANAGER,
TEAM_USER_ROLE_BUILDER,
TEAM_USER_ROLE_VIEWER,
TEAM_USER_ROLE_CONTRIBUTOR,
TEAM_USER_ROLE_DRAFTER,
TEAM_USER_ROLE_READONLY_AGENT,
TEAM_USER_ROLE_APP_BUILDER,
TEAM_USER_ROLE_APP_VIEWER,
TEAM_USER_ROLE_PERSONAL_TEAM_OWNER
id
string

Composite identifier ({team_id}:{group_id}). Alternative to team_id + group_id.

customRoleId
string | null

Bind the group to one of this workspace's custom roles instead of a plain built-in role. The binding's role is pinned to the custom role's base role. Requires custom roles to be enabled for the organization.

Response

200 - application/json

Success

data
data · object