`POST /api/keys/acl/update`

Amend an existing ACL entry to a given rights mask.

Amends an entry, then re-reads and verifies with the same mask test as grant. Use this rather than revoke to REDUCE a principal to fewer rights: send the mask you want it to end up with.

Everything said about grant -- the mask test, the widening, the stamps, the read-back -- applies here unchanged.

Authentication

Send the session id as Authorization: Bearer <session id>, and an RFC 9449 DPoP proof in the DPoP header if your session is bound to a key. The two are required together, not as alternatives — see Authenticating and Proving you hold your key.

This surface sets no cookie

There is no session cookie on any response and none is read on any request. Do not set credentials: "include" on a browser fetch.

Request

Field	Type	Required	Description
`ttag`	`string`	yes	Canonical base64 hidden link naming the key. Required, and a zero-length one is refused: it names no key and is not a wildcard.
`systemId`	`integer`	yes	The one field on an ACL entry that is a NUMBER rather than an 8-byte value. Read it from the server; a wrong one addresses a principal that does not exist.
`principalId`	`integer` or `string`	yes	A non-negative integer, or a DECIMAL STRING for an id above 2^53. This is the same spelling `POST /api/keys/export` takes and the same spelling this surface projects.
`rights`	`variant` or `variant`	yes	The rights to grant, as a bitmask or as names. The key server WIDENS what you send, so the response reports the requested mask and the observed one separately.
`maxUsage`	`integer`	no	Omit for no limit. Anything below -1 is refused here because the underlying setter throws synchronously, which would reach you as a `500` rather than as a bad request.
`startTime`	`string`	no	base64 of EXACTLY 8 bytes -- a raw stamp, not a date string and not a number; there is no conversion on this field. Omit to send the eight zero bytes that mean "unset".
`endTime`	`string`	no	base64 of exactly 8 bytes. Omit for "unset".

Example

{
  "ttag": "...",
  "systemId": 0,
  "principalId": 0,
  "rights": 0,
  "maxUsage": 0,
  "startTime": "...",
  "endTime": "..."
}

Responses

`200`

The amendment landed, verified by a fresh read.

Field	Type	Required	Description
`code`	`string`	no	Absent on success; `NOT_VERIFIED` when the read-back disagrees.
`operation`	`string`	no	Which key-server operation was sent.
`verified`	`boolean`	no
`requestedRights`	`integer` or `null`	no	Null on revoke, which takes no rights.
`requestedRightNames`	`array` or `null`	no
`entry`	`AclEntry` or `variant`	no	The matching entry from the fresh read, or null. Null is the SUCCESS case on revoke.
`acl`	`AclInfo`	no
`detail`	`string`	no

entry — AclEntry

Field	Type	Required	Description
`principalId`	`string`	no	Decimal string. Feeds straight back into the grant/update/revoke routes and into export.
`systemId`	`integer`	no
`aclEntryId`	`string`	no	base64 opaque handle
`aclId`	`string`	no	base64 opaque handle
`rights`	`integer`	no	The rights bitmask AS THE KEY SERVER HOLDS IT. The key server WIDENS what is asked for -- requesting WRITE reads back as WRITE\|READ -- so test this with a mask AND, never with equality.
`rightNames`	array of `string` (`OWNER`, `READ`, `WRITE`, `MANDATORY_GROUP`, `HOST_MATRIX`)	no
`maxUsage`	`integer`	no	-1 means no limit.
`userRight`	`integer`	no
`startTime`	`string`	no	base64 of the raw 8-byte stamp
`startTimeUnset`	`boolean`	no	True when the stamp is all zero -- the "no window" default, reported rather than converted into a date it does not mean.
`endTime`	`string`	no	base64 of the raw 8-byte stamp
`endTimeUnset`	`boolean`	no

AclInfo

Field	Type	Required	Description
`aclId`	`string`	no
`hiddenLink`	`object`	no	The hidden link as the key server reports it on the ACL object. Its shape is the key server's and is passed through unchanged; do not depend on it. Use the `ttag` you sent.
`expired`	`boolean`	no
`entryCount`	`integer`	no
`entries`	array of `AclEntry`	no	One ACL entry -- one principal's rights over one key.

Example

{
  "code": "...",
  "operation": "...",
  "verified": true,
  "requestedRights": 0,
  "requestedRightNames": [
    "..."
  ],
  "entry": {
    "principalId": "...",
    "systemId": 0,
    "aclEntryId": "...",
    "aclId": "...",
    "rights": 0,
    "rightNames": [
      "OWNER"
    ],
    "maxUsage": 0,
    "userRight": 0,
    "startTime": "...",
    "startTimeUnset": true,
    "endTime": "...",
    "endTimeUnset": true
  },
  "acl": {
    "aclId": "...",
    "hiddenLink": {},
    "expired": true,
    "entryCount": 0,
    "entries": [
      {
        "principalId": "...",
        "systemId": 0,
        "aclEntryId": "...",
        "aclId": "...",
        "rights": 0,
        "rightNames": [
          "..."
        ],
        "maxUsage": 0,
        "userRight": 0,
        "startTime": "...",
        "startTimeUnset": true,
        "endTime": "...",
        "endTimeUnset": true
      }
    ]
  },
  "detail": "..."
}

`400`

The request was refused before anything was sent to the key server.

Most 400s on this surface carry code: BAD_REQUEST and a detail naming the field and saying what the key server would otherwise have done with it. A large share of them exist because the value would have been ACCEPTED downstream and quietly meant something else -- an empty string that reaches the wire as "mint a new key", a zero-length identifier that names no object, a numeric flag word that clears bits the caller did not name.

`401`

No live session, or a DPoP proof that did not verify.

SESSION_NOT_FOUND -- the credential names no session this Gateway holds. SESSION_EXPIRED -- it aged out. Both carry reauth: true; obtain a new credential rather than retrying.

PROOF_* -- the sender constraint refused. See the DPoP section of this document for the full table; PROOF_MALFORMED is a 400 and PROOF_REPLAY_CACHE_FULL a 503, and the rest are here.

SCOPED_CREDENTIAL_EXPIRED -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces.

`403`

OBJECT_NOT_IN_CREDENTIAL_SCOPE or ACCESS_DENIED.

`404`

ACL_NOT_FOUND -- and no amendment was attempted.

`409`

NOT_VERIFIED -- the read-back does not show the requested rights.

`500`

A fault rather than a refusal.

OP_FAILED is the catch-all: the key server refused in words that match no classified pattern, so the Gateway cannot say more than that the operation did not happen. Some key server refusals that are conceptually a caller error arrive here rather than as a 4xx, because the wire carries no distinguishing code -- where a route can recognise one from its message it maps it, and each such mapping is documented on the operation.

`502`

READBACK_FAILED.

`503`

A capacity ceiling or a missing deployment prerequisite. retryable says which.

A scope of session or process names the ceiling that was hit, and the response carries Retry-After.

Error handling

Every failure answers JSON carrying at least code and detail. Match on code — detail is written for a human debugging the call and its wording is not part of the contract. See the error model.

Status	Meaning
`400`	The request was refused before anything was sent to the key server. Most `400`s on this surface carry `code: BAD_REQUEST` and a `detail` naming the field and saying what the key server would otherwise have done with it. A large share of them exist because the value would have been ACCEPTED downstream and quietly meant something else -- an empty string that reaches the wire as "mint a new key", a zero-length identifier that names no object, a numeric flag word that clears bits the caller did not name.
`401`	No live session, or a DPoP proof that did not verify. `SESSION_NOT_FOUND` -- the credential names no session this Gateway holds. `SESSION_EXPIRED` -- it aged out. Both carry `reauth: true`; obtain a new credential rather than retrying. `PROOF_*` -- the sender constraint refused. See the DPoP section of this document for the full table; `PROOF_MALFORMED` is a `400` and `PROOF_REPLAY_CACHE_FULL` a `503`, and the rest are here. `SCOPED_CREDENTIAL_EXPIRED` -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces.
`403`	`OBJECT_NOT_IN_CREDENTIAL_SCOPE` or `ACCESS_DENIED`.
`404`	`ACL_NOT_FOUND` -- and no amendment was attempted.
`409`	`NOT_VERIFIED` -- the read-back does not show the requested rights.
`500`	A fault rather than a refusal. `OP_FAILED` is the catch-all: the key server refused in words that match no classified pattern, so the Gateway cannot say more than that the operation did not happen. Some key server refusals that are conceptually a caller error arrive here rather than as a `4xx`, because the wire carries no distinguishing code -- where a route can recognise one from its message it maps it, and each such mapping is documented on the operation.
`502`	`READBACK_FAILED`.
`503`	A capacity ceiling or a missing deployment prerequisite. `retryable` says which. A `scope` of `session` or `process` names the ceiling that was hit, and the response carries `Retry-After`.

Authentication​

Request​

Responses​

200​

400​

401​

403​

404​

409​

500​

502​

503​

Error handling​