Skip to content
CCS Chat Docs

Replace a role's Chat capabilities in one context

PUT
/api/v1/tenants/{tenant_id}/admin/role-permissions/{role_id}
curl --request PUT \
  --url https://chat.centralcodestation.com/api/v1/tenants/example/admin/role-permissions/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "capabilities": [ "conversations.read", "messages.read", "messages.send", "messages.update" ] }'

Stored at the Identity Server. tenant_owner is locked (400).

Administration in the guides

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
role_id
required
string

An Identity Server role id.

tenant_id
required
string

The Identity Server tenant id.

Query Parameters

Section titled “Query Parameters”
application_id
string

A chat-enabled tenant application; omit for the tenant-wide mapping.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
capabilities
required

The complete set of Chat capabilities the role grants in this context.

Array<string>

Example 

{
  "capabilities": [
    "conversations.read",
    "messages.read",
    "messages.send",
    "messages.update"
  ]
}

Responses

Section titled “Responses”

200

Section titled “200”

Success.

Media typeapplication/json
object
role_id
required
string
role
required
string
display_name
required
string
nullable
role_scope
required
string
Allowed values: tenant application
system
required
boolean
locked
required

True for tenant_owner: holds every capability, not editable.

boolean
capabilities
required
Array<string>

Example 

{
  "role_id": "role-coach",
  "role": "coach",
  "display_name": "Coach",
  "role_scope": "application",
  "system": false,
  "locked": false,
  "capabilities": [
    "conversations.read",
    "messages.read",
    "messages.send",
    "messages.update"
  ]
}

400

Section titled “400”

Error. error is one of: invalid_request, role_locked.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 400,
  "error": "invalid_request",
  "message": "The request is malformed: a required field is missing, a value has the wrong type or format, or a field the route does not accept was sent",
  "path": "/api/v1/tenants/fitness/applications/fitness-app/conversations",
  "timestamp": "2026-10-14T09:30:00.000Z"
}

401

Section titled “401”

Error. error is one of: invalid_token, token_revoked.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 401,
  "error": "invalid_token",
  "message": "The bearer token is missing, malformed, expired, signed by an unknown key, has the wrong audience (`aud` must be `chat-api`), or lacks the required scope.",
  "path": "/api/v1/tenants/fitness/applications/fitness-app/conversations",
  "timestamp": "2026-10-14T09:30:00.000Z"
}

403

Section titled “403”

Error. error is one of: not_tenant_member, no_application_access, tenant_not_available, insufficient_scope, client_context_mismatch, missing_capability, principal_not_allowed.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 403,
  "error": "not_tenant_member",
  "message": "The user is not an active member of the tenant in the URL.",
  "path": "/api/v1/tenants/fitness/applications/fitness-app/conversations",
  "timestamp": "2026-10-14T09:30:00.000Z"
}

404

Section titled “404”

Error. error is one of: not_found, role_not_found.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 404,
  "error": "not_found",
  "message": "The resource does not exist, or belongs to another tenant or application",
  "path": "/api/v1/tenants/fitness/applications/fitness-app/conversations",
  "timestamp": "2026-10-14T09:30:00.000Z"
}

429

Section titled “429”

Error. error is one of: rate_limited.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 429,
  "error": "rate_limited",
  "message": "The caller exceeded a rate limit",
  "path": "/api/v1/tenants/fitness/applications/fitness-app/conversations",
  "timestamp": "2026-10-14T09:30:00.000Z"
}

503

Section titled “503”

Error. error is one of: identity_unavailable.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 503,
  "error": "identity_unavailable",
  "message": "Chat could not reach the Identity Server and has no fresh cached answer.",
  "path": "/api/v1/tenants/fitness/applications/fitness-app/conversations",
  "timestamp": "2026-10-14T09:30:00.000Z"
}

default

Section titled “default”

Error — see error for the code.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit body_too_long query_too_short query_too_long user_required invalid_json invalid_id_token invalid_redirect_uri too_many_attachments role_locked invalid_grant invalid_token token_revoked missing_capability insufficient_scope not_tenant_member no_application_access tenant_not_available not_conversation_member client_context_mismatch principal_not_allowed system_message_not_allowed chat_access_not_granted not_found application_not_found role_not_found payload_too_large target_user_not_eligible actor_not_member conversation_archived direct_conversation_immutable invalid_reply rate_limited server_error identity_unavailable
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 403,
  "error": "invalid_request",
  "message": "Missing Chat capability messages.send",
  "path": "/api/v1/tenants/t1/applications/a1/conversations"
}