Skip to main content
POST
Grant authority

Authorizations

Authorization
string
header
required

Clerk session JWT (deployments with Clerk auth) — validated per request (issuer + signature + lifetime + authorized-party). The internal Boardy tenant/member are resolved from the token's ACTIVE Clerk organization (org_id) → the Boardy tenant it maps to → this user's member in that tenant (#356). A token with no active organization is rejected; production never trusts spoofable X-Tenant-Id/X-Member-Id headers. The same normalized context backs the SPA, this OpenAPI surface, and MCP.

Headers

Idempotency-Key
string

AD-5 idempotency: a repeated mutation with the same key replays the prior result (no double-apply).

Path Parameters

id
string<uuid>
required

Body

application/json
verb
string
required
boardId
null | string<uuid>
required
docId
null | string<uuid>

Response

Created

id
string<uuid>
required
tenantId
string<uuid>
required
memberId
string<uuid>
required
verb
enum<string>
required
Available options:
Read,
Write,
Manage
boardId
null | string<uuid>
required
grantedBy
string<uuid>
required
createdAt
string<date-time>
required
target
enum<string>
default:Board
Available options:
Board,
Doc
scope
object
docId
null | string<uuid>