| 方法 | 路径 | 摘要 | 认证 |
|---|---|---|---|
| GET | /v1/custom-rbac/grants | Page through active or revoked custom-role grants | 登录会话 |
| POST | /v1/custom-rbac/grants | Assign the current role revision to another active tenant member | 登录会话 |
| POST | /v1/custom-rbac/grants/{grant_id}/revoke | Append a custom-role grant revocation fact | 登录会话 |
| GET | /v1/custom-rbac/permissions | List the tenant-delegable permission catalog | 登录会话 |
| GET | /v1/custom-rbac/roles | Page through custom roles in the authenticated tenant scope | 登录会话 |
| POST | /v1/custom-rbac/roles | Create a custom role and its first immutable revision | 登录会话 |
| GET | /v1/custom-rbac/roles/{role_id} | Get a custom role in the authenticated tenant scope | 登录会话 |
| POST | /v1/custom-rbac/roles/{role_id}/deactivate | Deactivate a custom role with compare-and-swap | 登录会话 |
| POST | /v1/custom-rbac/roles/{role_id}/publish | Publish a new permission revision with compare-and-swap | 登录会话 |
| POST | /v1/custom-rbac/roles/{role_id}/rename | Rename a custom role with revision compare-and-swap | 登录会话 |
契约文件：api/control-custom-rbac.openapi.yaml