| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/custom-rbac/grants | Page through active or revoked custom-role grants | Session |
| POST | /v1/custom-rbac/grants | Assign the current role revision to another active tenant member | Session |
| POST | /v1/custom-rbac/grants/{grant_id}/revoke | Append a custom-role grant revocation fact | Session |
| GET | /v1/custom-rbac/permissions | List the tenant-delegable permission catalog | Session |
| GET | /v1/custom-rbac/roles | Page through custom roles in the authenticated tenant scope | Session |
| POST | /v1/custom-rbac/roles | Create a custom role and its first immutable revision | Session |
| GET | /v1/custom-rbac/roles/{role_id} | Get a custom role in the authenticated tenant scope | Session |
| POST | /v1/custom-rbac/roles/{role_id}/deactivate | Deactivate a custom role with compare-and-swap | Session |
| POST | /v1/custom-rbac/roles/{role_id}/publish | Publish a new permission revision with compare-and-swap | Session |
| POST | /v1/custom-rbac/roles/{role_id}/rename | Rename a custom role with revision compare-and-swap | Session |
Contract file：api/control-custom-rbac.openapi.yaml