POST/api/v1/update-role-policies

Update a role's spending policy

Sets a new spending limit and reset cycle on one role in a workspace, changing the headroom of every member who holds that role there.

AccessRequires a permission in the workspaceMANAGE_ROLE

A role's policy is the cap on what each member holding the role can move in a cycle. This call replaces it. All five fields are required, so send the current cycle values again when you are only changing the limit, and read what is in force first with GET /api/v1/get-role-limit. The policy belongs to the role in the workspace you name, and roles are workspace-scoped: the same role name in another workspace keeps its own limit. See Roles and permissions.

Permissions are edited separately, with POST /api/v1/add-perm-to-role and POST /api/v1/remove-perm-from-role. This endpoint changes only the money side of the role.

This changes what every holder of the role can move

The new limit applies to every member holding this role in this workspace as soon as the call returns. Policies are enforced before the signing stage, so a movement over the limit is blocked and never reaches signers: lowering a limit can stop work the desk is in the middle of, and raising one widens what a single member can move before anyone approves it. Check who holds the role with GET /api/v1/get-users-from-workspace first, and see Vault policies for how role limits sit alongside vault limits.

Body parameters

role_idnumberrequired

The role whose policy to update, as returned in RoleUID by get-roles-and-perms-detailed.

workspace_idnumberrequired

The workspace the role belongs to. You must hold MANAGE_ROLE in it.

new_transaction_limitstringrequired

The role's new spending limit for one cycle, as a decimal string.

cycle_periodstringrequired

How often the role's usage counter resets. W for weekly or M for monthly.

cycle_daynumberrequired

The day the counter resets. Day of the week for a weekly cycle, day of the month for a monthly cycle.

bash

curl -X POST "$SQRL_API/api/v1/update-role-policies" \
  -H "authorization: Bearer $SQRL_TOKEN" \
  -H "content-type: application/json" \
  -d '{
        "role_id": 77,
        "workspace_id": 342,
        "new_transaction_limit": "75000.00",
        "cycle_period": "M",
        "cycle_day": 1
      }'

const res = await fetch(`${process.env.SQRL_API}/api/v1/update-role-policies`, {
  method: "POST",
  headers: {
    authorization: `Bearer ${process.env.SQRL_TOKEN}`,
    "content-type": "application/json",
  },
  body: JSON.stringify({
    role_id: 77,
    workspace_id: 342,
    new_transaction_limit: "75000.00",
    cycle_period: "M",
    cycle_day: 1,
  }),
});
const { Success } = await res.json();

rust

let res = client
    .post(format!("{}/api/v1/update-role-policies", api_base))
    .bearer_auth(&token)
    .json(&serde_json::json!({
        "role_id": 77,
        "workspace_id": 342,
        "new_transaction_limit": "75000.00",
        "cycle_period": "M",
        "cycle_day": 1,
    }))
    .send()
    .await?;

Response200 OK

{
"Success": true
}

#What happens next

Read the policy back with GET /api/v1/get-role-limit to confirm the stored values, and test a representative amount for a member with GET /api/v1/check-user-role-limit. Each member sees their own figures through GET /api/v1/get-my-limits, and the workspace list at GET /api/v1/get-users-from-workspace shows the new limit beside every holder of the role.

Was this page helpful?