> ## Documentation Index > Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update API token roles > Update Workspace and Organization roles for an API token. ## OpenAPI ````yaml /astro/api/v-1/openapi.yaml post /organizations/{organizationId}/tokens/{tokenId}/roles openapi: 3.0.3 info: contact: {} description: Astro Platform API title: Astro Platform API version: v1.0 servers: - url: https://api.astronomer.io/v1 security: - JWT: [] tags: - description: >- The `organization` object contains the metadata and configurations of an Astro Organization. It does not include objects within the Organization, such as users and clusters. Make requests to `organization` endpoints to view and update high level settings for your Organization, including settings related to authentication and billing. To manage resources within an Organization, make requests to the endpoints related to those resources, such as `users`. See [Billing](https://astronomer.io/docs/astro/manage-billing), [Set up single sign-on](https://astronomer.io/docs/astro/configure-idp), and [Manage domains](https://astronomer.io/docs/astro/manage-domains). name: Organization - description: >- The `deployment` object represents an Astro Deployment, which is a hosted Airflow environment that is powered by all core Airflow components, including schedulers and workers. Make requests to the `deployment` object to create, update, or delete a Deployment or its computational resources. See [Deployment settings](https://astronomer.io/docs/astro/deployment-settings). name: Deployment - description: >- A `cluster` object represents an Astro cluster, which is a Kubernetes cluster that hosts the infrastructure required to run Deployments. Make requests to `cluster` endpoints to manage your standard and dedicated clusters. See [Create a dedicated cluster](https://astronomer.io/docs/astro/create-dedicated-cluster). name: Cluster - description: >- The `workspace` object represents an Astro Workspace, which is a collection of Deployments that can be accessed by a specific group of users. It contains metadata about a Workspace, but does not contain objects within the Workspace such as users and Deployments. Make requests to `workspace` endpoints to manage high level details about your Workspace. To manage resources within a Workspace, make requests to the endpoints related to those resources, such as `users`, and use the `workspaceIds` parameter to filter results by Workspace. See [Configure Workspaces](https://astronomer.io/docs/astro/manage-workspaces). name: Workspace - description: >- The `user` object represents a user account in your Astro Organization. Astro creates a new `user` object whenever you invite a user by email or add a user to Astro through an identity provider. The object contains all information about a user, including their personal information, roles, and login attempts. It doesn't include attributes for actions that the user completes after they log in, such as updating a Deployment. Make requests to `user` endpoints to manage permissions for existing users both at the Organization and Workspace level. To create new users, make requests to `invite` endpoints instead. name: User - description: >- The `team` object represents an Astro Team, which is a group of users that share the same permissions across your Organization and Workspaces. Make requests to `team` endpoints to create, update, and delete Teams across an Organization. See [Configure Teams on Astro](https://astronomer.io/docs/astro/manage-teams). name: Team - description: >- The `apitoken` object represents a single API token within your Organization. API tokens are used to authenticate automated tools and processes to your Organization. They have varying levels of access to your resources based on their Organization, Workspace, and Deployment roles. See [Workspace API tokens](workspace-api-tokens.md) and [Organization API tokens](organization-api-tokens.md). name: api-token x-group: API Token - name: allowed-ip-address-range x-group: Allowed IP Address Range - name: agent-token x-group: Agent Token paths: /organizations/{organizationId}/tokens/{tokenId}/roles: post: tags: - api-token summary: Update API token roles description: Update Workspace and Organization roles for an API token. operationId: UpdateApiTokenRoles parameters: - description: The ID of the Organization where you want to update an API token. in: path name: organizationId required: true schema: type: string - description: The API token you want to update. in: path name: tokenId required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateApiTokenRolesRequest' description: The request body for updating a token. required: true x-originalParamName: body responses: '200': content: application/json: schema: $ref: '#/components/schemas/SubjectRoles' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/Error' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/Error' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/Error' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/Error' description: Internal Server Error security: - JWT: [] components: schemas: UpdateApiTokenRolesRequest: properties: roles: description: The roles of the API token, including DAG roles. items: $ref: '#/components/schemas/ApiTokenRole' minItems: 1 type: array required: - roles type: object SubjectRoles: properties: dagRoles: description: A list of the subject's DAG roles. items: $ref: '#/components/schemas/DagRole' type: array deploymentRoles: description: >- A list of the subject's Deployment roles. Currently only for API tokens. items: $ref: '#/components/schemas/DeploymentRole' type: array organizationRole: description: The subject's Organization role. example: >- ORGANIZATION_OWNER,ORGANIZATION_OBSERVE_ADMIN,ORGANIZATION_OBSERVE_MEMBER,ORGANIZATION_BILLING_ADMIN,ORGANIZATION_MEMBER type: string workspaceRoles: description: A list of the subject's Workspace roles. items: $ref: '#/components/schemas/WorkspaceRole' type: array type: object Error: properties: fieldErrors: description: >- FieldErrors carries one entry per failed request-validation constraint. Only present on 400 responses caused by request binding/validation. items: $ref: '#/components/schemas/FieldValidationError' type: array message: type: string requestId: type: string statusCode: maximum: 600 minimum: 400 type: integer required: - message - requestId - statusCode type: object ApiTokenRole: properties: deploymentId: description: >- Required when EntityType is DAG or TAG. The deployment containing the DAG. example: clm8t5u4q000008jq4qoc3031 type: string entityId: description: >- The ID of the entity. For DAG roles, this is the DAG ID. For TAG roles, this is the tag value. example: clm8sgvai000008l794psbkdv type: string entityType: description: The type of the entity. enum: - DEPLOYMENT - WORKSPACE - ORGANIZATION - DAG - DAG_TAG example: WORKSPACE type: string role: description: The role of the API token. example: WORKSPACE_MEMBER type: string required: - entityId - entityType - role type: object DagRole: properties: dagId: description: The DAG ID. Required if Tag is not specified. example: my_dag type: string dagTag: description: The DAG tag. Required if DagId is not specified. example: team-a type: string deploymentId: description: The Deployment ID containing the DAG. example: clm8t5u4q000008jq4qoc3031 type: string role: description: The role name (DAG_VIEWER, DAG_AUTHOR, or custom DAG role). example: DAG_VIEWER type: string required: - deploymentId - role type: object DeploymentRole: properties: deploymentId: description: The Deployment ID. example: clm8t5u4q000008jq4qoc3031 type: string role: description: The name of the role for the subject in the Deployment. example: DEPLOYMENT_ADMIN type: string required: - deploymentId - role type: object WorkspaceRole: properties: role: description: The role of the subject in the Workspace. enum: - WORKSPACE_OWNER - WORKSPACE_OPERATOR - WORKSPACE_AUTHOR - WORKSPACE_MEMBER - WORKSPACE_ACCESSOR example: WORKSPACE_MEMBER type: string workspaceId: description: The Workspace ID. example: clm8t5u4q000008jq4qoc3036 type: string required: - role - workspaceId type: object FieldValidationError: properties: code: type: string field: type: string message: type: string required: - code - field - message type: object securitySchemes: JWT: scheme: bearer type: http ````