Changelog

Subaccount API — Deprecation of permissions object

The legacy permissions object in the PUT Subaccount endpoint is being deprecated and will no longer be supported for permission updates.

Effective date: May 5, 2026 (in two weeks)

What’s changing

The current permissions object (boolean-based) will be removed from the update flow. Permission updates must instead be made using the new explicit mutation fields:

• grant_permissions
• revoke_permissions

Why this change

This update introduces explicit and unambiguous permission handling, preventing accidental overwrites and making permission updates safer and more predictable as the permissions model expands.

What you need to do

If you are currently sending:

1
{
2
  "permissions": {
3
    "assistants": true,
4
    "actions": false
5
  }
6
}

You should migrate to:

1
{
2
  "grant_permissions": ["assistants"],
3
  "revoke_permissions": ["actions"]
4
}

Important notes

• Requests containing the legacy permissions object will be rejected after the effective date.
• Only grant_permissions and revoke_permissions will be honored moving forward.
• This change applies specifically to the PUT Subaccount endpoint.