Overview

Attach one packageable feature to a list of packages in a single call. The feature must exist and have packageable: true, otherwise the request fails.

A package that already has the feature is skipped, not rejected, so the call is safe to repeat. Only packages actually modified are recorded in the audit trail.
If any id in the list does not exist the whole call rolls back — no package keeps the feature and no audit row is written.

Available for admin actors only — an Okta admin token (introspected by the API gateway) or, outside production, the static admin token. Any other actor type receives 403. Note the list operation on this path is not admin-only: it remains available to staff tokens, so authorization differs per operation.