Set user permissions

PUT /v1/users/{userId}/permissions

Replace a user's individually granted permissions with the given list. Permissions that come from the user's roles are not affected.

Requires: permission.grantpermission.revoke

Path Parameters

userId required

string

The user ID

Request Body

The complete list of individually granted permissions

RequestBody

permissionsrequired

enum[]

Example Request

application/json

{
  "permissions": [
    "organization.owner"
  ]
}

Response Schema

UserDetails

activityLogrequired

object[]

actionrequired

string

detailsoptional

string

idrequired

string

timestamprequired

string

format: date-time

createdAtrequired

string

format: date-time

displayNameoptional

string

emailrequired

string

expiresAtoptional

string

Invitation expiry date (invited/expired rows only).

format: date-time

invitationIdoptional

string

Present only for invited/expired rows.

invitedByEmailoptional

string

Email of the person who sent the invitation.

isOwnerrequired

boolean

lastActiveoptional

string

format: date-time

permissionsrequired

enum[]

rolesrequired

string[]

Role identifiers (usually system role keys like "operator", or role IDs for custom roles).

statusrequired

"active" | "invited" | "inactive" | "expired"

activeinvitedinactiveexpired

userIdoptional

string

Example Response

200 OK — application/json

{
  "activityLog": [
    {
      "id": "string",
      "action": "string",
      "timestamp": "2025-01-15T12:00:00.000Z",
      "details": "string"
    }
  ],
  "userId": "string",
  "email": "string",
  "displayName": "string",
  "isOwner": true,
  "roles": [
    "string"
  ],
  "permissions": [
    "organization.owner"
  ],
  "lastActive": "2025-01-15T12:00:00.000Z",
  "status": "active",
  "createdAt": "2025-01-15T12:00:00.000Z",
  "invitationId": "string",
  "expiresAt": "2025-01-15T12:00:00.000Z",
  "invitedByEmail": "string"
}