AssetCenter
Sign in Get started - it's free!

↑ ↓ to navigate · ↵ to open See all results
PATCH /api/v1/users/{user}/permissions

Update user permissions

Change a member’s role and access within the API key’s organization.

Last updated

Request

PATCH /api/v1/users/{user}/permissions

Requires users:permissions. See token permissions. The token creator must remain an active administrator of the token’s organization.

Send Authorization: Bearer YOUR_API_TOKEN and Accept: application/json.

user is the numeric ID of a current member of the token’s organization. This is a login user, distinct from an inventory person.

Query parameters

This endpoint does not use query parameters.

Request body

Provide at least one field. Omitted fields keep their current values.

Field Type Usage
is_admin boolean Optional. Grant or remove administrator access in this organization. Promotion grants full app access.
can_create_assets boolean Optional. Create assets.
can_create_subscriptions boolean Optional. Create subscriptions.
can_create_people boolean Optional. Create people.
can_create_locations boolean Optional. Create locations.
can_bulk_import boolean Optional. Use bulk import.
can_manage_asset_categories boolean Optional. Manage asset categories.
can_manage_subscription_categories boolean Optional. Manage subscription categories.
can_manage_asset_events boolean Optional. Manage asset event types.
asset_category_ids array of integers Optional. Replace asset category restrictions with up to 1,000 distinct asset category IDs in this organization. An empty array allows all asset categories.
subscription_category_ids array of integers Optional. Replace subscription category restrictions with up to 1,000 distinct subscription category IDs in this organization. An empty array allows all subscription categories.

Requires Idempotency-Key. Use a unique key for each action and keep it unchanged when retrying. Successful responses are remembered for 24 hours per token. Idempotency and retries.

Example

Set ASSETCENTER_API_TOKEN as described in the quick start. Replace example IDs with values from your organization.

cURL / Bash 
curl --request PATCH "https://my.assetcenter.app/api/v1/users/42/permissions" \
  --header "Authorization: Bearer $ASSETCENTER_API_TOKEN" \
  --header "Accept: application/json" \
  --header "Idempotency-Key: $(uuidgen)" \
  --header "Content-Type: application/json" \
  --data '{"can_create_assets":true,"asset_category_ids":[7]}'

Response

200 OK. Illustrative response; IDs and values will differ.

JSON 
{
  "data": {
    "id": 42,
    "name": "Alex Morgan",
    "email": "[email protected]",
    "is_active": true,
    "is_admin": false,
    "permissions": {
      "can_create_assets": true,
      "can_create_subscriptions": false,
      "can_create_people": false,
      "can_create_locations": false,
      "can_bulk_import": false,
      "can_manage_asset_categories": false,
      "can_manage_subscription_categories": false,
      "can_manage_asset_events": false
    },
    "asset_category_ids": [
      7
    ],
    "subscription_category_ids": []
  }
}

Behavior and constraints

The token creator cannot be a target. The organization must retain an active administrator. Personal names, email, phone, timezone, passwords, global activation, and individual two-factor settings cannot be changed here. Unsupported fields return 422.

Administrators cannot receive permission flags or category restrictions. Set is_admin=false before, or in the same request as, restricted permissions. Promote with is_admin=true alone; this clears only this organization’s category restrictions. Stored permission flags remain available if the user is later demoted.

Demotion revokes the target user’s customer integration tokens for this organization. Other organization memberships, category selections, and tokens remain unchanged. The response contains the updated user described in Get an organization user.

Errors

401 means the customer bearer token is missing, expired, revoked, or invalid. 403 means the token lacks the required permission or its creator is no longer an active administrator. 404 means the requested member or invitation is unavailable in this organization. 422 identifies invalid or unsupported input, plan limits, or a protected membership change. 409 indicates conflicting key reuse or a concurrent organization change. 429 means a rate limit was reached. Error handling and rate limits.