---
title: "Update asset permissions"
method: PUT
path: "/api/v1/permissions/{assetId}"
tags: ["Permissions"]
---

# Update asset permissions

`PUT /api/v1/permissions/{assetId}`

## Request

- Base URL: `https://docs.anzworldline-solutions.com.au`
- URL: `https://docs.anzworldline-solutions.com.au/api/v1/permissions/{assetId}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/docs/api/v1/permissions/:assetId/put.ts> (a function with typed inputs; its response is checked against the schema)

Replaces all permissions for a specific asset. If the asset is currently inheriting permissions, inheritance will be automatically broken. Only admin users can access this endpoint. Use cascade=true to trigger an async job that removes individual permissions from descendant assets.

## Path parameters

- `assetId` string, required

## Query parameters

- `cascade` boolean

## Request body

- UpdateAssetPermissionsForm
  - `permissions` RolePermissionForm[], required: List of role permission entries. Each entry defines permissions for a specific role on the asset.
    - `roleId` string, required: Role identifier. Can be role ID or role key.
    - `individual` string[]: Individual permission levels for this asset. Valid values: READ, WRITE, PUBLISH, EDIT_PERMISSIONS, CAN_ADD_CHILDREN
    - `inheritable` object: Inheritable permissions by scope for child assets. Keys are permission scopes (FOLDER, CONTENT, PAGE, etc.), values are sets of permission levels.

## Response `200`

Permissions updated successfully

- ResponseEntityUpdatePermissionsView
  - `errors` ErrorEntity[]
    - `errorCode` string
    - `message` string
    - `fieldName` string
  - `entity` UpdateAssetPermissionsView
    - `message` string, required: Success message describing the operation result
    - `permissionCount` integer, required: Number of permission entries saved during this operation
    - `inheritanceBroken` boolean, required: Whether permission inheritance was broken during this operation. True if the asset was previously inheriting permissions from its parent.
    - `asset` AssetPermissionsView, required: The updated asset with its new permission assignments
      - `assetId` string, required: Asset identifier
      - `assetType` 'INDIVIDUAL' | 'HOST' | 'FOLDER' | 'CONTAINER' | 'TEMPLATE' | 'TEMPLATE_LAYOUT' | 'LINK' | 'CONTENT' | 'PAGE' | 'CONTENT_TYPE' | 'STRUCTURE' | 'CATEGORY' | 'RULE', required: Asset type
      - `inheritanceMode` 'INHERITED' | 'INDIVIDUAL', required: Permission inheritance mode
      - `canEditPermissions` boolean, required: Whether the requesting user can edit permissions on this asset
      - `canEdit` boolean, required: Whether the requesting user can edit this asset
      - `canAddChildren` boolean, required: Whether the requesting user can add children to this asset
      - `parentAssetId` string: Parent asset identifier (null if no parent or at root level)
      - `permissions` RolePermissionView[], required: Paginated list of role permissions assigned to this asset
        - `roleId` string, required: Role identifier
        - `roleName` string, required: Role display name
        - `inherited` boolean, required: Whether permissions are inherited from a parent asset
        - `individual` string[], required: Individual permission levels assigned directly to this role on the asset
        - `inheritable` object: Inheritable permissions by scope (only for parent permissionables). Keys are permission scopes (HOST, FOLDER, CONTENT, etc.), values are permission types
          - `empty` boolean
      - `isParentPermissionable` boolean, required: Whether this asset can have child permissionables (e.g., hosts and folders)
    - `cascadeWarnings` string[]: Warnings from cascade operations that partially failed. Present only when cascade was requested and some role cascades failed.
  - `messages` MessageEntity[]
    - `message` string
  - `i18nMessagesMap` object
  - `permissions` string[]
  - `pagination` Pagination
    - `currentPage` integer
    - `perPage` integer
    - `totalEntries` integer

## Other responses

- `400`: Bad request - invalid request body or role IDs
- `401`: Unauthorized - authentication required
- `403`: Forbidden - user is not admin or lacks EDIT_PERMISSIONS on asset
- `404`: Asset not found
- `500`: Failed to update permissions

## Changes

- **2026-10-30** `4fd8e917d458`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/changes/api/v1/permissions/:assetId/put.md)

---

[API](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api.md) - [All operations](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/revisions/4fd8e917d458?raw)