---
title: "Update chat access"
method: PUT
path: "/api/public/organizations/{orgId}/chats/{chatId}/access"
tags: ["Chats"]
---

# Update chat access

`PUT /api/public/organizations/{orgId}/chats/{chatId}/access`

## Request

- Base URL: `https://charts.basedash.com`
- URL: `https://charts.basedash.com/api/public/organizations/{orgId}/chats/{chatId}/access`
- Auth: HTTP bearer

Replaces the access policy. Send the complete policy: groups and members not listed lose their access. Use mode "everyone" to give every organization member accessLevel (plus any listed groupAccess/memberAccess), or mode "restricted" so only the listed groups and members, the creator and organization admins can access it; restricting removes the default everyone access. groupAccess and memberAccess are required (send [] for none), and listing one principal twice with different levels is rejected. The GET response can be sent back unchanged, and sending the current policy again changes nothing. View-only members are capped at VIEW whatever their grant. The chat creator cannot be listed in memberAccess. Requires manage access to the chat.

## Path parameters

- `orgId` string, required: Organization ID
- `chatId` string, required: Chat ID

## Request body

- union
  - object
    - `mode` 'everyone', required
    - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW': Access level for every member of the organization
    - `groupAccess` object[], required: Organization groups and their access level. Required: send [] for none.
      - `id` string, required: Organization group or member ID
      - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'NONE': MANAGE can edit and change access, EDIT can edit, VIEW can view. NONE explicitly denies this principal, overriding group or everyone access.
    - `memberAccess` object[], required: Organization members and their access level. Required: send [] for none.
      - `id` string, required: Organization group or member ID
      - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'NONE': MANAGE can edit and change access, EDIT can edit, VIEW can view. NONE explicitly denies this principal, overriding group or everyone access.
  - object
    - `mode` 'restricted', required
    - `groupAccess` object[], required: Organization groups and their access level. Required: send [] for none.
      - `id` string, required: Organization group or member ID
      - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'NONE': MANAGE can edit and change access, EDIT can edit, VIEW can view. NONE explicitly denies this principal, overriding group or everyone access.
    - `memberAccess` object[], required: Organization members and their access level. Required: send [] for none.
      - `id` string, required: Organization group or member ID
      - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'NONE': MANAGE can edit and change access, EDIT can edit, VIEW can view. NONE explicitly denies this principal, overriding group or everyone access.

## Response `200`

Chat access updated successfully

- object
  - `data` ChatAccessResponse, required
    - `chatId` string, required: Chat ID
    - `mode` 'everyone' | 'restricted', required: everyone: all members have accessLevel, plus any listed principals. restricted: only listed principals, the creator and admins.
    - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'null', nullable, required: Access level for every member when mode is everyone
    - `groupAccess` object[], required: Organization groups and their access level
      - `id` string, required: Organization group or member ID
      - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'NONE', required: MANAGE can edit and change access, EDIT can edit, VIEW can view. NONE explicitly denies this principal, overriding group or everyone access.
    - `memberAccess` object[], required: Organization members and their access level
      - `id` string, required: Organization group or member ID
      - `accessLevel` 'MANAGE' | 'EDIT' | 'VIEW' | 'NONE', required: MANAGE can edit and change access, EDIT can edit, VIEW can view. NONE explicitly denies this principal, overriding group or everyone access.

## Other responses

- `400`: Bad request - Invalid JSON body or validation error
- `401`: Unauthorized - Missing or invalid API key
- `403`: Forbidden - View-only member, or no manage access to the chat
- `404`: Not found - Chat, group, or member not found or no access to the chat
- `429`: Rate limit exceeded - Too many requests
- `500`: Internal server error

---

[API](https://skmtc.dev/basedash/apis/basedash-public-api.md) - [All operations](https://skmtc.dev/basedash/apis/basedash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/basedash/apis/basedash-public-api/revisions/efb9d40bc6f7?raw)