---
title: "POST /v2/users/:user-id/rights"
method: POST
path: "/v2/users/{user-id}/rights"
---

# POST /v2/users/:user-id/rights

`POST /v2/users/{user-id}/rights`

Grant rights to a user.
Granting rights does not affect the resource version of the corresponding user.

## Path parameters

- `user-id` string, required

## Request body

- GrantUserRightsRequest — Add the rights to the set of rights granted to the user. Required authorization: ``HasRight(ParticipantAdmin) OR IsAuthenticatedIdentityProviderAdmin(identity_provider_id)``
  - `userId` string, required — The user to whom to grant rights. Required
  - `rights` Right[] — The rights to grant. Optional: can be empty
    - `kind` union — Required
      - object
        - `CanActAs` CanActAs, required
          - `value` CanActAs1, required
            - `party` string, required — The right to authorize commands for this party. Required
      - object
        - `CanExecuteAs` CanExecuteAs, required
          - `value` CanExecuteAs1, required
            - `party` string, required — The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
      - object
        - `CanExecuteAsAnyParty` CanExecuteAsAnyParty, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
          - `value` CanExecuteAsAnyParty1, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
      - object
        - `CanReadAs` CanReadAs, required
          - `value` CanReadAs1, required
            - `party` string, required — The right to read ledger data visible to this party. Required
      - object
        - `CanReadAsAnyParty` CanReadAsAnyParty, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
          - `value` CanReadAsAnyParty1, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
      - object
        - `Empty` Empty8, required
      - object
        - `IdentityProviderAdmin` IdentityProviderAdmin, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
          - `value` IdentityProviderAdmin1, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
      - object
        - `ParticipantAdmin` ParticipantAdmin, required — The right to administer the participant node.
          - `value` ParticipantAdmin1, required — The right to administer the participant node.
  - `identityProviderId` string — The id of the ``Identity Provider`` If not set, assume the user is managed by the default identity provider. Optional

## Response `200`

- GrantUserRightsResponse
  - `newlyGrantedRights` Right[] — The rights that were newly granted by the request. Optional: can be empty
    - `kind` union — Required
      - object
        - `CanActAs` CanActAs, required
          - `value` CanActAs1, required
            - `party` string, required — The right to authorize commands for this party. Required
      - object
        - `CanExecuteAs` CanExecuteAs, required
          - `value` CanExecuteAs1, required
            - `party` string, required — The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
      - object
        - `CanExecuteAsAnyParty` CanExecuteAsAnyParty, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
          - `value` CanExecuteAsAnyParty1, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
      - object
        - `CanReadAs` CanReadAs, required
          - `value` CanReadAs1, required
            - `party` string, required — The right to read ledger data visible to this party. Required
      - object
        - `CanReadAsAnyParty` CanReadAsAnyParty, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
          - `value` CanReadAsAnyParty1, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
      - object
        - `Empty` Empty8, required
      - object
        - `IdentityProviderAdmin` IdentityProviderAdmin, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
          - `value` IdentityProviderAdmin1, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
      - object
        - `ParticipantAdmin` ParticipantAdmin, required — The right to administer the participant node.
          - `value` ParticipantAdmin1, required — The right to administer the participant node.

## Other responses

- `400` — Invalid value, Invalid value for: body
- `default`

---

[API](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints.md) · [All operations](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/canton/json-ledger-api-http-endpoints/revisions/296292e8b8f1/schema)