---
title: "POST /v1/origin/namespaces/{namespaceSlug}/grants"
method: POST
path: "/v1/origin/namespaces/{namespaceSlug}/grants"
tags: ["OriginService"]
---

# POST /v1/origin/namespaces/{namespaceSlug}/grants

`POST /v1/origin/namespaces/{namespaceSlug}/grants`

## Request

- Base URL: `https://api.cursor.com`
- URL: `https://api.cursor.com/v1/origin/namespaces/{namespaceSlug}/grants`
- Auth: HTTP bearer

Sets the permission a user, group, or owning-team group holds directly on
 an owner, replacing any permission previously granted directly to that
 principal. Repeating a grant the principal already holds succeeds without
 change. Only the four presets are accepted; `PERMISSION_CUSTOM` fails with
 INVALID_ARGUMENT. A user must be an active member of the owning team or
 its organization and a group an active group of that organization, and the
 write must leave the owner with at least one admin; otherwise the request
 fails with FAILED_PRECONDITION.

## Path parameters

- `namespaceSlug` string, required

## Request body

- object
  - `user` OriginUserActor
    - `id` string
    - `email` string, required: The account's email. On pull request, review, comment, check, requested reviewer, and mergeability responses it is empty unless the caller holds `repository:members:read` on the repository.
    - `displayName` string: Human-readable display name: the account's first and last name, each trimmed, joined with a space — exactly the name the product UI renders. Omitted when the account has no name; never synthesized from the email, the id, or any other field.
    - `handle` string: The user's claimed profile handle (the identity behind cursor.com /@handle), without the @ prefix. Present only while the user's profile is publicly visible; omitted for users without a claimed handle and for non-public profiles.
    - `performedVia` OriginUserActorPerformedViaActor: Identifies an actor that acted on behalf of the user.
      - `app` OriginAppActor
        - `id` string
        - `displayName` string: The app's registered display name, never empty when present. Omitted when the app cannot be resolved.
      - `serviceAccount` OriginServiceAccountActor
        - `id` string
        - `type` 'bugbot' | 'automations' | 'agent_serve' | 'agent' | 'grok_bot' | 'env_builds': Which product or feature the account acts for. Unset when this API does not categorize the account or it no longer exists. New values may be added: decode with unknown enum values ignored, and treat an unset or unrecognized type as an unknown product, never as an error.
        - `displayName` string: The product name Cursor shows for the account, such as a Grok bot's name; never empty when present. A Grok bot whose name cannot be read is named "Grok Bot". Omitted when the account has no product name.
  - `group` OriginGroup: Public Origin group identity (`grp_…`). Currently id-only.
    - `id` string
  - `teamGroup` OriginTeamGroup: A fixed group of the team that owns a repository or an owner: every team member or every team admin. These are the owning team's default access shelves, granted on the resource itself; a repository's team-group grant is distinct from the one inherited from its owner.
    - `kind` 'members' | 'admins'
  - `permission` 'PERMISSION_READ' | 'PERMISSION_CONTRIBUTOR' | 'PERMISSION_WRITE' | 'PERMISSION_ADMIN' | 'PERMISSION_CUSTOM', required: `PERMISSION_READ`, `PERMISSION_CONTRIBUTOR`, `PERMISSION_WRITE`, or `PERMISSION_ADMIN`.

## Response `200`

OK

- NamespaceGrant: One grant of access to an owner: the principal that holds it and the permission it confers on every repository under that owner. The principal is a user, a group, or one of the owning team's built-in groups (all team admins, or all team members). Grants to the built-in team groups are the team's default access to the owner and are set through `UpsertNamespaceGrant` and `DeleteNamespaceGrant` like any other grant.
  - `user` OriginUserActor
    - `id` string
    - `email` string, required: The account's email. On pull request, review, comment, check, requested reviewer, and mergeability responses it is empty unless the caller holds `repository:members:read` on the repository.
    - `displayName` string: Human-readable display name: the account's first and last name, each trimmed, joined with a space — exactly the name the product UI renders. Omitted when the account has no name; never synthesized from the email, the id, or any other field.
    - `handle` string: The user's claimed profile handle (the identity behind cursor.com /@handle), without the @ prefix. Present only while the user's profile is publicly visible; omitted for users without a claimed handle and for non-public profiles.
    - `performedVia` OriginUserActorPerformedViaActor: Identifies an actor that acted on behalf of the user.
      - `app` OriginAppActor
        - `id` string
        - `displayName` string: The app's registered display name, never empty when present. Omitted when the app cannot be resolved.
      - `serviceAccount` OriginServiceAccountActor
        - `id` string
        - `type` 'bugbot' | 'automations' | 'agent_serve' | 'agent' | 'grok_bot' | 'env_builds': Which product or feature the account acts for. Unset when this API does not categorize the account or it no longer exists. New values may be added: decode with unknown enum values ignored, and treat an unset or unrecognized type as an unknown product, never as an error.
        - `displayName` string: The product name Cursor shows for the account, such as a Grok bot's name; never empty when present. A Grok bot whose name cannot be read is named "Grok Bot". Omitted when the account has no product name.
  - `group` OriginGroup: Public Origin group identity (`grp_…`). Currently id-only.
    - `id` string
  - `teamGroup` OriginTeamGroup: A fixed group of the team that owns a repository or an owner: every team member or every team admin. These are the owning team's default access shelves, granted on the resource itself; a repository's team-group grant is distinct from the one inherited from its owner.
    - `kind` 'members' | 'admins'
  - `permission` 'PERMISSION_READ' | 'PERMISSION_CONTRIBUTOR' | 'PERMISSION_WRITE' | 'PERMISSION_ADMIN' | 'PERMISSION_CUSTOM': Permission the principal holds on every repository under the owner.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: The addressed resource, or its repository, does not exist or is not visible to the caller. Not-found and no-access are deliberately indistinguishable; a 404 never confirms that the resource does not exist.
- `429`: Too Many Requests
- `default`: Default error response

---

[API](https://skmtc.dev/cursor/apis/cursor-origin-api.md) - [All operations](https://skmtc.dev/cursor/apis/cursor-origin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cursor/apis/cursor-origin-api/revisions/cbc1547d6ef7?raw)