---
title: "Update user ACL"
method: PUT
path: "/v1/users/acl/{appId}/{userId}"
tags: ["Users"]
---

# Update user ACL

`PUT /v1/users/acl/{appId}/{userId}`

## Request

- Base URL: `https://api.chat.ethora.com`
- URL: `https://api.chat.ethora.com/v1/users/acl/{appId}/{userId}`
- Auth: HTTP bearer

**Auth**: User JWT

update acl for appId and userId respectively

## Path parameters

- `appId` string, required
- `userId` string, required

## Request body

- object
  - `network` object: Network-level ACL flags for this user. Fields: `wallet`, `transactions`, `tokens` — each is a `{ read, write }` object. Omit to leave unchanged.
    - `netStats` object
      - `read` boolean
  - `application` object: App-level ACL flags. Top-level keys: `appCreate`, `appSettings`, `appUsers`, `wallets`, `marketplace`. Each is a fine-grained permission object (`read`, `create`, `update`, `delete`, etc.). Omit to leave unchanged.
    - `appCreate` object
      - `create` boolean
    - `appSettings` object
      - `read` boolean
      - `update` boolean
      - `admin` boolean
    - `appUsers` object
      - `create` boolean
      - `read` boolean
      - `update` boolean
      - `delete` boolean
      - `admin` boolean
    - `appTokens` object
      - `create` boolean
      - `read` boolean
      - `update` boolean
      - `admin` boolean
    - `appPush` object
      - `create` boolean
      - `read` boolean
      - `update` boolean
      - `admin` boolean
    - `appStats` object
      - `read` boolean
      - `admin` boolean

## Response `200`

```
  {
    result: {
      {
        network: {
          netStats: {
            read: boolean,
            disabled: ['create', 'update', 'delete', 'admin']
          }
        },
        application: {
          appCreate: {
            craete: boolean,
            disabled: ['read', 'update', 'delete', 'admin']
          },
          appSettings: {
            read: boolean,
            update: boolean,
            admin: boolean,
            disabled: ['create', 'delete']
          },
          appUsers: {
            create: boolean,
            read: boolean,
            update: boolean,
            delete: boolean,
            admin: boolean
          },
          appTokens: {
            create: boolean,
            read: boolean,
            update: boolean,
            admin: boolean,
            disabled: ['delete']
          },
          appPush: {
            create: boolean,
            read: boolean,
            update: boolean,
            admin: boolean,
            disabled: ['delete']
          },
          appStats: {
            read: boolean,
            admin: boolean,
            disabled: ['create', 'update', 'delete']
          }
        }
      },
      _id: string,
      userId: string,
      appId: string,
      createdAt: string,
      updatedAt: string
    }
  }
```

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: ``` {error: string} ```
- `500`: Internal Server Error

---

[API](https://skmtc.dev/ethora/apis/platform-api.md) · [All operations](https://skmtc.dev/ethora/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ethora/apis/platform-api/revisions/01b6e64378ee?raw)