---
title: "Set a member module access level"
method: PATCH
path: "/accounts/{account}/members/{member}/module-access"
tags: ["Account"]
---

# Set a member module access level

`PATCH /accounts/{account}/members/{member}/module-access`

## Request

- Base URL: `https://api.factuarea.com/v1`
- URL: `https://api.factuarea.com/v1/accounts/{account}/members/{member}/module-access`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Replace the FULL set of module restrictions of a member in the tax ID named by `company_id`, and optionally its `grants`.
- The body replaces every previous restriction; an empty `restrictions` lifts them all. Sent `grants` replace the old ones.
- 422 `business_rule_violation` for restricting yourself, the owner or an unrestrictable section; 404 `member_not_found`. Requires the `members:write` scope, which `*` does not cover: the API key must list it explicitly.

## Path parameters

- `account` string, uuid, required
- `member` string, uuid, required

## Headers

- `Idempotency-Key` string
- `Factuarea-Version` string, date

## Request body

- SetAccountMemberModuleAccessV1Request
  - `company_id` string, uuid, required: Public identifier (UUID v7) of the company the access level is set on.
  - `restrictions` array[], required: Map of section to WITHDRAWN capabilities (`access`, `create`, `edit`, `delete`, `send`, `export`). Required; it can be empty.
    - string[]
  - `grants` string[]: Administrator-only sections GRANTED to the member in that tax ID (for example `verifactu`); never the Administrator keys (user management, plan and subscription, API and developers, digital certificate). Optional: omitted, the grants are left as they are; sent — even empty — it replaces them entirely.

## Response `200`

- object
  - `data` MemberModuleAccess, required: The module access level of an account member in one tax ID. `restrictions` is a DENY list: it states what has been WITHDRAWN, not what the person can do, so an empty object means no restriction at all and never no access. `grants` lists the administrator-only sections that were GRANTED on top.
    - `object` 'member_module_access', required: Always `member_module_access`.
    - `member_id` string, uuid, required: Opaque identifier (UUID v7) of the account member (the `id` of `AccountMember`).
    - `company_id` string, uuid, required: Opaque identifier (UUID v7) of the tax ID the level applies to.
    - `restrictions` object, required: Section to withdrawn capabilities. A section absent from the map has nothing withdrawn; an empty object means the member has no restriction at all. `access` is the root capability: withdrawing it makes the others irrelevant for that section.
    - `grants` string[], required: Administrator-only sections GRANTED to the member in this tax ID, on top of the User group. Never contains an Administrator key (user management, plan and subscription, API and developers, digital certificate). Empty when nothing was granted, and always empty for an `owner` or `admin`, who hold every permission of their plan. The capabilities inside a granted section are still governed by `restrictions`.

## Other responses

- `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version.
- `401`: Missing or invalid API key.
- `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the plan does not include the public API or this feature (`addon_not_active`, `feature_not_available_in_plan`), or the module is not available with a test key (`module_not_available_in_sandbox`).
- `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key.
- `422`: Validation failed — e.g. the API key plan limit was reached, or an invoice language outside the allowed catalog (`es`, `en`, `ca`). The `error.param` field identifies which input is invalid, if any. `idempotency_key_reused`: the `Idempotency-Key` was already used with a different body; send a new key or the same body. `invalid_param_format` on `Idempotency-Key`: the key must be 1 to 255 printable ASCII characters.
- `429`: Rate limit exceeded. Retry after the duration in `Retry-After`.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)