---
title: "PUT /api/admin/management/role_permissions/{roleId}"
method: PUT
path: "/api/admin/management/role_permissions/{roleId}"
tags: ["Admin: Roles"]
---

# PUT /api/admin/management/role_permissions/{roleId}

`PUT /api/admin/management/role_permissions/{roleId}`

## Request

- The document declares no server URL.
- Auth: API key in cookie `session`

Replace the permission matrix for a role.

## Path parameters

- `roleId` integer, required

## Request body

- RolePermissionsInput: The Permissions submitted for a role.
  - `grants` string[], required: The declared Permissions the role holds, replacing its current set. Names must come from the catalog (`GET /admin/management/permissions`).

## Response `200`

The request has succeeded.

- StaffRoleDetail: A staff role with the Permissions it holds (legacy: `StaffRoleCrud`).
  - `id` integer, required
  - `name` string, required
  - `description` string, nullable, required
  - `grants` string[], required: Names of the declared Permissions the role holds (see `Permission`).

## Other responses

- `default`: Default error response shared by every operation. `@error` emits an OpenAPI `default` response, keeping central transport failures typed without enumerating every status on every operation.

## Changes

- **2026-10-18** `9380d4c85a04`: 4 info
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `403`
  - removed the non-success response with the status `422`
  - added the optional property `errors` to the response with the `default` status
- **2026-10-17** `023e7c2cd140`: 2 breaking, 1 warning, 2 info
  - added the new required request property `grants`
  - removed the required property `permissions` from the response with the `200` status
  - removed the request property `permissions`
  - added the non-success response with the status `422`
  - …1 more
- **2026-10-17** `6038dca99ed6`: 2 info
  - the endpoint scheme security `AdminSession` was added to the API
  - the endpoint scheme security `AdminSession AND XsrfToken` was removed from the API
- **2026-09-26** `d456bc339390`: 1 info
  - endpoint added
- **2026-09-26** `5eaeb6a41751`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/changes/api/admin/management/role_permissions/:roleId/put.md)

---

[API](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api.md) - [All operations](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/revisions/51c7f596b47c?raw)