---
title: "Update user permissions on asset"
method: PUT
path: "/api/v1/permissions/user/{userId}/asset/{assetId}"
tags: ["Permissions"]
---

# Update user permissions on asset

`PUT /api/v1/permissions/user/{userId}/asset/{assetId}`

Saves permissions for a user's individual role on a specific asset (host or folder). This endpoint assigns permissions directly to the user's individual role. If the asset inherits permissions, inheritance will be broken automatically before saving. Optionally cascade permissions to descendants (removes their individual permissions). Only admin users can update permissions.

## Path parameters

- `userId` string, required
- `assetId` string, required

## Request body

- SaveUserPermissionsForm
  - `permissions` object, required — Permission assignments by scope (INDIVIDUAL, HOST, FOLDER, etc.) with permission levels (READ, WRITE, PUBLISH, EDIT_PERMISSIONS, CAN_ADD_CHILDREN)
  - `cascade` boolean — Whether to cascade permissions to all children assets

## Response `200`

User permissions updated successfully

- ResponseEntitySaveUserPermissionsView
  - `errors` ErrorEntity[]
    - `errorCode` string
    - `message` string
    - `fieldName` string
  - `entity` SaveUserPermissionsView
    - `userId` string, required — User identifier
    - `roleId` string, required — User's individual role identifier
    - `asset` UserPermissionAssetView, required — The updated asset with new permission assignments
      - `id` string, required — Asset identifier (host identifier for HOST type, folder inode for FOLDER type)
      - `type` 'HOST' | 'FOLDER', required — Asset type
      - `name` string, required — Asset name (hostname for HOST, folder name for FOLDER)
      - `path` string, required — Full path to the asset
      - `hostId` string, required — Host identifier (same as id for HOST type, parent host for FOLDER type)
      - `canEditPermissions` boolean, required — Whether the requesting user can edit permissions on this asset
      - `inheritsPermissions` boolean, required — Whether this asset inherits permissions from its parent
      - `permissions` object, required — Map of permission types (INDIVIDUAL, HOST, FOLDER, etc.) to sets of permission level names (READ, WRITE, PUBLISH, EDIT_PERMISSIONS, CAN_ADD_CHILDREN)
        - `empty` boolean
    - `cascadeInitiated` boolean, required — Whether permission cascade to children was initiated
  - `messages` MessageEntity[]
    - `message` string
  - `i18nMessagesMap` object
  - `permissions` string[]
  - `pagination` Pagination
    - `currentPage` integer
    - `perPage` integer
    - `totalEntries` integer

## Other responses

- `400` — Bad request - invalid input (see error message for details)
- `401` — Unauthorized - authentication required
- `403` — Forbidden - admin access required or user lacks EDIT_PERMISSIONS on asset
- `404` — User or asset not found

---

[API](https://skmtc.dev/jostens/apis/dotcms-rest-api.md) · [All operations](https://skmtc.dev/jostens/apis/dotcms-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jostens/dotcms-rest-api/revisions/a088fe9f515c/schema)