---
title: "Replace one principal's legal-entity access"
method: PUT
path: "/companies/{companyId}/entity-access/{userId}"
tags: ["Company Settings"]
---

# Replace one principal's legal-entity access

`PUT /companies/{companyId}/entity-access/{userId}`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/companies/{companyId}/entity-access/{userId}`
- Auth: HTTP bearer

Owner/admin only. Atomically revokes the active grant set for an active company member or assigned accountant, then grants either every legal entity or the selected concrete legal entities. Consolidated reporting scopes cannot be granted.

## Request body

- union
  - object
    - `scope` 'all_entities', required
  - object
    - `scope` 'entities', required
    - `entityIds` string[], required

## Response `200`

Updated legal-entity access summary

- EntityAccessSummaryResponse
  - `success` boolean, required
  - `data` EntityAccessSummary, required
    - `companyId` string, uuid, required
    - `userId` string, uuid, required
    - `scope` 'all_entities' | 'entities', required
    - `entityIds` string[], required

## Other responses

- `401`: Authentication required
- `403`: Insufficient permissions or not a company member
- `404`: Resource not found
- `422`: Request failed validation

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)