---
title: "Add permission to user"
method: POST
path: "/api/users/{user_id}/permissions"
tags: ["Permissions"]
---

# Add permission to user

`POST /api/users/{user_id}/permissions`

Add a single user-level permission to a user.

Privileged-grant policy (2026-08-13, see `app/db/permissions.py`): the guard
moved from "refuse every `NEVER_ASSIGNABLE` name" to the same split
`app/db/admin.py` already applies to roles — `system_admin` refused outright,
`admin`/`view_all_pvs` allowed with an EXPLICIT `grant_privileged_role` and
audited in the write's own transaction. The check itself runs in the DB layer,
inside that transaction: doing it up here would leave a check-then-write race.

## Path parameters

- `user_id` integer, required

## Headers

- `x-api-token` string, nullable

## Request body

- PermissionAssign
  - `permission_id` integer, required
  - `grant_privileged_role` boolean

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/multigest/apis/multigest-protected-api.md) · [All operations](https://skmtc.dev/multigest/apis/multigest-protected-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/multigest/multigest-protected-api/revisions/4b44eb76b3ee/schema)