---
title: "Set permission"
method: PUT
path: "/api/v3/meta/bases/{baseId}/permissions"
tags: ["Permissions"]
---

# Set permission

`PUT /api/v3/meta/bases/{baseId}/permissions`

## Request

- Base URL: `https://app.nocodb.com`
- URL: `https://app.nocodb.com/api/v3/meta/bases/{baseId}/permissions`
- Auth: one of:
  - API key in header `xc-token`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/nocodb/apis/nocodb-v3/docs/api/v3/meta/bases/:baseId/permissions/put.ts> (a function with typed inputs; its response is checked against the schema)

Create or replace the grant for one permission on a table or field. A grant is exactly one rule: a minimum role (`granted_type` `role` with `granted_role`), named users and teams (`granted_type` `user` with `subjects`), or `nobody`. `TABLE_VISIBILITY` can be set by base owners only.

**Note**: Table and field permissions are available on cloud-hosted **Business** plans and above, and on licensed self-hosted deployments. Listing grants works on every plan, so a downgraded workspace can still see the grants in place.

## Path parameters

- `baseId` string, required

## Request body

- PermissionSet
  - `entity` 'table' | 'field', required: What the grant is attached to.
  - `entity_id` string, required: Table ID for entity `table`, field ID for entity `field`.
  - `permission` 'TABLE_VISIBILITY' | 'TABLE_RECORD_ADD' | 'TABLE_RECORD_DELETE' | 'RECORD_FIELD_EDIT', required: `TABLE_*` keys attach to a table, `RECORD_FIELD_EDIT` to a field.
  - `granted_type` 'role' | 'user' | 'nobody', required: `role`: a minimum base role. `user`: only the listed subjects. `nobody`: no one.
  - `granted_role` 'creator' | 'editor': Minimum role. Required with `granted_type` `role` and rejected otherwise. To restrict to owners, use `granted_type` `user`.
  - `subjects` object[]: Users and teams allowed. Required (non-empty) with `granted_type` `user`, rejected otherwise. Give each by `id`, or a user by `email`.
    - `type` 'user' | 'team', required
    - `id` string
    - `email` string, email
    - `hierarchy_scope` 'self_only' | 'self_and_descendants': Team subjects only: whether the grant covers just that team or its sub-teams too.
  - `enforce_for_automation` boolean: Also enforce for automations.
  - `enforce_for_form` boolean: Also enforce for form submissions.

## Response `200`

The grant as stored.

- Permission
  - `id` string: Unique identifier for the grant.
  - `entity` 'table' | 'field': What the grant is attached to.
  - `entity_id` string: Table ID or field ID.
  - `permission` 'TABLE_VISIBILITY' | 'TABLE_RECORD_ADD' | 'TABLE_RECORD_DELETE' | 'RECORD_FIELD_EDIT': `TABLE_*` keys attach to a table, `RECORD_FIELD_EDIT` to a field.
  - `granted_type` 'role' | 'user' | 'nobody': `role`: a minimum base role. `user`: only the listed subjects. `nobody`: no one.
  - `granted_role` string, nullable: Minimum role for a role grant, else null.
  - `subjects` object[]
    - `type` 'user' | 'team' | 'appTeam' | 'agent'
    - `id` string
    - `hierarchy_scope` 'self_only' | 'self_and_descendants': Team subjects only: whether the grant covers just that team or its sub-teams too.
  - `enforce_for_automation` boolean
  - `enforce_for_form` boolean
  - `created_by` string

## Other responses

- `400`: The request body or a query parameter failed validation.
- `403`: Authenticated, but not allowed: the role is too low, the token scope does not cover the operation, or the plan does not include the feature or allows no more of this resource.

## Changes

- **2026-11-06** `62a735aaf849`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nocodb/apis/nocodb-v3/changes/api/v3/meta/bases/:baseId/permissions/put.md)

---

[API](https://skmtc.dev/nocodb/apis/nocodb-v3.md) - [All operations](https://skmtc.dev/nocodb/apis/nocodb-v3/llms.txt) - [OpenAPI document](https://skmtc.dev/nocodb/apis/nocodb-v3/revisions/62a735aaf849?raw)