---
title: "Replace all grants for a user"
method: PUT
path: "/user/{id}/grant"
tags: ["Role and grant"]
---

# Replace all grants for a user

`PUT /user/{id}/grant`

## Request

- Base URL: `https://api.nullplatform.com`
- URL: `https://api.nullplatform.com/user/{id}/grant`
- Auth: HTTP bearer

Replace all existing grants for a user with a new set of grants. This operation **deletes all existing grants** and creates the new ones.

- Send an **empty array** `[]` to remove all grants from the user.
- Send a **non-empty array** to replace all grants with the specified ones.

The operation is **transactional**: if any new grant fails validation, no changes are made.

You can **use either `role_id` or `role_slug`** for each grant in the request.

## Path parameters

- `id` integer, required

## Request body

- union[]: Array of grants to set for the user. Send an empty array to remove all grants.
  - union
    - BulkGrantItemRoleSlug
      - `nrn` string, required: The NRN of the resource where the role is assigned.
      - `role_slug` string, required: The slug of the role to assign. > Note: See [Roles](/docs/authorization/roles) for more info.
    - BulkGrantItemRoleId
      - `nrn` string, required: The NRN of the resource where the role is assigned.
      - `role_id` integer, required: The ID of the role to assign. > Note: See [Roles](/docs/authorization/roles) for more info.

## Response `200`

Grants were replaced successfully.

- BulkGrantResponse[]: Array of created/updated grants.
  - `id` integer, required: The unique identifier for the grant.
  - `nrn` string, required: The NRN of the resource where the role is assigned.
  - `user_id` integer, required: The ID of the user who received the grant.
  - `role_id` integer, required: The ID of the role assigned.
  - `role_slug` string: The slug of the role assigned.
  - `status` 'active' | 'pending', required: The status of the grant.

## Other responses

- `204`: All grants were removed (empty array was sent).
- `400`: The request failed validation. See POST endpoint for common causes.
- `4XX`: The request couldn't be processed. For example, a parameter is invalid, the resource doesn't exist, or you don't have permission. The body is a problem details object (RFC 9457).
- `5XX`: Something went wrong on nullplatform's side. The body is a problem details object (RFC 9457).

## Changes

- **2026-10-15** `728d4df70ca1`: 6 breaking, 15 info
  - the response property `message` became optional for the status `4XX`
  - the response property `message` became optional for the status `5XX`
  - removed the required property `error` from the response with the `4XX` status
  - removed the required property `error` from the response with the `5XX` status
  - …17 more
- **2026-09-17** `43b3c1ecdfd8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nullplatform/apis/nullplatform-api/changes/user/:id/grant/put.md)

---

[API](https://skmtc.dev/nullplatform/apis/nullplatform-api.md) - [All operations](https://skmtc.dev/nullplatform/apis/nullplatform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nullplatform/apis/nullplatform-api/revisions/d3f66bc633d4?raw)