---
title: "Grant or revoke per-user permissions"
method: PATCH
path: "/v1/users/{user_id}/permissions"
tags: ["Users"]
---

# Grant or revoke per-user permissions

`PATCH /v1/users/{user_id}/permissions`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/users/{user_id}/permissions`
- Auth: HTTP bearer

Inserts or updates per-user permission grants for a member of the authenticated caller's organization. Each item sets one permission (by `permissions.id`) to enabled or disabled; permissions not listed are left unchanged. The caller cannot update their own permissions or an account owner's. Effective permissions are the union of role grants and enabled per-user grants — disabling a permission here does not revoke it from a role. Returns every per-user grant stored for the member.

## Path parameters

- `user_id` string, required

## Request body

- UserUpsertUserPermissionsRequestEnvelopeDTO
  - `data` object
    - `attributes` UserUpsertUserPermissionsRequestDTO
      - `permissions` UserPermissionToggleDTO[], required
        - `enabled` boolean, required
        - `permission_id` integer, required

## Response `200`

OK

- object: Standard response containing data and its metadata if any
  - `data` object[]
    - `attributes` UserPermissionAttributesDTO
      - `action` string
      - `created_at` integer
      - `enabled` boolean
      - `module` string
      - `permission_id` integer
      - `updated_at` integer
      - `user_id` string
    - `id` string
    - `type` string
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)