---
title: "Set permissions for a file"
method: PUT
path: "/files/{fileId}/permissions"
tags: ["Files"]
---

# Set permissions for a file

`PUT /files/{fileId}/permissions`

## Request

- Base URL: `https://public-api.process.st/api/v1.1`
- URL: `https://public-api.process.st/api/v1.1/files/{fileId}/permissions`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Sets who can view or edit a file. Send the complete list of users and groups you want to grant access to; this replaces the permissions managed through this API. Use user emails or the group addresses returned by Get permissions. An empty list removes all permissions you can manage here. Of the system groups, only AllMembers can be set; AllAdmins, AllFreeMembers, AllGuests, and AllAnonymous are managed automatically. Both the submitted and resulting lists are limited to 1000 entries. If either exceeds the limit, nothing changes. Returns the updated permissions.

## Path parameters

- `fileId` string, required

## Request body

- FilePermissionEntry[]
  - `email` string, required: Email address.
  - `accessLevel` 'Edit' | 'View', required: Access level granted to a user on this file. - `Edit` — view, edit, and delete the file. - `View` — view the file (read-only).

## Response `200`

- PublicApiFilePermissionListResponse
  - `data` object[]: The list of resources returned by this request.
    - `email` string, required: Email address.
    - `accessLevel` 'Edit' | 'View' | 'Custom', required: Access level a user or group has on this file. `Edit` — view, edit, and delete the file. `View` — view the file (read-only). `Custom` — the user's underlying permission atoms don't match any predefined level; inspect the `permissions` object on the same entry for the actual atoms.
    - `permissions` object, required: Granular permission flags this user or group has on the file.
      - `fileRead` boolean, required: Can view the file.
      - `fileUpdate` boolean, required: Can edit the file.
      - `fileDelete` boolean, required: Can delete the file.
  - `links` object[]: Pagination links. When the result has more pages, look for an entry with `name: "next"` — its `href` is the URL to fetch the next page. Absence of `next` means there are no more pages. For single-resource responses this array is typically empty.
    - `name` string, required: Standard link relation name (RFC 5988) indicating this link's role. Common values include `self`, `edit`, `related`, `previous`, `next`.
    - `href` string, required: URL of the linked resource.
    - `rel` 'Approval Task' | 'Approvals' | 'Assignees' | 'Comment' | 'Data Set Records' | 'Data Sets' | 'Form Field Values' | 'Subject Task' | 'Task' | 'Tasks' | 'Users' | 'Webhook' | 'Workflow' | 'Workflow Run': Optional. The kind of resource this link points to (e.g. `Workflow`, `Task`, `Comment`).
    - `type` 'Api' | 'App', required: Whether this link targets an API endpoint or a Process Street app URL. `Api` — a callable API endpoint you can fetch directly. `App` — a browser-facing URL in the Process Street UI.

## Other responses

- `400`: Invalid value for: body
- `default`

## Changes

- **2026-10-30** `292a565ad8bc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/process/apis/process-street-public-api/changes/files/:fileId/permissions/put.md)

---

[API](https://skmtc.dev/process/apis/process-street-public-api.md) - [All operations](https://skmtc.dev/process/apis/process-street-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/process/apis/process-street-public-api/revisions/78ea0b3f3b40?raw)