---
title: "Update an endpoint permission (admin)"
method: PUT
path: "/admin/endpoint-permissions/{permission_id}"
tags: ["admin"]
---

# Update an endpoint permission (admin)

`PUT /admin/endpoint-permissions/{permission_id}`

## Request

- Base URL: `https://api.qualityclouds.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.qualityclouds.ai/admin/endpoint-permissions/{permission_id}`
- Auth: one of:
  - HTTP bearer
  - OpenID Connect (`https://account.qualityclouds.com//realms/ai-production/.well-known/openid-configuration`)

Updates action, resource_extractor, is_active, and description (req 2). Returns 400 when resource_extractor is not a valid strategy string. Supply expected_updated_at to enable optimistic concurrency checking; a 409 is returned when the row has been modified since last fetched.

## Path parameters

- `permission_id` string, uuid, required

## Request body

- UpdateEndpointPermissionRequest: Request body for PUT /admin/endpoint-permissions/{id} (req 3). Only the fields the admin UI is allowed to modify are exposed. expected_updated_at enables optimistic concurrency: when provided, the backend rejects the update with 409 if the row has changed since the UI last fetched it (req 5).
  - `action` string, nullable: Action required to call this endpoint (e.g. 'repo:view'). Set to null to make the endpoint public.
  - `resource_extractor` string, nullable: Strategy for extracting resource_id from the request (e.g. 'path:repository_id', 'jwt_org', 'none').
  - `is_active` boolean, required: Whether this endpoint is actively enforced by the authorization middleware.
  - `description` string, nullable: Human-readable description of the endpoint.
  - `expected_updated_at` string, date-time, nullable: Optimistic concurrency token. Supply the updated_at value received from the last GET. Omit to skip the concurrency check.

## Response `200`

Successful Response

- EndpointPermissionAdminResponse: Response schema for a single endpoint_permissions row (req 1, req 5). updated_at is included to allow optimistic concurrency checking in the admin UI: the UI must send this value back in PUT requests as expected_updated_at to detect concurrent modifications.
  - `id` string, uuid, required
  - `http_method` string, required
  - `path_pattern` string, required
  - `action` string, nullable, required
  - `resource_type` string, nullable, required
  - `resource_extractor` string, nullable, required
  - `description` string, nullable, required
  - `is_active` boolean, required
  - `updated_at` string, date-time, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `422`: Validation Error

---

[API](https://skmtc.dev/qualityclouds/apis/qai-orchestrator-api.md) · [All operations](https://skmtc.dev/qualityclouds/apis/qai-orchestrator-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qualityclouds/apis/qai-orchestrator-api/revisions/250c849925af?raw)