---
title: "POST /api/permissions/exceptions"
method: POST
path: "/api/permissions/exceptions"
tags: ["Permissions"]
---

# POST /api/permissions/exceptions

`POST /api/permissions/exceptions`

Share (allow) or deny a specific record for a user. Deny wins; sharing a denied record is rejected.

## Request body

- object
  - `userId` string, required
  - `permission` string, required
  - `resourceType` string, required
  - `resourceId` string, required
  - `effect` 'allow' | 'deny', required

## Response `200`

Default Response

- object
  - `metadata` object, required
    - `success` boolean, required — True when the request succeeded.
  - `data` object, required
    - `ok` boolean, required

## Other responses

- `409` — Default Response

## Changes

- **2026-08-20** `976ee26dacda` — 1 warning
  - changed the pattern of the request property `permission` from `^[^:]+:.+$` to `^[^:]+:(create|read|edit|delete|archive)$`

[Change history](https://skmtc.dev/retraced/apis/api-reference/changes/api/permissions/exceptions/post.md)

---

[API](https://skmtc.dev/retraced/apis/api-reference.md) · [All operations](https://skmtc.dev/retraced/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/retraced/api-reference/revisions/60d6c901bc4e/schema)