---
title: "Replace a person's scoped roles"
method: PUT
path: "/v1/spaces/{spaceId}/people/{personId}/roles"
tags: ["Access"]
---

# Replace a person's scoped roles

`PUT /v1/spaces/{spaceId}/people/{personId}/roles`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/people/{personId}/roles`
- Auth: HTTP bearer

Replaces every direct scoped role assigned to one person. A new `commenter` role on a target the comments surface never shows returns 422 `comments_target_unavailable`; roles the person already holds are kept as they are.

## Path parameters

- `spaceId` string, required
- `personId` string, required

## Request body

- object
  - `grants` object[], required
    - `scope` string, required
    - `role` 'viewer' | 'commenter' | 'editor' | 'manager', required
    - `target` union
      - object
        - `kind` 'live', required
      - object
        - `kind` 'version', required
        - `versionId` string, required
      - object
        - `kind` 'branch', required
        - `branch` string, required
      - object
        - `kind` 'all_versions', required

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `id` string, required
    - `spaceId` string, required
    - `displayName` string, required
    - `email` string, email, nullable, required
    - `status` 'pending' | 'accepted' | 'revoked', required
    - `grants` object[], required
      - `id` string, required
      - `scope` string, required
      - `role` 'viewer' | 'commenter' | 'editor' | 'manager', required
      - `target` union, required
        - object
          - `kind` 'live', required
        - object
          - `kind` 'version', required
          - `versionId` string, required
        - object
          - `kind` 'branch', required
          - `branch` string, required
        - object
          - `kind` 'all_versions', required
      - `createdAt` string, date-time, required
      - `revokedAt` string, date-time, nullable, required
    - `invitedBy` string, nullable, required
    - `inviteExpiresAt` string, date-time, nullable, required
    - `acceptedAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)