---
title: "Grant or revoke a permission for a user"
method: POST
path: "/api/permissions"
tags: ["Roles & Permissions"]
---

# Grant or revoke a permission for a user

`POST /api/permissions`

## Request

- Base URL: `https://api.sponsorunited.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sponsorunited.com/api/permissions`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/sponsorunited/apis/sponsorunited-api/docs/api/permissions/post.ts> (a function with typed inputs; its response is checked against the schema)

Attaches an existing permission to a user, or detaches it, and returns the user's resulting permission names. This does not create new permissions.

## Request body

- PermissionSetRequest
  - `permissionName` string, required: Name of the permission in slug format.
  - `userId` integer, required: Identifier of the user the permission applies to.
  - `allow` boolean, required: True grants the permission to the user, false revokes it.

## Response `200`

The permission names the user holds after the change.

- object
  - `permissions` string[]

## Other responses

- `404`: User does not exist, or the permission does not exist.
- `500`: Permission already attached to user.

---

[API](https://skmtc.dev/sponsorunited/apis/sponsorunited-api.md) - [All operations](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/revisions/cbf1ca5bff8f?raw)