---
title: "Set Platform Privileges"
method: PUT
path: "/api/admin/identities/{identity_id}/platform-privileges"
tags: ["admin-identities"]
---

# Set Platform Privileges

`PUT /api/admin/identities/{identity_id}/platform-privileges`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/admin/identities/{identity_id}/platform-privileges`
- Auth: none declared

Grant or revoke platform privilege tiers (TOS-3571).

Replaces the SQL-only promote path: before this route the flag had no
application-code writer at all, and the only zero-admin check that ever ran
was inside migration 093 at apply time.

``require_admin`` is Tier-1-only (``role`` derives from
``is_platform_admin``), which is what makes Tier 2 non-self-service: a
read-only holder cannot reach this route, and neither can an agent's owner.

## Path parameters

- `identity_id` string, uuid, required

## Request body

- SetPlatformPrivilegesRequest: Partial update: omit a tier to leave it untouched.
  - `is_platform_admin` boolean, nullable
  - `is_platform_admin_readonly` boolean, nullable

## Response `200`

Successful Response

- PlatformPrivilegeOut: The two platform privilege tiers on one identity (TOS-3571).
  - `identity_id` string, uuid, required
  - `kind` string, required
  - `is_active` boolean, required
  - `is_platform_admin` boolean, required
  - `is_platform_admin_readonly` boolean, required
  - `is_last_full_admin` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/5fdd1072e877?raw)