---
title: "Set user-specific access control for a script."
method: PUT
path: "/api/v1/script/{script_id}/access/users"
---

# Set user-specific access control for a script.

`PUT /api/v1/script/{script_id}/access/users`

**Authentication**: JWT token required
**Authorization**: Admin level access required (ADMIN or SUPERADMIN)
**Purpose**: Configure which specific users can access and execute a script

**Path Parameters**:
- `script_id`: Script identifier/slug or numeric ID

**Request Schema**:
```json
{
  "users": ["user123", "user456"]
}
```

**Request Fields**:
- `users`: Array of user IDs that should have access
  (empty array removes restrictions)

**User Validation**:
- All provided user IDs must exist in the system
- User IDs can be numeric IDs or email addresses
- Invalid user IDs will cause the request to fail

**Response Schema**:
```json
{
  "data": {
    "script_id": "12345",
    "restricted": true,
    "allowed_roles": [],
    "allowed_users": ["user123", "user456"],
    "access_type": "user_restricted"
  }
}
```

**Behavior**:
- Empty users array removes all user-specific restrictions
- Non-empty array restricts access to specified users only
- User restrictions work independently of role restrictions
- Users in the allowed list can access script regardless of their role

**Access Logic**:
- If both role and user restrictions exist: user must match either criteria
- User-specific access overrides role-based restrictions
- Admins can always access scripts regardless of restrictions

**Use Cases**:
- Grant script access to specific researchers or partners
- Create private scripts for limited user groups
- Implement per-project script access controls
- Beta testing with selected users

**Error Responses**:
- `400 Bad Request`: Missing 'users' field, invalid user IDs, or user not found
- `401 Unauthorized`: JWT token required
- `403 Forbidden`: Admin privileges required
- `404 Not Found`: Script does not exist
- `500 Internal Server Error`: Failed to update access controls

## Path parameters

- `script_id` string, required

## Request body

- object

## Response `200`

Success

- object

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.dev/trends/apis/trends-earth-api.md) · [All operations](https://skmtc.dev/trends/apis/trends-earth-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trends/trends-earth-api/revisions/6bdbc0b84666/schema)