Grant one or more users read or write access to a data release.

Each permission assignment maps a Globus username to a read or write permission. The corresponding Globus identities are resolved from the username and added as members of the release's permission groups:

• read → members are added to the release's read-only (R) group, granting the ability to view the release and its files.
• write → members are added to the release's read-write (RW) group, granting the ability to view and modify the release and its files.

Members are added with the manager role so they may in turn manage group membership.

The request body accepts either a single permission object or a list of them, so multiple users and permission levels can be granted in one call:

.. code-block::

[
    {"globus_username": "user1@example.org", "permission": "read"},
    {"globus_username": "user2@example.org", "permission": "write"}
]

The caller must have an existing role on the release; otherwise a 403 Forbidden is returned.

Note: this endpoint operates on the release's Globus groups directly. It is intended for releases that have not yet been published, as publishing removes the release's permission groups.

Globus applies each membership change independently, so a partial failure is possible. The response data contains the release's permissions after the update and an errors list describing any add actions Globus rejected (with the affected username, permission, and reason). If any action failed, success is false.

:param id: The ID of the data release to grant permissions on. :param data: A single permission assignment or a list of assignments, each pairing a Globus username with a read or write permission. :param token: A valid bearer token for the user making the request. :raises ForbiddenException: If the caller has no role on the release. :raises NotFoundException: If no data release exists for the given ID. :return: The updated membership and any per-identity failures reported by Globus.