---
title: "REST API: Update Permissions"
type: "wiki"
space: "Axero Documentation"
author: "Anonymous User"
created: 2019-06-04T10:12:01Z
updated: 2026-09-28T01:21:22Z
tags: ["API"]
url: "https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/32996/rest-api-update-permissions"
---

# REST API: Update Permissions

[Open API Guide](https://my.axerosolutions.com/spaces/5/axero-documentation/api-guide?id=32996)
PUT/api/permissions/access

Set a role's permissions on an entity type, site-wide, in a space, or on one item. ResponseData is true when the permissions were saved.

## Request

### Request Header
| Header | Required | Value | Description |
| :--- | :--- | :--- | :--- |
| `Authorization` | YES | `Bearer YOUR_TOKEN` | Bearer token for the authenticated user. [Learn how to create Bearer tokens](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/108973/creating-bearer-tokens). |
| `Content-Type` | YES | `application/json` | Must be set to `application/json` |
### Required Parameters
| Parameter | Type | Required | Location | Description |
| :--- | :--- | :--- | :--- | :--- |
| `EntityType` | Integer | YES | Query | Entity type the permissions apply to; see [REST API: System Entity Types](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/25112/rest-api-system-entity-types "REST API: System Entity Types"). A comma-separated list is not refused: its numbers are combined into one value, so 1,2 is read as 3. For a site administrator, a number that names no entity type is not refused either: the permissions are saved against that number, where no item uses them. |
| `RoleID` | Integer | YES | Query | Unique identifier for a particular role |
| `Permissions` | String | YES | Body | JSON object of permission names and true or false values for the role; see [REST API: Permission Types](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/25171/rest-api-permission-types "REST API: Permission Types"). A request without a body answers 500: the endpoint prepares a 400 for it but never sends it, and the save fails. A name that is not a permission is skipped. |
### Optional Parameters
| Parameter | Type | Required | Location | Description |
| :--- | :--- | :--- | :--- | :--- |
| `EntityID` | Integer | NO | Query | ID of the item, for entity types whose permissions are set per item: file folders, forums, and forum groups. Leave it out \(default 0\) to set the entity type's default permissions. |
| `SpaceID` | Integer | NO | Query | Space whose permissions are set. Default: 0, the site level. A value that is not a whole number is ignored, and the site-level permission is changed instead. |
| `ContentTypeID` | Integer | NO | Query | Content type ID, for permissions on a custom content type. Default: none. A value that is not a whole number is ignored. |
## Example

### Request Header

```
Authorization: Bearer YOUR_TOKEN
Content-Type: application/json
```

### Request URL

`https://your-site.com/api/permissions/access?entitytype=3&roleid=3`

### Request Body

```
{
  "Create": true
}
```

### Success Response

```
{
  "IsError": false,
  "ResponseMessage": "",
  "ResponseData": true
}
```

### Error Response

```
{
  "Message": "No HTTP resource was found that matches the request URI 'https://your-site.com/api/permissions/access?RoleID=37'."
}
```

## Error Handling

| Status Code | Likely Cause | Next Action |
| :--- | :--- | :--- |
| 400 Bad Request | RoleID, SpaceID, EntityID, or ContentTypeID is not an integer, or EntityType is not a number or an entity type name. | Send RoleID and EntityType in the query string. |
| 401 Unauthorized | Missing or invalid Bearer token. | Check token validity. [Learn how to create Bearer tokens →](https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/108973/creating-bearer-tokens) |
| 403 Forbidden | The caller is not a site administrator and cannot modify permissions for this space, entity type, and entity. | Confirm the user has the required roles for this action. |
| 500 Server Error | The request has no body, or another internal failure. The body is empty. | Send a JSON object of permission names. |
| 404 or 405 | A required query parameter was left out, so the request matched a different action or none. The message reads No HTTP resource was found or The requested resource does not support http method. | Send every required query parameter. The message does not mean the item you asked for is missing. |

## Rate Limits

While Axero does not enforce hard rate limits by default, we recommend the following best practices to ensure optimal performance:

- **Sustained Request Rate:** Do not exceed 5 API calls per second
- **Sequential Processing:** Wait for each request to complete before sending the next in automated workflows
- **Concurrent Connections:** If parallel processing is required, limit to 3 or fewer simultaneous requests
- **Response Timeout:** Ensure API responses complete within 15 seconds during testing

Axero may implement temporary rate restrictions if excessive API usage affects overall site performance. For high-volume integrations, contact Axero to discuss your requirements.