---
title: "Replace one role's permissions"
description: "Set permissions for this role only; other roles remain untouched, and permissions never cross between roles or require ordering."
canonical: "https://grid82.com/docs/builder-api/roles/set-permissions"
updated: "2026-11-13"
---

# Replace one role's permissions

`PUT https://studio.grid82.app/v1/apps/{appId}/roles/{roleId}/permissions`

Set permissions for this role only; other roles remain untouched, and permissions never cross between roles or require ordering.

Include every table the role should access; omitted tables become inaccessible. `tables` is `"*"` (everything, future tables included) or a map of table id to grant. Example, read all rows, edit only `stage`, hide every other field: `{"tables":{"tbl_deals":{"access":"granted","fields":{"mode":"selected","entries":{"fld_name":{"see":true},"fld_stage":{"see":true,"edit":true}}},"update":"all"}}}`. A field absent from `entries` is hidden; `fields: {"mode":"all","edit":"none"}` shows every field, future ones included. `rows`, `update` and `delete` take a filter group as views do, to limit rows. Simulate first if unsure who is affected. Send the `revision` from roles.get as `baseRevision`; if someone changed this role after that revision, the save is refused with 409 instead of erasing their change.

Requires the `schema:write` scope. Operation `roles.setPermissions`. MCP tool `roles_setPermissions`. CLI: `grid82 roles set-permissions` (`npx grid82`).

## Path parameters

| Name     | Type   | Required | Description |
| -------- | ------ | -------- | ----------- |
| `appId`  | string | yes      |             |
| `roleId` | string | yes      |             |

## Headers

| Name              | Type   | Required | Description                                                                                                                                                                                                                                                        |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Idempotency-Key` | string | no       | Any unique string. Sending the same key with the same request again returns the first response (marked `Idempotency-Replayed: true`) instead of running it twice. Reusing it for a different request is refused with 409. Kept for 24 hours. Up to 255 characters. |

## Request body

| Field          | Type           | Required | Description |
| -------------- | -------------- | -------- | ----------- |
| `tables`       | "\*" or object | yes      |             |
| `baseRevision` | string         | no       |             |

**Authorizations**

- `Authorization` (bearer, in header, required)

## Response

**200**: Success

- `data` (`object`, required)
- `data.version` (`number`, required)
- `data.roles` (`object[]`, required, items: `1–100 items`)
- `data.roles.id` (`string`, required, pattern: `^[a-z][a-z0-9_]{0,62}$`)
- `data.roles.name` (`string`, required, length: `1–120 chars`)
- `data.roles.description` (`string`, length: `≤ 500 chars`)
- `data.roles.assistantMonthlyCredits` (`integer`, range: `0–10000000`)
- `data.roles.interface` (`enum<string>`, one of: `assigned, own`)
- `data.roles.automations` (`enum<string>`, one of: `none, own`)
- `data.permissions` (`object[]`, required, items: `≤ 100 items`)
- `data.permissions.role` (`string`, required, pattern: `^[a-z][a-z0-9_]{0,62}$`)
- `data.permissions.tables` (`string | Record<string, object>`, required)
- `data.revision` (`string`, required)

```json
{
  "data": {
    "version": 123.45,
    "roles": [
      {
        "id": "<string>",
        "name": "<string>",
        "description": "<string>",
        "assistantMonthlyCredits": 123,
        "interface": "assigned",
        "automations": "none"
      }
    ],
    "permissions": [
      {
        "role": "<string>",
        "tables": "<string>"
      }
    ],
    "revision": "<string>"
  }
}
```

**4XX**: Refused

- `error` (`object`, required)
- `error.code` (`enum<string>`, required, one of: `not_found, forbidden, unauthenticated, validation_failed, conflict, rate_limited, payment_required, not_implemented, internal`)
- `error.message` (`string`, required)
- `error.details` (`Record<string, unknown>`)

```json
{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}
```

**Example request**

```bash
curl --request PUT \
  --url 'https://studio.grid82.app/v1/apps/<appId>/roles/<roleId>/permissions' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "tables": "<string>"
}'
```