# Update a permission group

```http
PUT https://secure.yoprint.com/v1/api/store/{team_slug}/setting/group/{hash_id}
```

- API version: v1
- Operation ID: `v1_public_group_update_put`
- Section: Team settings › [Permission groups](https://developer.yoprint.com/reference/permission-groups.md)
- Web page: https://developer.yoprint.com/reference/permission-groups/v1-group-update-put/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Renames a group or replaces its permissions, and returns it. The change applies at once to every member of the group.

The web app stops you from editing your own group; the API doesn't. Be careful not to remove Manage Settings from your own group.

## Permission

Needs the Manage Settings permission. The team's plan must include advanced permission management.

## Business rules

- `permissions`, when sent, has at least one known key and replaces the list.

## Side effects

- Members of the group get the new permissions immediately.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The permission group's `id`: a hash id from an earlier answer. Only hash ids work here; anything else answers 404 `page_not_found`. Example `aaNZmyj0mvmWLU`.

## Request body

Content type `application/json`, required.

Fields:

- `name` (string, optional)
- `permissions` (array of strings, optional): Replaces the whole list. Permission keys. `manage_setting` is Manage Settings, `manage_billing` Manage Billing, `manage_stock` Manage Stock. For orders, quotes, purchase orders and customers, `*_all_*` covers every record and `*_self_*` (or `*_assigned_*`) only records assigned to the member. `view_order_finance` is View Sales Order Pricing; `view_customer_finance` is View Customer Sales Aggregates. Repeated keys are accepted and saved as sent. One of: `"manage_setting"`, `"manage_stock"`, `"manage_billing"`, `"view_production_board"`, `"create_product"`, `"update_product"`, `"view_product"`, `"create_service"`, `"update_service"`, `"view_service"`, `"create_order"`, `"view_all_order"`, `"view_self_order"`, `"update_all_order"`, `"update_self_order"`, `"message_all_order"`, `"message_self_order"`, `"create_quote"`, `"view_all_quote"`, `"view_self_quote"`, `"update_all_quote"`, `"update_self_quote"`, `"create_po"`, `"view_all_po"`, `"view_self_po"`, `"update_all_po"`, `"update_self_po"`, `"view_all_customer"`, `"view_assigned_customer"`, `"update_assigned_customer"`, `"update_all_customer"`, `"create_customer"`, `"view_vendor"`, `"update_vendor"`, `"create_vendor"`, `"view_report"`, `"view_customer_finance"`, `"view_order_finance"`. At least 1 item.

### Example request

```bash
curl -X PUT 'https://secure.yoprint.com/v1/api/store/your-team/setting/group/aaNZmyj0mvmWLU' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "permissions": [
      "view_all_order",
      "message_all_order",
      "update_all_order",
      "view_all_customer"
    ]
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required)
  - `id` (string, required)
  - `name` (string, required)
  - `permissions` (array of strings, required): Permission keys. `manage_setting` is Manage Settings, `manage_billing` Manage Billing, `manage_stock` Manage Stock. For orders, quotes, purchase orders and customers, `*_all_*` covers every record and `*_self_*` (or `*_assigned_*`) only records assigned to the member. `view_order_finance` is View Sales Order Pricing; `view_customer_finance` is View Customer Sales Aggregates. Listed as saved, repeats included. One of: `"manage_setting"`, `"manage_stock"`, `"manage_billing"`, `"view_production_board"`, `"create_product"`, `"update_product"`, `"view_product"`, `"create_service"`, `"update_service"`, `"view_service"`, `"create_order"`, `"view_all_order"`, `"view_self_order"`, `"update_all_order"`, `"update_self_order"`, `"message_all_order"`, `"message_self_order"`, `"create_quote"`, `"view_all_quote"`, `"view_self_quote"`, `"update_all_quote"`, `"update_self_quote"`, `"create_po"`, `"view_all_po"`, `"view_self_po"`, `"update_all_po"`, `"update_self_po"`, `"view_all_customer"`, `"view_assigned_customer"`, `"update_assigned_customer"`, `"update_all_customer"`, `"create_customer"`, `"view_vendor"`, `"update_vendor"`, `"create_vendor"`, `"view_report"`, `"view_customer_finance"`, `"view_order_finance"`.
  - `users` (array of objects, required): The members in the group.
    - Each item:
      - `avatar_url` (string | null, required)
      - `email` (string, required)
      - `id` (string, required): The member's id, as List team members gives it.
      - `name` (string, required)
  - `version` (integer, required): The permission format. 3 for every group created or updated through the API.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "id": "aaNZmyj0mvmWLU",
    "name": "Sales Team",
    "permissions": [
      "view_all_order",
      "message_all_order",
      "update_all_order",
      "view_all_customer"
    ],
    "users": [
      {
        "avatar_url": null,
        "email": "alex@example.com",
        "id": "ZiGXY6Fzqgi3AM",
        "name": "Alex Rivera"
      }
    ],
    "version": 3
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
  - When: The API key is missing or wrong. Fix: Send your personal API key as `Authorization: Bearer YOUR_API_KEY`.
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
  - When: Your permission group lacks Manage Settings. This 403 has a short body, `{"message": "Insufficient Permission"}`, without `success` or `error`. Fix: Ask the team owner to give your permission group Manage Settings.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
  - When: No permission group with that id on this team (`error.code` is null and `error.message` starts "No query results"), the id is not one of this team's hash ids, or you are not a member of the team (both `page_not_found`). Fix: Use an `id` from the list operation and check the team slug.
- `422` The request was refused and changed nothing: `validation_failed` lists what to fix in `error.fields`, other codes name a business rule. When the team's plan does not include the feature, the body is only `{"message": "This feature is not available to your team's plan."}`.
  - When: The team's plan doesn't include advanced permission management. The body is short: `{"message": "This feature is not available to your team's plan."}`. Fix: Upgrade the plan.
  - When: `permissions` is empty or has an unknown key. `error.code` is `validation_failed`, and `error.fields` names each field with its messages. Fix: Fix the fields listed in `error.fields` and send the request again.

## Related

- [Show a permission group](https://developer.yoprint.com/reference/permission-groups/v1-group-show.md): `GET /v1/api/store/{team_slug}/setting/group/{hash_id}`