Update a permission group

PUT/v1/api/store/{team_slug}/setting/group/{hash_id}

v1Operation ID v1_public_group_update_put

Renames a group or replaces its permissions, and returns it. The change applies at once to every member of the group.

The web app stops you from editing your own group; the API doesn't. Be careful not to remove Manage Settings from your own group.

Permission

Needs the Manage Settings permission. The team's plan must include advanced permission management.

Business rules

• permissions, when sent, has at least one known key and replaces the list.

Side effects

• Members of the group get the new permissions immediately.

Path parameters

• team_slugstringrequired

  Your team slug, shown as Team ID next to your API key in Profile.

  • Example your-team
• hash_idstringrequired

  The permission group's id: a hash id from an earlier answer. Only hash ids work here; anything else answers 404 page_not_found.

  • Example aaNZmyj0mvmWLU

Request body

application/json, required.

• namestring
• permissionsarray of strings

  Replaces the whole list. Permission keys. manage_setting is Manage Settings, manage_billing Manage Billing, manage_stock Manage Stock. For orders, quotes, purchase orders and customers, *_all_* covers every record and *_self_* (or *_assigned_*) only records assigned to the member. view_order_finance is View Sales Order Pricing; view_customer_finance is View Customer Sales Aggregates. Repeated keys are accepted and saved as sent.

  • Each item is one of: "manage_setting", "manage_stock", "manage_billing", "view_production_board", "create_product", "update_product", "view_product", "create_service", "update_service", "view_service", "create_order", "view_all_order", "view_self_order", "update_all_order", "update_self_order", "message_all_order", "message_self_order", "create_quote", "view_all_quote", "view_self_quote", "update_all_quote", "update_self_quote", "create_po", "view_all_po", "view_self_po", "update_all_po", "update_self_po", "view_all_customer", "view_assigned_customer", "update_assigned_customer", "update_all_customer", "create_customer", "view_vendor", "update_vendor", "create_vendor", "view_report", "view_customer_finance", "view_order_finance"
  • At least 1 item

Response

200Successful response.

• dataobjectrequired
  Child fields (5)

  • idstringrequired
  • namestringrequired
  • permissionsarray of stringsrequired

    Permission keys. manage_setting is Manage Settings, manage_billing Manage Billing, manage_stock Manage Stock. For orders, quotes, purchase orders and customers, *_all_* covers every record and *_self_* (or *_assigned_*) only records assigned to the member. view_order_finance is View Sales Order Pricing; view_customer_finance is View Customer Sales Aggregates. Listed as saved, repeats included.

    • Each item is one of: "manage_setting", "manage_stock", "manage_billing", "view_production_board", "create_product", "update_product", "view_product", "create_service", "update_service", "view_service", "create_order", "view_all_order", "view_self_order", "update_all_order", "update_self_order", "message_all_order", "message_self_order", "create_quote", "view_all_quote", "view_self_quote", "update_all_quote", "update_self_quote", "create_po", "view_all_po", "view_self_po", "update_all_po", "update_self_po", "view_all_customer", "view_assigned_customer", "update_assigned_customer", "update_all_customer", "create_customer", "view_vendor", "update_vendor", "create_vendor", "view_report", "view_customer_finance", "view_order_finance"
  • usersarray of objectsrequired

    The members in the group.

    Fields of each item (4)

    • avatar_urlstring | nullrequired
    • emailstringrequired
    • idstringrequired

      The member's id, as List team members gives it.

    • namestringrequired
  • versionintegerrequired

    The permission format. 3 for every group created or updated through the API.

• statusintegerrequired
• successbooleanrequired

Errors

• 401The API key is missing or wrong (unauthenticated).

  When

  The API key is missing or wrong.

  Fix

  Send your personal API key as Authorization: Bearer YOUR_API_KEY.

• 403You are not allowed to do this. api_access_not_in_plan: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only {"message": "Insufficient Permission"}. Other refusals use the error envelope, with unauthorized or user_is_not_authorized.

  When

  Your permission group lacks Manage Settings. This 403 has a short body, {"message": "Insufficient Permission"}, without success or error.

  Fix

  Ask the team owner to give your permission group Manage Settings.

• 404Not found. page_not_found: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. code: null, with a message that starts "No query results for": there is no record with that id.

  When

  No permission group with that id on this team (error.code is null and error.message starts "No query results"), the id is not one of this team's hash ids, or you are not a member of the team (both page_not_found).

  Fix

  Use an id from the list operation and check the team slug.

• 422The request was refused and changed nothing: validation_failed lists what to fix in error.fields, other codes name a business rule. When the team's plan does not include the feature, the body is only {"message": "This feature is not available to your team's plan."}.

  When

  The team's plan doesn't include advanced permission management. The body is short: {"message": "This feature is not available to your team's plan."}.

  Fix

  Upgrade the plan.

  When

  permissions is empty or has an unknown key. error.code is validation_failed, and error.fields names each field with its messages.

  Fix

  Fix the fields listed in error.fields and send the request again.

Related

• GETShow a permission group/v1/api/store/{team_slug}/setting/group/{hash_id}

Example request

curl

curl -X PUT 'https://secure.yoprint.com/v1/api/store/your-team/setting/group/aaNZmyj0mvmWLU' \  -H 'Authorization: Bearer YOUR_API_KEY' \  -H 'Accept: application/json' \  -H 'X-Yoprint-Decimal-Format: exact-v1' \  -H 'Content-Type: application/json' \  -d '{    "permissions": [      "view_all_order",      "message_all_order",      "update_all_order",      "view_all_customer"    ]  }'

Example response 200

Response

{
  "data": {
    "id": "aaNZmyj0mvmWLU",
    "name": "Sales Team",
    "permissions": [
      "view_all_order",
      "message_all_order",
      "update_all_order",
      "view_all_customer"
    ],
    "users": [
      {
        "avatar_url": null,
        "email": "alex@example.com",
        "id": "ZiGXY6Fzqgi3AM",
        "name": "Alex Rivera"
      }
    ],
    "version": 3
  },
  "status": 200,
  "success": true
}