Skip to main content
PUT
Update user Administrative permissions (internal/domain)
Updates a user’s administrative permissions — the global capabilities a user holds (e.g. User Management, Privileged Accounts Management, Tenant Management, System Configuration). This is replacement semantics: the supplied set of permissions becomes the user’s full set.
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Permissions required

The Access Token must be issued to a user with the administrative User Management permission.

Replacement semantics — read before write

This endpoint replaces the user’s administrative permissions with the supplied set. To add or remove individual permissions, first call Get user details to read the current set, then PUT the desired modified set.
Don’t accidentally remove your own User Management permission. If the Access Token’s user is the one being modified, removing User Management permission ends API access mid-call. Syteca prevents removing User Management from the last holder, but you can lock yourself out of admin functions by removing it from yourself when others still hold it.

Common use cases

  • Role promotion — A user moves into an admin role; grant administrative permissions programmatically.
  • Periodic permission audit — Quarterly automation reads, validates, and corrects each user’s permissions against an external policy source of truth.
  • Compliance remediation — Bulk-remove a permission from all users who shouldn’t have it after a policy change.

Errors

See Status codes. Common errors:
  • 400 Bad Request — invalid permission identifier.
  • 403 Forbidden — caller lacks User Management permission.
  • 404 Not Found — user doesn’t exist.
  • 409 Conflict — attempting to remove User Management from the last holder.

Get user details

Read current permissions before updating.

Update client access

Modify per-Client access rules.

Update user access

Modify User-to-User access rules.

Administrative permissions

List of all admin permissions.

Authorizations

Authorization
string
header
required

Access token for authentication

Path Parameters

userId
integer<int32>
required

ID of the user to update Administrative permissions

Body

application/json
admin_permission_keys
string[] | null

List of administrative permission identifiers to assign directly to the user

Administrative permission identifier

Response

Administrative permissions for a user updated successfully