# Set object permissions

Launch stage: GA

`PUT /api/2.0/permissions/{request_object_type}/{request_object_id}`

Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their parent objects or root object.

API scopes: access-management

## Path parameters

- `request_object_type` (string, required)
  The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.
- `request_object_id` (string, required)
  The id of the request object.

## Request body

- `access_control_list` (array of object, optional)
  - `user_name` (string, optional)
    name of the user
  - `group_name` (string, optional)
    name of the group
  - `service_principal_name` (string, optional)
    application ID of a service principal
  - `permission_level` (string, optional)
    Possible values:
    - `CAN_MANAGE`
    - `CAN_RESTART`
    - `CAN_ATTACH_TO`
    - `IS_OWNER`
    - `CAN_MANAGE_RUN`
    - `CAN_VIEW`
    - `CAN_READ`
    - `CAN_RUN`
    - `CAN_EDIT`
    - `CAN_USE`
    - `CAN_MANAGE_STAGING_VERSIONS`
    - `CAN_MANAGE_PRODUCTION_VERSIONS`
    - `CAN_EDIT_METADATA`
    - `CAN_VIEW_METADATA`
    - `CAN_BIND`
    - `CAN_QUERY`
    - `CAN_MONITOR`
    - `CAN_CREATE`

## Returns

Returns the PermissionsResponse object.

## Response

```json
{
  "object_id": "string",
  "object_type": "string",
  "access_control_list": [
    {
      "user_name": "string",
      "group_name": "string",
      "service_principal_name": "string",
      "display_name": "string",
      "all_permissions": [
        {}
      ]
    }
  ]
}
```