# Update Object Permissions

Launch stage: GA

`PATCH /api/2.0/permissions/{request_object_type}/{request_object_id}`

Updates the permissions on an object. Objects can inherit permissions from their parent objects or root object.

API scopes: access-management

## Path parameters

- `request_object_type` (string, optional)
  The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.
- `request_object_id` (string, optional)
  The id of the request object.

## Request body

- `access_control_list` (array of object, optional)
  - `user_name` (string, required)
    name of the user
  - `group_name` (string, required)
    name of the group
  - `service_principal_name` (string, required)
    application ID of a service principal
  - `permission_level` (string, optional)
    Possible values: `CAN_MANAGE`, `CAN_RESTART`, `CAN_ATTACH_TO`, `IS_OWNER`, `CAN_MANAGE_RUN`, `CAN_VIEW`, `CAN_READ`, `CAN_RUN`, `CAN_EDIT`, `CAN_USE`, `CAN_MANAGE_STAGING_VERSIONS`, `CAN_MANAGE_PRODUCTION_VERSIONS`, `CAN_EDIT_METADATA`, `CAN_VIEW_METADATA`, `CAN_BIND`, `CAN_QUERY`, `CAN_MONITOR`, `CAN_CREATE`

## Returns

- `object_id` (string, optional)
- `object_type` (string, optional)
- `access_control_list` (array of object, optional)
  - `user_name` (string, required)
    name of the user
  - `group_name` (string, required)
    name of the group
  - `service_principal_name` (string, required)
    Name of the service principal.
  - `display_name` (string, optional)
    Display name of the user or service principal.
  - `all_permissions` (array of object, optional)
    All permissions.
    - `permission_level` (string, optional)
      Possible values: `CAN_MANAGE`, `CAN_RESTART`, `CAN_ATTACH_TO`, `IS_OWNER`, `CAN_MANAGE_RUN`, `CAN_VIEW`, `CAN_READ`, `CAN_RUN`, `CAN_EDIT`, `CAN_USE`, `CAN_MANAGE_STAGING_VERSIONS`, `CAN_MANAGE_PRODUCTION_VERSIONS`, `CAN_EDIT_METADATA`, `CAN_VIEW_METADATA`, `CAN_BIND`, `CAN_QUERY`, `CAN_MONITOR`, `CAN_CREATE`
    - `inherited` (boolean, optional)
    - `inherited_from_object` (array of string, optional)

## Response

```json
{
  "object_id": "string",
  "object_type": "string",
  "access_control_list": [
    {
      "user_name": "string",
      "group_name": "string",
      "service_principal_name": "string",
      "display_name": "string",
      "all_permissions": [
        {}
      ]
    }
  ]
}
```