# Update object permissions

Launch stage: GA

`PATCH /api/2.0/permissions/{request_object_type}/{request_object_id}`

Updates the permissions on an object. Objects can inherit permissions from their parent objects or root object.

API scopes: access-management

## Path parameters

- `request_object_type` (string, required)
  The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.
- `request_object_id` (string, required)
  The id of the request object.

## Request body

- `access_control_list` (array of object, optional)
  - `user_name` (string, optional)
    name of the user
  - `group_name` (string, optional)
    name of the group
  - `service_principal_name` (string, optional)
    application ID of a service principal
  - `permission_level` (string, optional)
    Possible values:
    - `CAN_MANAGE`
    - `CAN_RESTART`
    - `CAN_ATTACH_TO`
    - `IS_OWNER`
    - `CAN_MANAGE_RUN`
    - `CAN_VIEW`
    - `CAN_READ`
    - `CAN_RUN`
    - `CAN_EDIT`
    - `CAN_USE`
    - `CAN_MANAGE_STAGING_VERSIONS`
    - `CAN_MANAGE_PRODUCTION_VERSIONS`
    - `CAN_EDIT_METADATA`
    - `CAN_VIEW_METADATA`
    - `CAN_BIND`
    - `CAN_QUERY`
    - `CAN_MONITOR`
    - `CAN_CREATE`

## Returns

Returns the PermissionsResponse object.

## Response

```json
{
  "object_id": "string",
  "object_type": "string",
  "access_control_list": [
    {
      "user_name": "string",
      "group_name": "string",
      "service_principal_name": "string",
      "display_name": "string",
      "all_permissions": [
        {}
      ]
    }
  ]
}
```