> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Add Permissions to a User

> Grants permissions straight to one person, bypassing roles and groups.

Reach for this last. A direct grant has to be revoked person by person. The maintainable path is to grant the role to a group and manage membership.

Granting a permission the person already holds directly is not an error. On success the response has no body (204).

Failures:
- `400` — `permissions` is missing or empty.
- `404` — no such user in your organization, or one of the permissions does not exist.
- `422 IDE-1061` — a permission is reserved for machine credentials; no person may hold it. Removing it stays open.
- `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml post /v1/users/{id}/permissions
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager identity component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Identity API
  version: v1
servers:
  - url: https://identity.sandbox.lerian.net
security: []
tags:
  - description: >-
      M2M-only: each plugin declares its own permissions, roles and M2M
      contract, and the server reconciles them.
    name: Declarations
  - description: >-
      A tenant administrator's customers. Each partner holds what its
      credentials may DO (permissions, per product) and WHERE they may do it
      (scope, per product and dimension); an M2M application attached to one is
      confined to that intersection. Administrator-only: authorized on the
      "partners" resource, and every route resolves the owning organization from
      the caller's token.
    name: Partners
paths:
  /v1/users/{id}/permissions:
    post:
      tags:
        - Users
      summary: Add Permissions to a User
      description: >-
        Grants permissions straight to one person, bypassing roles and groups.


        Reach for this last. A direct grant has to be revoked person by person.
        The maintainable path is to grant the role to a group and manage
        membership.


        Granting a permission the person already holds directly is not an error.
        On success the response has no body (204).


        Failures:

        - `400` — `permissions` is missing or empty.

        - `404` — no such user in your organization, or one of the permissions
        does not exist.

        - `422 IDE-1061` — a permission is reserved for machine credentials; no
        person may hold it. Removing it stays open.

        - `503 IDE-0066` — the identity provider is unavailable (unreachable,
        too slow to answer, or failing). Nothing about the request was wrong;
        retry it later.
      operationId: addUserPermissions
      parameters:
        - description: User ID.
          in: path
          name: id
          required: true
          schema:
            description: User ID.
            examples:
              - 00000000-0000-0000-0000-000000000000
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssignPermissionsInput'
              description: The permissions to grant to the user.
        required: true
      responses:
        '204':
          description: No Content
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Bad Request
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Not Found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Unprocessable Entity
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
      security:
        - BearerAuth: []
components:
  schemas:
    AssignPermissionsInput:
      additionalProperties: false
      properties:
        permissions:
          description: Permission identifiers.
          items:
            type: string
          minItems: 1
          type: array
      required:
        - permissions
      type: object
    HTTPError:
      additionalProperties: false
      properties:
        code:
          type: string
        entityType:
          type: string
        err: {}
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.