Set a member's permission overrides (admin only)

PUT 
/api/users/:userId/permissions

Sets a team member's per-user permission overrides (grant/revoke on top of their role). ADMIN-ONLY. Admin-reserved permissions (e.g. members.manage) are silently dropped from grants so no one can be escalated; a permission in both lists is treated as revoked.

Request

Responses

200

The updated member.

401

Not authenticated. code: account_disabled means the member's seat was deactivated in this workspace: the session is over even though the token was not revoked (clients sign out and clean up).

403

Authenticated but not allowed.

404

Resource not found (or not visible to the current tenant).

422

The request failed validation.