replaceFormGrants

PUT

/api/v1/data-sources/{id}/access/{userId}

Atomically replaces one user’s grants on the form with the supplied capabilities (submit, view_own, view_all, review, approve, manage), collapsing implied capabilities to a minimal set, in a single transaction with an audit entry. The form creator and global Owners cannot be edited here, and a manager cannot remove their own only management path. Requires the manage capability and CSRF.

Request Body^required

Media typeapplication/json

object

capabilities

required

Array<string>

Example^generated

{
  "capabilities": [
    "example"
  ]
}

Responses

200

Updated access entries under data.entries

403

Manage capability required

422

Invalid capability, creator edit, or self-management removal