---
metadata:
  - name: generator
    content: Diplodoc Platform v5.64.0
  - property: og:type
    content: article
  - property: article:section
    content: API reference
  - property: og:title
    content: Updating dashboard permissions
alternate:
  - https://yandex.com.tr/support/tracker/en/api/dashboards/update-dashboard-permissions.md
  - href: https://yandex.com.tr/support/tracker/en/api/dashboards/update-dashboard-permissions.md
    type: text/markdown
    title: Markdown version
  - href: https://yandex.com.tr/support/tracker/en/llms.txt?revision=r21825371
    rel: describedby
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.com.tr/support/tracker/en/llms.txt?revision=r21825371


# Updating dashboard permissions

Use this request to grant or revoke dashboard permissions. You need the `GRANT` permission to make the request.

<div class="request_example yfm-code-floating-container method_patch">
    <p>PATCH</p>
    <pre><code>https://api.tracker.yandex.net/v3/dashboards/{dashboard_ID}/permissions?version=DASHBOARD_VERSION</code></pre>
    <button class="yfm-clipboard-button"><svg width="16" height="16" viewBox="0 0 24 24" class="yfm-clipboard-icon" data-animation="15">
    <path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path>
    <path stroke="currentColor" fill="transparent" strokewidth="1.5" d="M9.5 13l3 3l5 -5" visibility="hidden">
        <animate id="visibileAnimation-15" attributeName="visibility" from="hidden" to="visible" dur="0.2s" fill="freeze" begin=""></animate>
        <animate id="hideAnimation-15" attributeName="visibility" from="visible" to="hidden" dur="1s" begin="visibileAnimation-15.end+1" fill="freeze"></animate>
    </path>
</svg>
</button>
</div>

<!-- source: en/api/_assets/style/methods.md -->

<!-- endsource: en/api/_assets/style/methods.md -->

## Request format {#request}

Before making a request, [get permission to access the API](https://yandex.com.tr/support/tracker/en/api/access.md). Specify the current dashboard version in the `version` parameter or the `If-Match` header.

```json translate=no
PATCH /v3/dashboards/{dashboard_ID}/permissions?version=DASHBOARD_VERSION
Host: api.tracker.yandex.net
Authorization: OAuth API_TOKEN
Content-Type: application/json
X-Org-ID or X-Cloud-Org-ID: ORGANIZATION_ID

{
  "grant": {
    "READ": {"users": [{"id": "USER_ID"}], "groups": [], "roles": []}
  },
  "revoke": {
    "WRITE": {"users": [], "groups": [{"id": "GROUP_ID"}], "roles": []}
  }
}
```

<!-- source: en/api/_includes/headings.md -->
{% cut "Headers" %}

* `Host`: address of the node that provides the API.

* <!-- source: en/api/_includes/authorization.md -->
  `Authorization`: Authorization token about these formats:

    - `OAuth OAUTH_TOKEN`: For authorization using the OAuth 2.0 protocol. [Learn more](https://yandex.com.tr/support/tracker/en/api/access.md#about_OAuth)

    - `Bearer IAM_TOKEN`: For authorization using an IAM token, if a Yandex Identity Hub organization is linked to Tracker. [Learn more](https://yandex.com.tr/support/tracker/en/api/access.md#iam-token)
  <!-- endsource: en/api/_includes/authorization.md -->


* <!-- source: en/api/_includes/org-id.md -->
  # ID types {#types}


  `X-Org-ID` or `X-Cloud-Org-ID`: Organization ID.

  - Use the `X-Org-ID` header if a Tracker organization is linked to Yandex 360 for Business.

  - Use the `X-Cloud-Org-ID` header if a Tracker organization is linked to Yandex Identity Hub.


  # Finding the ID {#find-id}


  To get the organization ID, go to **Administration** → [**Organizations**](https://tracker.yandex.com/admin/orgs) and copy the value from the **ID** field.
  <!-- endsource: en/api/_includes/org-id.md -->


{% endcut %}
<!-- endsource: en/api/_includes/headings.md -->

{% cut "Resource" %}

#|
|| **Parameter** | **Description** | **Data type** ||
|| dashboard_ID | Dashboard ID. | Number ||
|#

{% endcut %}

{% cut "Request parameters" %}

Pass the dashboard version in the `version` parameter or the `If-Match` header.

#|
|| **Parameter** | **Description** | **Data type** ||
|| version | Current dashboard version. Specify it if you did not pass the `If-Match` header. | Number ||
|#

{% endcut %}

{% cut "Additional headers" %}

#|
|| **Header** | **Description** ||
|| If-Match | Current dashboard version in double quotes, for example `"4"`. Specify it if you did not pass the `version` parameter. ||
|#

{% endcut %}

{% cut "Request body parameters" %}

#|
|| **Parameter** | **Description** | **Data type** ||
|| grant | Permissions to grant. | Object ||
|| revoke | Permissions to revoke. | Object ||
|#

**Fields of the** `grant` **and** `revoke` **objects**

#|
|| **Parameter** | **Description** | **Data type** ||
|| READ | Read access. | Object ||
|| WRITE | Write access. | Object ||
|| GRANT | Access management. | Object ||
|#

**Fields of the** `READ`, `WRITE`, **and** `GRANT` **objects**

#|
|| **Parameter** | **Description** | **Data type** ||
|| users | Users with the permission. Each object contains an `id`. | Array of objects ||
|| groups | Groups with the permission. Each object contains an `id`. | Array of objects ||
|| roles | System roles with the permission. Pass an array of strings, for example `["OWNER"]`. | Array of strings ||
|#

{% endcut %}

## Response format {#response}

{% list tabs %}

- Request executed successfully

    <!-- source: en/api/_includes/answer-200.md -->
    If the request is successful, the API returns a response with code `200 OK`.
    <!-- endsource: en/api/_includes/answer-200.md -->

    On success, the API returns the updated permissions object.

    ```json translate=no
    {
      "acl": {
        "READ": {
          "users": [],
          "groups": [
            {
              "self": "https://api.tracker.yandex.net/v3/groups/3",
              "id": "3",
              "display": "All employees"
            }
          ],
          "roles": []
        },
        "WRITE": {
          "users": [
            {
              "self": "https://api.tracker.yandex.net/v3/users/1234567890",
              "id": "1234567890",
              "display": "User"
            }
          ],
          "groups": [],
          "roles": [
            {
              "id": "OWNER",
              "name": "Owner"
            }
          ]
        },
        "GRANT": {
          "users": [],
          "groups": [],
          "roles": [
            {
              "id": "OWNER",
              "name": "Owner"
            }
          ]
        }
      }
    }
    ```

    {% cut "Response parameters" %}

    #|
    || **Parameter** | **Description** | **Data type** ||
    || acl | Effective permissions. | Object ||
    || inheritedFrom | Source of inherited permissions. Omitted when permissions are set directly on the dashboard. | Object ||
    |#

    **Fields of the** `acl` **object**

    #|
    || **Parameter** | **Description** | **Data type** ||
    || READ | Subjects with read access. | Object ||
    || WRITE | Subjects with write access. Also grants `READ`. | Object ||
    || GRANT | Subjects who can manage access. | Object ||
    |#

    **Fields of the** `READ`, `WRITE`, **and** `GRANT` **objects**

    #|
    || **Parameter** | **Description** | **Data type** ||
    || users | User references. [User object fields](https://yandex.com.tr/support/tracker/en/api/dashboards/create-dashboard.md#user). | Array of objects ||
    || groups | Group references with `self`, `id`, and `display` fields. | Array of objects ||
    || roles | System roles with `id` and `name` fields. | Array of objects ||
    |#


    **Fields of elements in the** `groups` **array**

    #|
    || **Parameter** | **Description** | **Data type** ||
    || self | Group API resource URL. | String ||
    || id | Group ID. | String ||
    || display | Group name. | String ||
    |#

    **Fields of elements in the** `roles` **array**

    #|
    || **Parameter** | **Description** | **Data type** ||
    || id | System role ID, for example `OWNER`. | String ||
    || name | Role name. | String ||
    |#

    {% endcut %}

- Request failed

    If the request is processed incorrectly, the API returns a response with an error code:

    <!-- source: en/api/_includes/answer-error-400.md -->
    400
    :   One or more request parameters have an invalid value.
    <!-- endsource: en/api/_includes/answer-error-400.md -->

    Invalid request body or `If-Match` header format, or the dashboard permissions are inherited.

    <!-- source: en/api/_includes/answer-error-403.md -->
    403
    :   You are not authorized to perform this action. You can check what rights you have in the Tracker interface. The same rights are required to perform an action via the API and interface.
    <!-- endsource: en/api/_includes/answer-error-403.md -->

    No `GRANT` permission for the dashboard.

    <!-- source: en/api/_includes/answer-error-404.md -->
    404
    :   The requested object was not found. You may have specified an invalid object ID or key.
    <!-- endsource: en/api/_includes/answer-error-404.md -->

    <!-- source: en/api/_includes/answer-error-412.md -->
    412
    :   A conflict occurred while editing the object. The error may be due to an invalid update version.
    <!-- endsource: en/api/_includes/answer-error-412.md -->

    <!-- source: en/api/_includes/answer-error-422.md -->
    422
    :   JSON validation error, the request is rejected.
    <!-- endsource: en/api/_includes/answer-error-422.md -->

    User or group not found.

    <!-- source: en/api/_includes/answer-error-428.md -->
    428
    :   Access to the resource is denied. Make sure all required conditions for the request are specified.
    <!-- endsource: en/api/_includes/answer-error-428.md -->

    Neither `version` nor `If-Match` was provided.

{% endlist %}