Skip to main content
POST
cURL
This endpoint is not a plain create. It is a declarative bulk upsert: you describe the access you want, and Nekt works out which grants to create, which to change, and which to remove. Each entry in assignments is a cross product. Every recipient in users and groups is paired with every resource in layers, folders, tables, and volumes, and each resulting pair gets permission_level. Two users and three tables in one assignment is six grants.

Request body

Each object in assignments: Recipient ids come from List Permission Recipients. Resource ids come from List Layers, the folders, tables, and volumes endpoints.
notify_members and message are accepted by this endpoint but do not send email. They are carried over from an earlier version of the API. Grants take effect regardless; recipients are simply not notified.

Response

Each list holds full permission objects. A pair that already had the level you asked for appears in none of them — the call is idempotent.

Grant one level on one table

Onboard a group across a whole layer

Granting on a layer covers the folders, tables, and volumes inside it. You do not need to enumerate them.

Grant and revoke in one request

Different levels need separate assignment blocks. This is how you move someone up on one resource and off another atomically.
Two assignments that target the same recipient and the same resource with different levels are rejected with 400 naming the conflicting positions. Repeating the same pair at the same level is fine and simply ignored.

Python: mirror a group’s access onto a new member

Errors

Authorizations

x-api-key
string
header
required

API Key authentication. Format: 'x-api-key: api_key'

Body

assignments
object[]
required
write-only
notify_members
boolean
default:false
write-only
message
string
write-only

Response

201 - application/json
created
object[]
required
read-only
updated
object[]
required
read-only
revoked
object[]
required
read-only