> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission object

> A single Catalog grant: one recipient, one resource, one level.

A Catalog grant is always **one recipient on one resource at one level**. There is no row that means "these three tables" — [Assign Permissions](/platform-api/permissions/catalog/assign) expands a bulk request into individual grants, and each one is an object of this shape.

| Field              | Type                              | Notes                                                           |
| ------------------ | --------------------------------- | --------------------------------------------------------------- |
| `id`               | UUID                              |                                                                 |
| `permission_level` | `viewer` \| `editor` \| `manager` | The only mutable field.                                         |
| `user`             | UUID                              | Set when the recipient is a person. Expandable.                 |
| `group`            | UUID                              | Set when the recipient is a permission group. Expandable.       |
| `layer`            | UUID                              | Expandable.                                                     |
| `folder`           | UUID                              | Expandable.                                                     |
| `table`            | UUID                              | Expandable.                                                     |
| `volume`           | UUID                              | Expandable.                                                     |
| `granted_by`       | UUID                              | Who created the grant. For an API key, its creator. Expandable. |
| `created_at`       | datetime                          |                                                                 |
| `updated_at`       | datetime                          |                                                                 |

**Exactly one of `user` / `group` is set, and exactly one of `layer` / `folder` / `table` / `volume`.** The rest are `null`. That is a database constraint, not a convention, so you can branch on it safely.

Any field marked expandable can be inflated into the full object with `?expand=` — see [Expanding Responses](/platform-api/expanding-responses).

<Note>
  Field types and formats are also rendered on the operation pages, for example under the response of [List Permissions](/platform-api/permissions/catalog/list).
</Note>