> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Object Permission

> Change the level or the tool scope of a single grant.

Two fields are writable: `permission_level`, and `tool_scope` for live-connection grants.

```bash theme={null}
curl --request PATCH \
  --url https://api.nekt.ai/api/v1/organization/object-permissions/6f2a9c4b-2a10-4e7f-9c54-d2a9b1d28b0e/ \
  --header "x-api-key: YOUR_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"tool_scope": ["search_contacts", "get_contact"]}'
```

<Warning>
  Raising a live-connection grant to `manager` clears its `tool_scope`. A manager sees the connection's full available tool set by definition, so the two cannot coexist — sending both in the same request returns `400`.
</Warning>

Setting `tool_scope` on a secret grant returns `400`: the field applies to live connections only.

## Related

* [Permissions flow](/platform-api/permissions/overview) — where tool scoping fits in the wider model.


## OpenAPI

````yaml PATCH /api/v1/organization/object-permissions/{id}/
openapi: 3.0.3
info:
  title: Nekt API
  version: v1
  description: Nekt API Documentation
  contact:
    email: support@nekt.ai
servers:
  - url: https://api.nekt.ai
security: []
paths:
  /api/v1/organization/object-permissions/{id}/:
    patch:
      tags:
        - v1
      description: >-
        Grants CRUD for the "Others" axis (secrets), mirroring
        LakehousePermissionsViewSet.


        The recipients listing lives in object_permission_recipients.py,
        mirroring the

        lakehouse permission.py / permission_recipients.py split.
      operationId: v1_organization_object_permissions_partial_update
      parameters:
        - in: path
          name: id
          schema:
            type: string
            format: uuid
          description: A UUID string identifying this Object permission.
          required: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedObjectPermission'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchedObjectPermission'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PatchedObjectPermission'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectPermission'
          description: ''
      security:
        - ApiKeyAuth: []
components:
  schemas:
    PatchedObjectPermission:
      type: object
      description: A grant of access to a secret or a live connection.
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        permission_level:
          $ref: '#/components/schemas/PermissionLevelEnum'
        tool_scope:
          nullable: true
          description: >-
            Live connections only: subset of the connection's available tools
            this access may use (NULL = the full available set, tracking it as
            it changes; MANAGER grants are always NULL)
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
        user:
          type: string
          readOnly: true
          description: User (Expandable)
        group:
          type: string
          readOnly: true
          description: Group (Expandable)
        secret:
          type: string
          readOnly: true
          description: Secret (Expandable)
        live_connection:
          type: string
          readOnly: true
          description: Live connection (Expandable)
        granted_by:
          type: string
          readOnly: true
          description: Granted by (Expandable)
    ObjectPermission:
      type: object
      description: A grant of access to a secret or a live connection.
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        permission_level:
          $ref: '#/components/schemas/PermissionLevelEnum'
        tool_scope:
          nullable: true
          description: >-
            Live connections only: subset of the connection's available tools
            this access may use (NULL = the full available set, tracking it as
            it changes; MANAGER grants are always NULL)
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
        user:
          type: string
          readOnly: true
          description: User (Expandable)
        group:
          type: string
          readOnly: true
          description: Group (Expandable)
        secret:
          type: string
          readOnly: true
          description: Secret (Expandable)
        live_connection:
          type: string
          readOnly: true
          description: Live connection (Expandable)
        granted_by:
          type: string
          readOnly: true
          description: Granted by (Expandable)
      required:
        - created_at
        - granted_by
        - group
        - id
        - live_connection
        - permission_level
        - secret
        - updated_at
        - user
    PermissionLevelEnum:
      enum:
        - manager
        - editor
        - viewer
      type: string
      description: |-
        * `manager` - Manager
        * `editor` - Editor
        * `viewer` - Viewer
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: 'API Key authentication. Format: ''x-api-key: api_key'''

````