# Update administrator permissions

`PUT https://api.cademi.com.br/api/v3/administrators/{administrator_id}/permissions`

Operation ID: `administrators.permissions.update` · API v3

Replaces the administrator's role, granular permissions, and product access in a single operation. Permissions not granted in `permissions` are disabled, and product access is set to exactly the products listed in `product_ids`. If any part of the request is rejected, no changes are applied.

Permission keys that do not exist in the permission catalog return `validation_failed`.

The API cannot assign the `root` or `master_admin` role, and every permission granted must be part of the selected role's default permissions. Requests that exceed these limits return `delegation_limit_exceeded`.

To avoid overwriting a newer version, send the `ETag` returned by the retrieve administrator operation in the `If-Match` header.

Required permissions: `administrators.manage_permissions`.

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `administrator_id` | path | string | yes |  |
| `If-Match` | header | string | no |  |

## Request body

Content type: `application/json`, required.

| Field | Type | Required | Description |
|---|---|---|---|
| `permissions` | object | yes |  |
| `product_ids` | array of string | no |  |
| `role` | string | yes |  |

## Responses

### 200

Returns the updated role and permissions.

Body: `data`: AdministratorPermissions.

Fields of AdministratorPermissions:

| Field | Type | Required | Description |
|---|---|---|---|
| `object` | string, one of `administrator_permissions` | yes |  |
| `permissions` | object | yes | Nested map in the form {permission: {field: boolean}}, with one key per granular permission in the catalog. |
| `product_ids` | array of string | yes |  |
| `revision` | string | yes |  |
| `role` | string, one of `root`, `admin`, `product_admin`, `master_admin`, `support`, `designer` | yes |  |

### 401

The credential is missing, malformed, expired, or revoked.

Body: Error.

### 403

The current credentials do not have the permission required by this operation.

Body: Error.

### 404

The administrator was not found or is not accessible with the current credentials.

Body: Error.

### 412

The administrator has changed since the supplied revision was retrieved.

Body: Error.

### 422

The request body or query parameters failed validation.

Body: ValidationFailed.

Full schema: https://cademi.dev/openapi/v3.json