Skip to content

Grant a permission on a collection to a principal

POST
/collections/{id}/acls

Inserts one ACL row. Requires write access to the collection (owner / collections.admin / system.admin).

id
required
string format: uuid
object
principal_type
required
string
Allowed values: user role team
principal_id
required

A REFERENCE, not a name. BIGINT user.ref when principal_type=user; the row’s UUID when it is role or team.

The pattern admits the union of both forms because one schema serves all three principal types; the handler enforces the type-specific half and rejects a mismatch with 400. Passing a username here used to be accepted and stored, producing a grant that no read rule could ever match (#916).

Which principal types actually CONFER access depends on the surface. asset_type_acls honours all three. post_acls and collection_acls honour user only — their read rules gate on principal_type = 'user' because role/team scoping on content is ADR 0010 Layer 5 and unimplemented — so those two endpoints reject role and team with 400 rather than storing a grant that does nothing.

string
<= 64 characters /^([0-9]+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/
permission
required
string
Allowed values: read write admin
expires_at
string format: date-time
nullable

ACL row added

Malformed request

object
error
required

Human-readable error summary

string
Example
the request could not be completed

Authentication required, missing, or invalid

object
error
required

Human-readable error summary

string
Example
the request could not be completed
Example
{
"error": "authentication required: sign in and retry with a valid session or API token"
}

Authenticated but missing required capabilities

object
error
required

Human-readable error summary

string
Example
the request could not be completed

Resource not found

object
error
required

Human-readable error summary

string
Example
the request could not be completed