> ## Documentation Index > Fetch the complete documentation index at: https://www.domo.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update Permissions > Grant or replace permissions for a user, group, or app instance on a collection. ## Permission Inheritance Users and groups inherit permissions from the app, so often the most convenient approach is to give the app the permissions you want all users to have. Anyone who has the app card shared with them inherits its permissions on the collection and its documents. By default, apps receive `read`, `create_content`, `read_content`, `update_content`, and `delete_content` on their collections. For finer-grained control — when not everyone should be able to create, update, or delete documents — grant permissions directly to individual users or groups instead. ## Available Permissions | Permission | Grants | | ---------------- | ------ | | `admin` | All permissions to the collection and its documents | | `write` | Update the collection's properties | | `read` | Read the collection's properties | | `share` | Add or remove permissions this entity already holds | | `delete` | Delete the collection | | `create_content` | Create documents in the collection | | `update_content` | Update documents in the collection | | `read_content` | Read documents in the collection | | `delete_content` | Delete documents from the collection | `READ` is always included in the resulting permission set, even if you do not specify it. Removing all entity permissions leaves only users with the **Manage AppDB** grant with access. ## OpenAPI ````yaml /openapi/product/appdb.yaml put /api/datastores/v1/collections/{collectionId}/permission/{entity}/{entityId} openapi: 3.0.0 info: title: App DB API version: v1 description: | The App DB API allows developers to interact with AppDB, a NoSQL database for storing arbitrary JSON documents. This API supports CRUD operations, querying, and aggregation, enabling developers to manage data efficiently within their Domo applications. servers: - url: https://{instance}.domo.com description: Domo Instance variables: instance: default: api description: Your specific Domo instance name (e.g., mycompany) security: - developerToken: [] tags: - name: Documents description: Manage individual documents in an AppDB collection. - name: Collections description: Manage AppDB collections (schema, permissions). - name: App DB API (Product) description: Manage documents and collections in AppDB. paths: /api/datastores/v1/collections/{collectionId}/permission/{entity}/{entityId}: put: tags: - App DB API (Product) summary: Update Permissions description: > Grant or replace permissions for a user, group, or app instance on a collection. ## Permission Inheritance Users and groups inherit permissions from the app, so often the most convenient approach is to give the app the permissions you want all users to have. Anyone who has the app card shared with them inherits its permissions on the collection and its documents. By default, apps receive `read`, `create_content`, `read_content`, `update_content`, and `delete_content` on their collections. For finer-grained control — when not everyone should be able to create, update, or delete documents — grant permissions directly to individual users or groups instead. ## Available Permissions | Permission | Grants | | ---------------- | ------ | | `admin` | All permissions to the collection and its documents | | `write` | Update the collection's properties | | `read` | Read the collection's properties | | `share` | Add or remove permissions this entity already holds | | `delete` | Delete the collection | | `create_content` | Create documents in the collection | | `update_content` | Update documents in the collection | | `read_content` | Read documents in the collection | | `delete_content` | Delete documents from the collection | `READ` is always included in the resulting permission set, even if you do not specify it. Removing all entity permissions leaves only users with the **Manage AppDB** grant with access. parameters: - name: collectionId in: path required: true schema: type: string description: The ID of the collection. - $ref: '#/components/parameters/EntityType' - $ref: '#/components/parameters/EntityId' - name: permissions in: query required: true description: One or more permissions to apply. Pass as a comma-separated list. style: form explode: false schema: type: array items: type: string enum: - admin - write - read - share - delete - create_content - update_content - read_content - delete_content example: read,create_content,read_content,update_content,delete_content - name: overwrite in: query required: false description: > Controls how the specified permissions are applied to the entity's existing permission set. - `false` (default) — **additive**: merges the specified permissions with any permissions the entity already holds. - `true` — **replace**: discards the entity's existing permissions and replaces them with exactly the permissions you specify. `READ` is still always included in the resulting set. schema: type: boolean default: false responses: '204': description: Permissions updated successfully. No response body is returned. '400': description: >- The request could not be validated — for example, the `entityId` does not resolve to an existing entity. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: message: Unable to verify user with id 1 status: 400 statusReason: Bad Request toe: X1EIQPAW9O-YR1AP-0WM59 '403': description: >- Forbidden. The collection does not exist or the caller does not have the `share` permission on it. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: message: The item you're looking for can not be found status: 403 statusReason: Forbidden toe: GP0ITH3EYK-UTED0-8ZCS2 '404': $ref: '#/components/responses/CollectionNotFoundDirect' components: parameters: EntityType: name: entity in: path required: true description: The type of entity the permissions apply to. schema: type: string enum: - USER - GROUP - RYUU_APP EntityId: name: entityId in: path required: true description: >- The ID of the entity the permissions apply to. For a **USER** or **GROUP**, this is the numeric ID (for example, `870010733`). For a **RYUU_APP**, this is the app instance's UUID — the same value as the app's datastore UUID, which also appears as the subdomain of the app's origin (e.g., `https://.domoapps.domo.com`). schema: type: string examples: userOrGroup: summary: User or group (numeric ID) value: '870010733' app: summary: App instance (UUID) value: fcd8baba-9524-4fb5-b94b-b3d3b588e740 schemas: ErrorResponse: type: object properties: message: type: string description: A human-readable error message. status: type: integer description: HTTP status code. statusReason: type: string description: HTTP status reason phrase. toe: type: string description: Trace identifier for support; stands for Thread of Execution. responses: CollectionNotFoundDirect: description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: message: No collection with id a3f7d891-bc24-4e56-9a12-c7e3b0f845d2 found status: 404 statusReason: Not Found toe: UO3SB982DA-RL9G8-GO8DF securitySchemes: developerToken: type: apiKey in: header name: X-DOMO-Developer-Token description: Domo Developer Token for authentication. ````