API

Change a role's permissions

PUThttps://lemurseye.com/api/v1/roles/{id}/permissions

Sets exactly which permissions a role holds in your company only: other companies, and the LemursEye default, are untouched. Everyone holding the role gets the change.

Two safeguards: users:write and roles:manage belong to the owner alone, and the owner role always keeps them (and users:read), so nobody can untick their way out of their own company.

Permission: roles:manage (a person only, never an API key). The token is sent as Authorization: Bearer <token>; see Authentication.

Path parameters

idstringrequired
The role: owner, manager, viewer or installer.

Body (JSON)

permissionsstring[]required
The full new set of permission keys, from List roles. Only tenant-scope keys.

Response

200

The role as your company now has it, customised: true.

Errors

Where a message is listed, it comes back as JSON: { "error": "..." }. Otherwise only the status code is returned.

404
No role with this id.
400
The role is not a company role; a key is unknown or platform-only; or a key is reserved to the owner (users:write, roles:manage).
401
No token, or it has expired.
403
The token lacks the permission above.

curl --request PUT \
  --url https://lemurseye.com/api/v1/roles/viewer/permissions \
  --header "Authorization: Bearer $LEMURSEYE_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "permissions": [
      "fleet:read",
      "trips:read",
      "money:read",
      "reports:read",
      "alerts:read"
    ]
  }'

Response200

{
  "id": "viewer",
  "slug": "viewer",
  "tenantId": null,
  "name": "Viewer",
  "description": "Reads the map, history, money and reports. Changes nothing.",
  "scope": "tenant",
  "builtIn": true,
  "permissions": [
    "fleet:read",
    "trips:read",
    "money:read",
    "reports:read",
    "alerts:read"
  ],
  "userCount": 4,
  "customised": true
}

← List roles and permissions Reset a role to the default →