Add a permission

Grants one resource:action permission to a property manager and returns their full list afterwards. Adding a permission they already hold leaves the list as it was.

Authorization

Authorizationstringrequired

Bearer token — Send your API token in the Authorization header as Bearer <token>. Requests without a valid token are rejected with 401 Unauthorized.

Path parameters

propertyManagerIdstringrequired

The property manager. A Snowflake id, sent as a decimal string.

example: 1830472847398404098

Body

application/json

permissionstringrequired

The permission to grant, as resource:action — for example property:read, property:write or property:delete. 1 to 100 characters.

Response

200 · The property manager's full permission list after the change.

permissionsstring[]

Every resource:action string this property manager holds. * means every permission.

401 · The access token is missing, expired, or does not belong to a property manager.

404 · No property manager with that id exists for the calling company. A record that belongs to another company is reported the same way as one that does not exist. The id you asked for is in `entityId`; `detail` names only the kind of record.

Two different gates

A property manager is limited in three independent ways, and it is easy to confuse them.

Permissions are resource:action strings such as property:read. They decide what the API lets this person do. See list permissions.
Property access decides which properties those permissions reach — all of them, or a named set of portfolios and properties. See get property access.
Menu access decides which top-level menus MagicDoor's own web app draws for them. It hides screens; it does not stop an API call. See get menu access.

Anyone can grant anything

There is no check that the caller holds the permission they are handing out, and no check that they outrank the person they are handing it to. Any property manager in the company can grant any permission to any colleague, themselves included.