putUserScreenScopes

PUT

/api/v1/users/{id}/screen-scopes

curl --request PUT \
  --url https://example.com/api/v1/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/screen-scopes \
  --header 'Content-Type: application/json' \
  --header 'X-CSRF-Token: example' \
  --data '{ "mode": "all", "scopes": [ { "type": "location", "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "name": "example" } ] }'

Replace an account’s screen access. Requires users.manage and the admin scope. Cookie-authenticated unsafe requests require X-CSRF-Token. mode is required: all screens is an explicit choice, never an empty grant list. An Owner cannot be restricted, nobody can change their own screen access, and a caller with restricted screen access may grant only locations and Display Groups granted to it directly.

Parameters

Path Parameters

id

required

string format: uuid

Header Parameters

X-CSRF-Token

required

string

Request Body^required

Media typeapplication/json

object

mode

required

All reaches every screen. restricted reaches the union of the granted locations and Display Groups, and nothing without grants.

string

Allowed values: all restricted

scopes

Grants for restricted access. Must be empty for all.

Array<object>

object

type

required

string

Allowed values: location group

id

required

string format: uuid

name

string

Responses

200

Screen access replaced

Media typeapplication/json

object

data

required

object

mode

required

All reaches every screen. restricted reaches the union of the granted locations and Display Groups, and nothing without grants.

string

Allowed values: all restricted

scopes

required

Array<object>

object

type

required

string

Allowed values: location group

id

required

string format: uuid

name

string

configured

required

False when the account has no stored policy, which reaches no screen until one is saved.

boolean

wholeFleet

required

Read mode instead. True exactly when a stored policy is in mode all; never derived from the number of grants.

boolean

Example

{
  "data": {
    "mode": "all",
    "scopes": [
      {
        "type": "location"
      }
    ]
  }
}

400

Invalid request body

401

Dashboard authentication required

403

Insufficient role, own account (cannot_scope_self), or screen access the caller may not delegate (screen_scope_delegation)

404

User not found

422

Mode missing (screen_access_mode_required), grants invalid (scope_invalid), or the account is an Owner (owner_not_scopable)