## Site permissions

`PUT /v1/sites/:id/permissions`

Replaces all access permissions of a site: after the call, the site keeps only the permissions you pass. To reset all permissions, use [`DELETE /v1/sites/:id/permissions`](/docs/entities/sites/permissions-delete).

## Parameters

| Parameter | Type | Required | Description |
|----------|-----|:-----:|----------|
| `id` (path) | number | yes | Site ID. List: [`GET /v1/sites`](/docs/entities/sites/list) |
| `scope` (query) | string | no | Site type: `KNOWLEDGE` — knowledge base, `GROUP` — workgroup site, `MAINPAGE` — home page. Omit the parameter for all other sites |

## Request fields (body)

| Field | Type | Required | Description |
|------|-----|:-----:|----------|
| `rights` | object | yes | Site permissions: the key is an access code, the value is an array of operations. At least one access code is required |
| `rights.<access code>` | string[] | yes | Operations for the access code: `read` — view, `edit` — edit, `sett` — change settings, `public` — publish, `delete` — delete, `denied` — access denied. An empty array is accepted. The access code is a non-empty string, for example `U1317` for the employee with ID `1317` from [`GET /v1/users`](/docs/entities/users/list), or `AU` |

No other fields are accepted in the body.

## Examples

### curl — personal key

```bash
curl -X PUT "https://vibecode.bitrix24.com/v1/sites/42/permissions" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"rights": {"U1317": ["read", "edit"]}}'
```

### curl — OAuth application

```bash
curl -X PUT "https://vibecode.bitrix24.com/v1/sites/42/permissions" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rights": {"U1317": ["read", "edit"]}}'
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/sites/42/permissions', {
  method: 'PUT',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ rights: { U1317: ['read', 'edit'] } }),
})
const body = await res.json()

if (body.success && body.data.updated) {
  console.log('Site permissions replaced')
}
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/sites/42/permissions', {
  method: 'PUT',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ rights: { U1317: ['read', 'edit'] } }),
})
const body = await res.json()

if (body.success && body.data.updated) {
  console.log('Site permissions replaced')
}
```

## Response fields

| Field | Type | Description |
|------|-----|----------|
| `success` | boolean | `true` — the permissions were replaced |
| `data.updated` | boolean | Always `true`: Bitrix24 confirmed the permissions replacement |

## Response example

```json
{
  "success": true,
  "data": {
    "updated": true
  }
}
```

## Error response example

400 — the body has no `rights`, or an empty object was passed:

```json
{
  "success": false,
  "error": {
    "code": "MISSING_REQUIRED_FIELDS",
    "message": "rights must be a non-empty access-code dictionary; use DELETE to clear all rights"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|----------|
| 400 | `MISSING_REQUIRED_FIELDS` | The body has no `rights`, or `rights` is an empty object or not an object |
| 400 | `INVALID_PARAMS` | The body has fields other than `rights`. The error message is `Only rights is accepted` |
| 400 | `INVALID_PARAMS` | An access code is an empty string, a value is not an array, or the array holds an operation outside `read`, `edit`, `sett`, `public`, `delete`, `denied` |
| 400 | `INVALID_PARAMS` | `id` is not a positive integer |
| 400 | `INVALID_SCOPE` | `scope` is not one of `KNOWLEDGE`, `GROUP`, `MAINPAGE` |
| 404 | `ENTITY_NOT_FOUND` | No site with this `id` exists, or it is not visible to the key. A knowledge base, workgroup site or home page requires the `scope` parameter |
| 403 | `BITRIX_ACCESS_DENIED` | The key does not belong to a Bitrix24 account administrator, or the Bitrix24 plan does not include extended site permissions |
| 409 | `LANDING_MODULE_NOT_ENABLED` | The Sites module is unavailable on the Bitrix24 account |
| 422 | `BITRIX_ERROR` | Bitrix24 did not confirm the permissions replacement or rejected the site operation |
| 403 | `SCOPE_DENIED` | The key lacks the `landing` scope |
| 403 | `WRITE_BLOCKED_READONLY_KEY` | The key is read-only |
| 401 | `TOKEN_MISSING` | The key has no Bitrix24 tokens configured |

Full list of common API errors — [Errors](/docs/errors).

## Known specifics

- **Assigned permissions cannot be verified through the API.** No method reads site permissions. [`GET /v1/sites/:id/my-permissions`](/docs/entities/sites/my-permissions) shows only the operations of the key's user: for a Bitrix24 account administrator it lists all six operations regardless of the assigned permissions.

## See also

- [Reset site permissions](/docs/entities/sites/permissions-delete)
- [My site permissions](/docs/entities/sites/my-permissions)
- [Site list](/docs/entities/sites/list)
- [Sites](/docs/entities/sites)
- [Errors](/docs/errors)