POST

Permissions.Add

Add or assign permission data to a team member. Only the owner or a manager can call this method. This route saves permission JSON and folder permission settings, then sends a socket event so UI clients can refresh User.Basic.

Permissions

On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Only the organization owner or a manager can call this route.

Action

Creates a Permissions record or sends the requested data after validation.

Push Service

Pushes event permissions.add.updated to users who should see this change.

Automation

No automation is run for this function.

Special Instructions

Send the bearer token on protected calls with Authorization: Bearer YOUR TOKEN.
On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Send parameters as POST body fields exactly as documented.
Send date/time values in UTC Y-m-d H:i:s format when a date or datetime field is used.

Required Parameters

Name	Type	Sample	Explanation
`team_member_id` post	int	`321`	Team member id. Aliases: member_id, user_id, id.

Optional Parameters

Name	Type	Sample	What it gives
`roles_modules` post	json	`{"customer_add":"1"}`	Permission flags for app/business modules.
`plan_roles_modules` post	json	`{"documents":"1"}`	Plan/module permission flags.
`module` post	json	`{"mission":"1"}`	Enabled modules for this member.
`client_module` post	json	`{}`	Client-side module flags.
`shared_with_folder` post	json	`["1","2"]`	Folders this member can see. Alias: folders. Always stored as unique strings, e.g. ["1","2","3"].
`folder_permissions` post	json	`{"1":{"edit":"1"}}`	Per-folder permission object.
`member_admin` post	int	`0`	Set 1 to make this member a manager.
`show_all_user_tickets` post	int	`0`	Set 1 to allow seeing all team tickets.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Permissions.Add",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "team_member_id": "321",
        "roles_modules": "{\"customer_add\":\"1\"}",
        "shared_with_folder": "[\"1\",\"2\"]"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Permissions.Add",
    "url_domain": "https:\/\/{domain}\/app\/Permissions.Add"
}

Endpoint

POST /app/Permissions.Add
POST https://{user}.bull36.com/app/Permissions.Add
POST https://{domain}/app/Permissions.Add

Sample Output

{
    "success": 1,
    "message": "Permissions updated",
    "team_member_id": "321",
    "socket_event": "permissions.add.updated",
    "automation_event": null
}

JavaScript Example

const token = 'YOUR TOKEN';
const body = new URLSearchParams({ team_member_id: '321', roles_modules: JSON.stringify({ customer_add: '1' }), shared_with_folder: JSON.stringify(['1', '2']) });

const res = await fetch('/app/Permissions.Add', { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body });
const data = await res.json();
console.log(data);

Error Example

{
    "success": "0",
    "error": "permission_denied",
    "message": "Permission denied to manage this resource"
}