POST

Permissions.Edit

Edit/replace permission data for a team member. Only the owner or a manager can call this method. Send only permission groups that should be changed.

Permissions

On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Only the organization owner or a manager can call this route.

Action

Updates the requested Permissions record after validating permissions and input fields.

Push Service

Pushes event permissions.edit.updated to users who should see this change.

Automation

No automation is run for this function.

Special Instructions

Send the bearer token on protected calls with Authorization: Bearer YOUR TOKEN.
On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Send parameters as POST body fields exactly as documented.
Send date/time values in UTC Y-m-d H:i:s format when a date or datetime field is used.

Required Parameters

Name	Type	Sample	Explanation
`team_member_id` post	int	`321`	Team member id. Aliases: member_id, user_id, id.

Optional Parameters

Name	Type	Sample	What it gives
`roles_modules` post	json	`{"customer_edit":"1"}`	Permission flags for app/business modules.
`plan_roles_modules` post	json	`{"documents":"1"}`	Plan/module permission flags.
`module` post	json	`{"mission":"1"}`	Enabled modules for this member.
`client_module` post	json	`{}`	Client-side module flags.
`shared_with_folder` post	json	`["1","3"]`	Replace folders this member can see. Alias: folders. Always stored as unique strings, e.g. ["1","2","3"].
`folder_permissions` post	json	`{"1":{"edit":"1","delete":"0"}}`	Replace per-folder permission object.
`member_admin` post	int	`1`	Set 1 manager, 0 normal team member.
`show_all_user_tickets` post	int	`1`	Set 1 to allow seeing all team tickets.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Permissions.Edit",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "team_member_id": "321",
        "folder_permissions": "{\"1\":{\"edit\":\"1\"}}"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Permissions.Edit",
    "url_domain": "https:\/\/{domain}\/app\/Permissions.Edit"
}

Endpoint

POST /app/Permissions.Edit
POST https://{user}.bull36.com/app/Permissions.Edit
POST https://{domain}/app/Permissions.Edit

Sample Output

{
    "success": 1,
    "message": "Permissions updated",
    "team_member_id": "321",
    "socket_event": "permissions.edit.updated",
    "automation_event": null
}

JavaScript Example

const token = 'YOUR TOKEN';
const body = new URLSearchParams({ team_member_id: '321', folder_permissions: JSON.stringify({ 1: { edit: '1' } }) });

const res = await fetch('/app/Permissions.Edit', { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body });
const data = await res.json();
console.log(data);

Error Example

{
    "success": "0",
    "error": "permission_denied",
    "message": "Permission denied to manage this resource"
}