---
title: "Replace object access control list"
method: PUT
path: "/v1/objects/{object-id}/access-rights"
tags: ["Objects"]
---

# Replace object access control list

`PUT /v1/objects/{object-id}/access-rights`

Replace the object's directly assigned access control list and set the inherited-rights
flag. This is a full replacement: any user or group not present in `accessList` loses its
directly assigned rights on the object. Both members are optional; an omitted member
leaves the current value unchanged. Requires both modify and access-control rights on the
object.

## Path parameters

- `object-id` integer, required

## Request body

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the group flag bit (0x40000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object. Attribute is 64 bit wide since schema version 70.25, although only low 32 bits are allocated so far - bit 31 (0x80000000) is a valid access bit (execute script), not a flag.

## Response `200`

Access rights updated; the resulting access control list is returned.

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the group flag bit (0x40000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object. Attribute is 64 bit wide since schema version 70.25, although only low 32 bits are allocated so far - bit 31 (0x80000000) is a valid access bit (execute script), not a flag.

## Other responses

- `400` — Malformed request body or invalid access list
- `401` — Unauthorized
- `403` — User does not have modify and access-control rights on the object
- `404` — Object with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/revisions/ae3bfc65fa61/schema)