---
title: "Update task permission rules"
method: PUT
path: "/workflows/{workflowId}/revisions/{revisionId}/tasks/{taskId}/permission-rules"
tags: ["Workflow Tasks"]
---

# Update task permission rules

`PUT /workflows/{workflowId}/revisions/{revisionId}/tasks/{taskId}/permission-rules`

Replaces the client-configurable permission rules for a task on a draft workflow revision. PUT semantics: send the full list of desired rules to replace all existing ones. Send an empty array to remove all client-configurable rules. Note: system-managed permits (e.g. for all-members groups) are preserved and not affected by this endpoint. Returns the resulting permission rules.

## Path parameters

- `workflowId` string, required
- `revisionId` string, required
- `taskId` string, required

## Request body

- UpdateTaskPermissionRuleRequest[]
  - union
    - object
      - `sourceType` 'ChecklistInitiator' | 'FormField', required — Where the user(s) that get task access are pulled from at runtime. - `ChecklistInitiator` — grants access to the user who started the workflow run. - `FormField` — grants access to users referenced by a form field on the run (`sourceWidgetId` identifies which Members form field).
      - `sourceWidgetId` string — For `sourceType=FormField`: the ID of the Members form field whose value drives the rule's assignees at runtime. Absent for `sourceType=ChecklistInitiator`.
      - `taskRead` boolean, required — When `true`, the rule grants read access to the task.
      - `taskUpdate` boolean, required — When `true`, the rule grants update access to the task (check off, edit form fields).
      - `type` 'Dynamic', required — Discriminator value for this variant. See the parent oneOf for the full set of values.
    - object
      - `email` string, required — Email address.
      - `taskRead` boolean, required — When `true`, the rule grants read access to the task.
      - `taskUpdate` boolean, required — When `true`, the rule grants update access to the task (check off, edit form fields).
      - `type` 'Static', required — Discriminator value for this variant. See the parent oneOf for the full set of values.

## Response `200`

- PublicApiPermissionRuleListResponse
  - `data` union[] — The list of resources returned by this request.
    - union
      - object
        - `sourceType` 'ChecklistInitiator' | 'FormField', required — Where the user(s) that get task access are pulled from at runtime. - `ChecklistInitiator` — grants access to the user who started the workflow run. - `FormField` — grants access to users referenced by a form field on the run (`sourceWidgetId` identifies which Members form field).
        - `sourceWidgetId` string — For `sourceType=FormField`: the ID of the Members form field whose value drives the rule's assignees at runtime. Absent for `sourceType=ChecklistInitiator`.
        - `taskRead` boolean, required — When `true`, the rule grants read access to the task.
        - `taskUpdate` boolean, required — When `true`, the rule grants update access to the task (check off, edit form fields).
        - `type` 'Dynamic', required — Discriminator value for this variant. See the parent oneOf for the full set of values.
      - object
        - `user` object, required — User this entry refers to.
          - `id` string, required — The resource's ID.
          - `email` string, required — The user's email address (also their login identifier).
          - `username` string, required — The user's display name (e.g. `Jane Doe`).
        - `taskRead` boolean, required — When `true`, the rule grants read access to the task.
        - `taskUpdate` boolean, required — When `true`, the rule grants update access to the task (check off, edit form fields).
        - `type` 'Static', required — Discriminator value for this variant. See the parent oneOf for the full set of values.
  - `links` object[] — Pagination links. When the result has more pages, look for an entry with `name: "next"` — its `href` is the URL to fetch the next page. Absence of `next` means there are no more pages. For single-resource responses this array is typically empty.
    - `name` string, required — Standard link relation name (RFC 5988) indicating this link's role. Common values include `self`, `edit`, `related`, `previous`, `next`.
    - `href` string, required — URL of the linked resource.
    - `rel` 'Approval Task' | 'Approvals' | 'Assignees' | 'Comment' | 'Data Set Records' | 'Data Sets' | 'Form Field Values' | 'Subject Task' | 'Task' | 'Tasks' | 'Users' | 'Webhook' | 'Workflow' | 'Workflow Run' — Optional. The kind of resource this link points to (e.g. `Workflow`, `Task`, `Comment`).
    - `type` 'Api' | 'App', required — Whether this link targets an API endpoint or a Process Street app URL. `Api` — a callable API endpoint you can fetch directly. `App` — a browser-facing URL in the Process Street UI.

## Other responses

- `400` — Invalid value for: body
- `default`

---

[API](https://skmtc.net/process/apis/process-street-public-api.md) · [All operations](https://skmtc.net/process/apis/process-street-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/process/process-street-public-api/revisions/6199a9464227/schema)