---
title: "Grant a permission to a customer"
method: POST
path: "/customers/{customer_id}/permissions"
tags: ["Customers"]
---

# Grant a permission to a customer

`POST /customers/{customer_id}/permissions`

Grants a permission to the specified customer.
Returns 201 with a Location header pointing to the new permission resource.
If `expires_at` is provided it must be a valid RFC 3339 / ISO 8601 timestamp.

## Path parameters

- `customer_id` string, required

## Request body

- V4CustomerPermissionRequest
  - `permission_id` string, required — Permission identifier to grant. Must be alphanumeric, hyphens, underscores, or dots. Max 256 characters.
  - `expires_at` string, date-time, nullable — Optional expiration timestamp in RFC 3339 / ISO 8601 format. Omit for a non-expiring permission.

## Response `201`

Permission granted.

- object — Created permission resource. The `permission_id` and `expires_at` fields echo the request body alongside the standard `object` and `url` envelope keys.
  - `object` 'customer_permission', required
  - `url` string, required
  - `permission_id` string, required
  - `expires_at` string, date-time, nullable, required

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `404` — Customer not found
- `415` — Unsupported Content-Type
- `429` — Too many requests
- `500` — Internal error
- `502` — Storage error
- `504` — Upstream timeout

---

[API](https://skmtc.net/qonversion/apis/qonversion-rest-api-v4.md) · [All operations](https://skmtc.net/qonversion/apis/qonversion-rest-api-v4/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/qonversion/qonversion-rest-api-v4/revisions/e3f72cf8951c/schema)