> ## Documentation Index
> Fetch the complete documentation index at: https://cantonfoundation-generated-reference-full-stack-preview.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v2/users/:user-id/rights

> Grant rights to a user. Granting rights does not affect the resource version of the corresponding user.

<div class="x2mdx-ref-page x2mdx-ref-page--operation x2mdx-ref-page--manual-api" />

<div class="x2mdx-ref-hero">
  <p class="x2mdx-ref-summary">Grant rights to a user. Granting rights does not affect the resource version of the corresponding user.</p>

  <div class="x2mdx-ref-badges">
    <span class="x2mdx-ref-badge x2mdx-ref-badge--protocol">OpenAPI</span>

    <a class="x2mdx-ref-badge x2mdx-ref-badge--changed" href="#history-updated-3-5">Updated 3.5</a>
  </div>
</div>

<RequestExample>
  ```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
  curl --request POST \
    --url 'http://localhost:7575/v2/users/{user-id}/rights' \
    --header 'Authorization: Bearer $TOKEN' \
    --header 'Content-Type: application/json' \
    --data '{
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }'
  ```

  ```python Python theme={"theme":{"light":"github-light","dark":"github-dark"}}
  import json
  import requests

  url = "http://localhost:7575/v2/users/{user-id}/rights"
  headers = {'Authorization': 'Bearer <token>', 'Content-Type': 'application/json'}
  payload = json.loads(r'''{
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }''')
  response = requests.request(
      "POST", url, headers=headers, json=payload
  )

  print(response.text)
  ```

  ```javascript JavaScript theme={"theme":{"light":"github-light","dark":"github-dark"}}
  const response = await fetch('http://localhost:7575/v2/users/{user-id}/rights', {
    method: 'POST',
    headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
    body: JSON.stringify({
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }),
  });

  console.log(await response.text());
  ```

  ```php PHP theme={"theme":{"light":"github-light","dark":"github-dark"}}
  <?php
  $curl = curl_init();

  curl_setopt_array($curl, [
      CURLOPT_URL => 'http://localhost:7575/v2/users/{user-id}/rights',
      CURLOPT_RETURNTRANSFER => true,
      CURLOPT_CUSTOMREQUEST => 'POST',
      CURLOPT_POSTFIELDS => <<<'JSON'
  {
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }
  JSON,
      CURLOPT_HTTPHEADER => [
          "Authorization: Bearer <token>",
          "Content-Type: application/json"
      ],
  ]);

  $response = curl_exec($curl);
  echo $response;
  ```

  ```go Go theme={"theme":{"light":"github-light","dark":"github-dark"}}
  package main

  import (
    "bytes"
    "fmt"
    "io"
    "net/http"
  )

  func main() {
    req, _ := http.NewRequest("POST", "http://localhost:7575/v2/users/{user-id}/rights", bytes.NewBufferString(`{
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }`))
    req.Header.Set("Authorization", "Bearer <token>")
    req.Header.Set("Content-Type", "application/json")
    response, _ := http.DefaultClient.Do(req)
    defer response.Body.Close()
    body, _ := io.ReadAll(response.Body)
    fmt.Println(string(body))
  }
  ```

  ```java Java theme={"theme":{"light":"github-light","dark":"github-dark"}}
  import java.net.URI;
  import java.net.http.HttpClient;
  import java.net.http.HttpRequest;
  import java.net.http.HttpResponse;

  var request = HttpRequest.newBuilder()
      .uri(URI.create("http://localhost:7575/v2/users/{user-id}/rights"))
      .header("Authorization", "Bearer <token>")
      .header("Content-Type", "application/json")
      .method("POST", HttpRequest.BodyPublishers.ofString("""
  {
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }
  """))
      .build();
  var response = HttpClient.newHttpClient().send(
      request, HttpResponse.BodyHandlers.ofString());
  System.out.println(response.body());
  ```

  ```ruby Ruby theme={"theme":{"light":"github-light","dark":"github-dark"}}
  require 'net/http'
  require 'uri'

  uri = URI('http://localhost:7575/v2/users/{user-id}/rights')
  request = Net::HTTP::Post.new(uri)
  request['Authorization'] = 'Bearer <token>'
  request['Content-Type'] = 'application/json'
  request.body = <<~JSON
  {
    "userId": "<string>",
    "rights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ],
    "identityProviderId": "<string>"
  }
  JSON
  response = Net::HTTP.start(uri.hostname, uri.port) do |http|
    http.request(request)
  end
  puts response.body
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  {
    "newlyGrantedRights": [
      {
        "kind": {
          "CanActAs": {
            "value": {
              "party": "<string>"
            }
          }
        }
      }
    ]
  }
  ```

  ```text 400 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  <string>
  ```

  ```json default theme={"theme":{"light":"github-light","dark":"github-dark"}}
  {
    "code": "<string>",
    "cause": "<string>",
    "correlationId": "<string>",
    "traceId": "<string>",
    "context": {},
    "resources": [
      [
        "<string>"
      ]
    ],
    "errorCategory": 123,
    "grpcCodeValue": 123,
    "retryInfo": "<string>",
    "definiteAnswer": false
  }
  ```
</ResponseExample>

## Authorizations

### httpAuth

<ParamField header="Authorization" type="string" required>
  HTTP bearer authentication. Send the token as `Authorization: Bearer &lt;token&gt;`. Ledger API standard JWT token
</ParamField>

### apiKeyAuth

<ParamField header="Sec-WebSocket-Protocol" type="string" required>
  API key authentication in the header. Ledger API standard JWT token (websocket)
</ParamField>

## Path parameters

<ParamField path="user-id" type="string" required />

## Body

<div class="x2mdx-ref-badges">
  <span class="x2mdx-ref-badge x2mdx-ref-badge--neutral">application/json</span>
</div>

<ParamField body="userId" type="string" required>
  The user to whom to grant rights. Required
</ParamField>

<ParamField body="rights" type="object[]">
  OpenAPI type: <code>Right\[]</code>.

  The rights to grant. Optional: can be empty

  <Expandable title="child attributes">
    <ParamField body="kind" type="object">
      OpenAPI type: <code>Kind</code>.

      Required

      <Expandable title="child attributes">
        <ParamField body="Variant 1" type="object">
          <Expandable title="child attributes">
            <ParamField body="CanActAs" type="object" required>
              OpenAPI type: <code>CanActAs</code>.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>CanActAs1</code>.

                  <Expandable title="child attributes">
                    <ParamField body="party" type="string" required>
                      The right to authorize commands for this party. Required
                    </ParamField>
                  </Expandable>
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 2" type="object">
          <Expandable title="child attributes">
            <ParamField body="CanExecuteAs" type="object" required>
              OpenAPI type: <code>CanExecuteAs</code>.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>CanExecuteAs1</code>.

                  <Expandable title="child attributes">
                    <ParamField body="party" type="string" required>
                      The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
                    </ParamField>
                  </Expandable>
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 3" type="object">
          <Expandable title="child attributes">
            <ParamField body="CanExecuteAsAnyParty" type="object" required>
              OpenAPI type: <code>CanExecuteAsAnyParty</code>.

              The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>CanExecuteAsAnyParty1</code>.

                  The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 4" type="object">
          <Expandable title="child attributes">
            <ParamField body="CanReadAs" type="object" required>
              OpenAPI type: <code>CanReadAs</code>.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>CanReadAs1</code>.

                  <Expandable title="child attributes">
                    <ParamField body="party" type="string" required>
                      The right to read ledger data visible to this party. Required
                    </ParamField>
                  </Expandable>
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 5" type="object">
          <Expandable title="child attributes">
            <ParamField body="CanReadAsAnyParty" type="object" required>
              OpenAPI type: <code>CanReadAsAnyParty</code>.

              The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>CanReadAsAnyParty1</code>.

                  The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 6" type="object">
          <Expandable title="child attributes">
            <ParamField body="Empty" type="object" required>
              OpenAPI type: <code>Empty8</code>.
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 7" type="object">
          <Expandable title="child attributes">
            <ParamField body="IdentityProviderAdmin" type="object" required>
              OpenAPI type: <code>IdentityProviderAdmin</code>.

              The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>IdentityProviderAdmin1</code>.

                  The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="Variant 8" type="object">
          <Expandable title="child attributes">
            <ParamField body="ParticipantAdmin" type="object" required>
              OpenAPI type: <code>ParticipantAdmin</code>.

              The right to administer the participant node.

              <Expandable title="child attributes">
                <ParamField body="value" type="object" required>
                  OpenAPI type: <code>ParticipantAdmin1</code>.

                  The right to administer the participant node.
                </ParamField>
              </Expandable>
            </ParamField>
          </Expandable>
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

<ParamField body="identityProviderId" type="string">
  The id of the `Identity Provider` If not set, assume the user is managed by the default identity provider. Optional
</ParamField>

## Responses

### 200

<div class="x2mdx-ref-badges">
  <span class="x2mdx-ref-badge x2mdx-ref-badge--neutral">application/json</span>
</div>

<ResponseField name="newlyGrantedRights" type="Right[]">
  The rights that were newly granted by the request. Optional: can be empty

  <Expandable title="child attributes">
    <ResponseField name="kind" type="Kind">
      Required

      <Expandable title="child attributes">
        <ResponseField name="Variant 1" type="object">
          <Expandable title="child attributes">
            <ResponseField name="CanActAs" type="CanActAs" required>
              <Expandable title="child attributes">
                <ResponseField name="value" type="CanActAs1" required>
                  <Expandable title="child attributes">
                    <ResponseField name="party" type="string" required>
                      The right to authorize commands for this party. Required
                    </ResponseField>
                  </Expandable>
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 2" type="object">
          <Expandable title="child attributes">
            <ResponseField name="CanExecuteAs" type="CanExecuteAs" required>
              <Expandable title="child attributes">
                <ResponseField name="value" type="CanExecuteAs1" required>
                  <Expandable title="child attributes">
                    <ResponseField name="party" type="string" required>
                      The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
                    </ResponseField>
                  </Expandable>
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 3" type="object">
          <Expandable title="child attributes">
            <ResponseField name="CanExecuteAsAnyParty" type="CanExecuteAsAnyParty" required>
              The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.

              <Expandable title="child attributes">
                <ResponseField name="value" type="CanExecuteAsAnyParty1" required>
                  The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 4" type="object">
          <Expandable title="child attributes">
            <ResponseField name="CanReadAs" type="CanReadAs" required>
              <Expandable title="child attributes">
                <ResponseField name="value" type="CanReadAs1" required>
                  <Expandable title="child attributes">
                    <ResponseField name="party" type="string" required>
                      The right to read ledger data visible to this party. Required
                    </ResponseField>
                  </Expandable>
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 5" type="object">
          <Expandable title="child attributes">
            <ResponseField name="CanReadAsAnyParty" type="CanReadAsAnyParty" required>
              The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.

              <Expandable title="child attributes">
                <ResponseField name="value" type="CanReadAsAnyParty1" required>
                  The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 6" type="object">
          <Expandable title="child attributes">
            <ResponseField name="Empty" type="Empty8" required />
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 7" type="object">
          <Expandable title="child attributes">
            <ResponseField name="IdentityProviderAdmin" type="IdentityProviderAdmin" required>
              The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.

              <Expandable title="child attributes">
                <ResponseField name="value" type="IdentityProviderAdmin1" required>
                  The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="Variant 8" type="object">
          <Expandable title="child attributes">
            <ResponseField name="ParticipantAdmin" type="ParticipantAdmin" required>
              The right to administer the participant node.

              <Expandable title="child attributes">
                <ResponseField name="value" type="ParticipantAdmin1" required>
                  The right to administer the participant node.
                </ResponseField>
              </Expandable>
            </ResponseField>
          </Expandable>
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

### 400

Invalid value, Invalid value for: body

<div class="x2mdx-ref-badges">
  <span class="x2mdx-ref-badge x2mdx-ref-badge--neutral">text/plain</span>
</div>

<ResponseField name="value" type="string" required />

### default

<div class="x2mdx-ref-badges">
  <span class="x2mdx-ref-badge x2mdx-ref-badge--neutral">application/json</span>
</div>

<ResponseField name="code" type="string" required />

<ResponseField name="cause" type="string" required />

<ResponseField name="correlationId" type="string" />

<ResponseField name="traceId" type="string" />

<ResponseField name="context" type="Map_String" required />

<ResponseField name="resources" type="Tuple2_String_String[]" />

<ResponseField name="errorCategory" type="integer (int32)" required />

<ResponseField name="grpcCodeValue" type="integer (int32)" />

<ResponseField name="retryInfo" type="string" />

<ResponseField name="definiteAnswer" type="boolean" />

## History

<div class="x2mdx-ref-history" aria-label="Reference history">
  <div class="x2mdx-ref-history-event x2mdx-ref-history-event--changed" id="history-updated-3-5">
    <div class="x2mdx-ref-history-event-head">
      <span class="x2mdx-ref-history-event-label">Updated</span>
      <code class="x2mdx-ref-history-event-version">3.5</code>
    </div>

    <p class="x2mdx-ref-history-event-detail">The POST /v2/users/\{user-id}/rights operation changed in this snapshot.</p>
  </div>
</div>