> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atollhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace agent scoped permissions atomically

> Verified human session and current management authority required. Agents cannot administer grants. PUT uses expected_revision and rejects stale versions or active execution conflicts with 409. No project webhook egress runtime is enabled by these grant contracts.



## OpenAPI

````yaml /openapi.json put /api/orgs/{id}/agents/{agentId}/permissions
openapi: 3.1.0
info:
  title: Atoll API
  version: 1.0.0
  description: >-
    REST API for Atoll project management, agent collaboration, strategy
    tracking, and integrations.
servers:
  - url: https://atollhq.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Organizations
  - name: Projects
  - name: Project access
  - name: Issues
  - name: Issue details
  - name: Milestones
  - name: Artifacts
  - name: Strategy
  - name: Members and agents
  - name: Planning
  - name: Setup
  - name: Integrations and billing
  - name: Notifications and public
  - name: Private inbox
  - name: Agent executions
  - name: Human attention
  - name: Products
paths:
  /api/orgs/{id}/agents/{agentId}/permissions:
    put:
      summary: Replace agent scoped permissions atomically
      description: >-
        Verified human session and current management authority required. Agents
        cannot administer grants. PUT uses expected_revision and rejects stale
        versions or active execution conflicts with 409. No project webhook
        egress runtime is enabled by these grant contracts.
      operationId: putAgentScopedPermissions
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: agentId
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              required:
                - expected_revision
                - follow_owner_projects
                - projects
                - grants
              properties:
                expected_revision:
                  type: integer
                  minimum: 1
                follow_owner_projects:
                  type: boolean
                projects:
                  type: array
                  items:
                    type: object
                    required:
                      - project_id
                      - access_level
                    properties:
                      project_id:
                        type: string
                        format: uuid
                      access_level:
                        type: string
                        enum:
                          - view
                          - edit
                          - admin
                grants:
                  type: array
                  items:
                    type: object
                    required:
                      - capability
                      - target_kind
                      - target_id
                    properties:
                      capability:
                        type: string
                      target_kind:
                        type: string
                        enum:
                          - organization
                          - all_kpis
                          - project
                          - product
                          - kpi
                          - webhook
                      target_id:
                        type: string
                        format: uuid
                        nullable: true
      responses:
        '200':
          description: >-
            Current explicit grants, owner project following, effective project
            sources, revision and edit capabilities
        '403':
          description: Human session or management authority required
        '409':
          description: Stale revision or active execution conflict
      security:
        - humanSessionAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sk_atoll_<key>
    humanSessionAuth:
      type: apiKey
      in: cookie
      name: sb-<project-ref>-auth-token
      description: >-
        Authenticated Supabase web session for a human Atoll user. The cookie
        name includes the deployment's Supabase project reference and may be
        chunked.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.