> ## Documentation Index > Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt > Use this file to discover all available pages before exploring further. # Change selected resource access > Change selected explicit grants with set and remove. set adds or replaces reader/editor grants; remove deletes only those explicit grants, not access inherited through other grants. Provide at least one nonempty set/remove or typeAccess. At most 100 principal changes, with no duplicates or overlap; the resulting access list may have at most 100 principals including the owner. Omitted grants and typeAccess stay unchanged; explicit typeAccess null disables inheritance. The owner cannot be changed, downgraded or removed; use PUT for ownership transfer. The complete resulting access list is revalidated; remove invalid existing grants in the same patch. Requires an unrestricted write-capable user credential and access management permission. Supply the current quoted ETag as If-Match. Stale revisions, including concurrent changes during the request, return 412 without applying the patch. Returns the complete applied state and ETag; a no-op keeps its revision. After a timeout, GET access before retrying. ## OpenAPI ````yaml /openapi.json patch /access/{resource} openapi: 3.0.3 info: title: Effective API version: 2.0.0 description: The public Effective REST API. Authenticate using an Effective API key. servers: - url: https://api.canary.effectiveai.app/api/v2 description: Canary security: - bearerAuth: [] paths: /access/{resource}: patch: tags: - Access summary: Change selected resource access description: >- Change selected explicit grants with set and remove. set adds or replaces reader/editor grants; remove deletes only those explicit grants, not access inherited through other grants. Provide at least one nonempty set/remove or typeAccess. At most 100 principal changes, with no duplicates or overlap; the resulting access list may have at most 100 principals including the owner. Omitted grants and typeAccess stay unchanged; explicit typeAccess null disables inheritance. The owner cannot be changed, downgraded or removed; use PUT for ownership transfer. The complete resulting access list is revalidated; remove invalid existing grants in the same patch. Requires an unrestricted write-capable user credential and access management permission. Supply the current quoted ETag as If-Match. Stale revisions, including concurrent changes during the request, return 412 without applying the patch. Returns the complete applied state and ETag; a no-op keeps its revision. After a timeout, GET access before retrying. operationId: patchAccess parameters: - schema: type: string maxLength: 256 pattern: ^[a-z][a-z0-9_-]*:[A-Za-z0-9][A-Za-z0-9:_-]*$ description: 'Resource identifier. Currently supported: `records::`.' required: true description: 'Resource identifier. Currently supported: `records::`.' name: resource in: path - schema: type: string description: >- Required current sharing ETag from an access response or creation receipt. required: false description: >- Required current sharing ETag from an access response or creation receipt. name: if-match in: header requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/V2ResourceAccessPatch' responses: '200': description: Complete applied access list. Unchanged access retains its ETag. headers: ETag: schema: type: string content: application/json: schema: $ref: '#/components/schemas/V2ResourceAccess' '400': description: Invalid resource, principal, role or access list. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '403': description: Credential or ownership transfer is not permitted. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '404': description: Resource missing or access management is not permitted. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '409': description: The record has no user owner; access cannot be read or replaced. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '412': description: Access changed; GET the latest access list and retry with its ETag. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '413': description: 'request_too_large: access requests are limited to 64 KiB.' content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '415': description: Use application/json. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '428': description: If-Match is required; GET access first. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '503': description: Dependency unavailable; respect Retry-After. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' security: - bearerAuth: [] components: schemas: V2ResourceAccessPatch: type: object properties: set: type: object additionalProperties: type: string enum: - reader - editor description: >- Add or replace these explicit reader/editor grants. Unlisted grants stay unchanged; the owner cannot be changed. Principals: `user:`, `group:`, `mc::member`, `mc::editor` or `mc::manager`; UUIDs must be lowercase. Access writes require users remaining in the resulting list to be active organization members, and remaining groups and Mission Controls to be visible to the caller. member includes all Mission Control members; editor and manager select those exact tiers. remove: type: array items: type: string pattern: >- ^(?:user:[1-9][0-9]*|group:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|mc:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:(?:member|editor|manager))$ maxItems: 100 description: >- Remove these explicit grants; absent grants are unchanged. The owner cannot be removed. Principals: `user:`, `group:`, `mc::member`, `mc::editor` or `mc::manager`; UUIDs must be lowercase. Access writes require users remaining in the resulting list to be active organization members, and remaining groups and Mission Controls to be visible to the caller. member includes all Mission Control members; editor and manager select those exact tiers. typeAccess: type: string nullable: true enum: - reader - editor - null description: >- For records, limits inherited record-type access to reader or editor; null disables that inheritance. It never increases a principal’s record-type role. This does not change the record type shares. Organization administrator permissions still apply. Omit to leave inheritance unchanged. additionalProperties: false V2ResourceAccess: type: object properties: access: type: object additionalProperties: type: string enum: - reader - editor - owner description: >- Map up to 100 principals to reader, editor or owner. Exactly one user must be owner. Principals: `user:`, `group:`, `mc::member`, `mc::editor` or `mc::manager`; UUIDs must be lowercase. Access writes require users remaining in the resulting list to be active organization members, and remaining groups and Mission Controls to be visible to the caller. member includes all Mission Control members; editor and manager select those exact tiers. typeAccess: type: string nullable: true enum: - reader - editor - null description: >- For records, limits inherited record-type access to reader or editor; null disables that inheritance. It never increases a principal’s record-type role. This does not change the record type shares. Organization administrator permissions still apply. resource: type: string availableRoles: type: array items: type: string enum: - reader - editor - owner accessEtag: type: string pattern: ^"[0-9a-f]{64}"$ description: >- Quoted sharing revision for If-Match on Access PUT/PATCH. Not the record content ETag. required: - access - typeAccess - resource - availableRoles - accessEtag additionalProperties: false V2CodedError: allOf: - $ref: '#/components/schemas/V2Error' - type: object properties: code: type: string minLength: 1 description: Stable error code. Clients must tolerate unknown future codes. details: type: array items: type: object properties: location: type: string enum: - path - query - header - body path: type: array items: type: string maxLength: 64 maxItems: 12 code: type: string enum: - required - invalid_type - invalid_value - unknown_field message: type: string minLength: 1 maxLength: 200 required: - location - path - code - message minItems: 1 maxItems: 20 description: Bounded safe validation issues; may omit some invalid fields. requestId: type: string minLength: 1 maxLength: 128 description: >- Existing server correlation for this HTTP attempt, when available. dataset: type: string enum: - naic - osha description: Dataset needed for dataset_not_enabled. businessCode: type: string description: The rater’s own refusal code, for business_rejection. violations: type: array items: type: object properties: code: type: string description: Authored or built-in constraint code message: type: string description: Authored message for the failed constraint path: type: string description: Input path of the offending value; empty for the request value: nullable: true description: Offending input value, size-bounded by the runtime constraint: type: string description: The constraint the value failed, as text cite: type: string nullable: true description: >- Filing citation of the constraint, when the source cites one required: - code - message - path - value - constraint - cite additionalProperties: false maxItems: 256 description: >- Each input constraint the submission failed, for invalid_inputs and business_rejection. violationsTruncated: type: boolean description: >- True when the rater reported more violations than violations holds. executionId: type: string description: >- The recorded execution of a failed rating, for rater rating failures. accessUrl: type: string nullable: true format: uri description: >- Where to add the product to your account, for product_access_required. required: - code V2Error: type: object properties: error: type: string minLength: 1 description: Human-readable explanation of the failure. required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: 'Effective API key. Send Authorization: Bearer sk-eai-...' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.