> ## Documentation Index > Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt > Use this file to discover all available pages before exploring further. # Replace a resource access list > Atomically replace explicit access and type-wide inheritance. Omitted principals lose their explicit grants. Exactly one user is owner. Only the current owner can transfer ownership; the previous owner keeps editor access. Requires an unrestricted write-capable user credential and access management permission. If-Match must be the current sharing ETag (accessEtag); stale revisions change nothing. A record without a user owner returns 409 without changes. After a timeout, read access again before retrying. ## OpenAPI ````yaml /openapi.json put /access/{resource} openapi: 3.0.3 info: title: Effective API version: 2.0.0 description: The public Effective REST API. Authenticate using an Effective API key. servers: - url: https://api.canary.effectiveai.app/api/v2 description: Canary security: - bearerAuth: [] paths: /access/{resource}: put: tags: - Access summary: Replace a resource access list description: >- Atomically replace explicit access and type-wide inheritance. Omitted principals lose their explicit grants. Exactly one user is owner. Only the current owner can transfer ownership; the previous owner keeps editor access. Requires an unrestricted write-capable user credential and access management permission. If-Match must be the current sharing ETag (accessEtag); stale revisions change nothing. A record without a user owner returns 409 without changes. After a timeout, read access again before retrying. operationId: replaceAccess parameters: - schema: type: string maxLength: 256 pattern: ^[a-z][a-z0-9_-]*:[A-Za-z0-9][A-Za-z0-9:_-]*$ description: 'Resource identifier. Currently supported: `records::`.' required: true description: 'Resource identifier. Currently supported: `records::`.' name: resource in: path - schema: type: string description: >- Required current sharing ETag from an access response or creation receipt. required: false description: >- Required current sharing ETag from an access response or creation receipt. name: if-match in: header requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/V2ResourceAccessInput' responses: '200': description: >- Applied access list, including the previous owner editor grant after transfer. headers: ETag: schema: type: string content: application/json: schema: $ref: '#/components/schemas/V2ResourceAccess' '400': description: Invalid resource, principal, role or access list. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '403': description: Credential or ownership transfer is not permitted. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '404': description: Resource missing or access management is not permitted. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '409': description: The record has no user owner; access cannot be read or replaced. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '412': description: Access changed; GET the latest access list and retry with its ETag. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '413': description: 'request_too_large: access requests are limited to 64 KiB.' content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '415': description: Use application/json. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '428': description: If-Match is required; GET access first. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '503': description: Dependency unavailable; respect Retry-After. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' security: - bearerAuth: [] components: schemas: V2ResourceAccessInput: type: object properties: access: type: object additionalProperties: type: string enum: - reader - editor - owner description: >- Map up to 100 principals to reader, editor or owner. Exactly one user must be owner. Principals: `user:`, `group:`, `mc::member`, `mc::editor` or `mc::manager`; UUIDs must be lowercase. Access writes require users remaining in the resulting list to be active organization members, and remaining groups and Mission Controls to be visible to the caller. member includes all Mission Control members; editor and manager select those exact tiers. typeAccess: type: string nullable: true enum: - reader - editor - null description: >- For records, limits inherited record-type access to reader or editor; null disables that inheritance. It never increases a principal’s record-type role. This does not change the record type shares. Organization administrator permissions still apply. required: - access - typeAccess additionalProperties: false V2ResourceAccess: type: object properties: access: type: object additionalProperties: type: string enum: - reader - editor - owner description: >- Map up to 100 principals to reader, editor or owner. Exactly one user must be owner. Principals: `user:`, `group:`, `mc::member`, `mc::editor` or `mc::manager`; UUIDs must be lowercase. Access writes require users remaining in the resulting list to be active organization members, and remaining groups and Mission Controls to be visible to the caller. member includes all Mission Control members; editor and manager select those exact tiers. typeAccess: type: string nullable: true enum: - reader - editor - null description: >- For records, limits inherited record-type access to reader or editor; null disables that inheritance. It never increases a principal’s record-type role. This does not change the record type shares. Organization administrator permissions still apply. resource: type: string availableRoles: type: array items: type: string enum: - reader - editor - owner accessEtag: type: string pattern: ^"[0-9a-f]{64}"$ description: >- Quoted sharing revision for If-Match on Access PUT/PATCH. Not the record content ETag. required: - access - typeAccess - resource - availableRoles - accessEtag additionalProperties: false V2CodedError: allOf: - $ref: '#/components/schemas/V2Error' - type: object properties: code: type: string minLength: 1 description: Stable error code. Clients must tolerate unknown future codes. details: type: array items: type: object properties: location: type: string enum: - path - query - header - body path: type: array items: type: string maxLength: 64 maxItems: 12 code: type: string enum: - required - invalid_type - invalid_value - unknown_field message: type: string minLength: 1 maxLength: 200 required: - location - path - code - message minItems: 1 maxItems: 20 description: Bounded safe validation issues; may omit some invalid fields. requestId: type: string minLength: 1 maxLength: 128 description: >- Existing server correlation for this HTTP attempt, when available. dataset: type: string enum: - naic - osha description: Dataset needed for dataset_not_enabled. businessCode: type: string description: The rater’s own refusal code, for business_rejection. violations: type: array items: type: object properties: code: type: string description: Authored or built-in constraint code message: type: string description: Authored message for the failed constraint path: type: string description: Input path of the offending value; empty for the request value: nullable: true description: Offending input value, size-bounded by the runtime constraint: type: string description: The constraint the value failed, as text cite: type: string nullable: true description: >- Filing citation of the constraint, when the source cites one required: - code - message - path - value - constraint - cite additionalProperties: false maxItems: 256 description: >- Each input constraint the submission failed, for invalid_inputs and business_rejection. violationsTruncated: type: boolean description: >- True when the rater reported more violations than violations holds. executionId: type: string description: >- The recorded execution of a failed rating, for rater rating failures. accessUrl: type: string nullable: true format: uri description: >- Where to add the product to your account, for product_access_required. required: - code V2Error: type: object properties: error: type: string minLength: 1 description: Human-readable explanation of the failure. required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: 'Effective API key. Send Authorization: Bearer sk-eai-...' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.