# Update access general access

`PATCH https://api.endless.app/access/{resource_type}/{resource_id}`

Source: https://endless.app/docs/api/access/update-general-access

Update access general access. Scoped to the resource named by `resource_id`. Send a sparse body — only the fields that changed. Each field is authorized on its own, so resending an unchanged one also demands its permission.

## Authentication

- `bearerAuth`: HTTP bearer (JWT)

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `resource_type` | path | "asset" \| "chat_conversation" \| "canvas" \| "project" \| "scheduled_task" \| "skill" | yes |  |
| `resource_id` | path | string (uuid) | yes |  |
| `Endless-Api-Version` | header | string | no | Pin the caller to an API major (`1`). Omit to accept the current version. A major this deployment cannot serve is refused with 400 `unsupported_api_version`. |

## Request body

Content type: `application/json` — object

- `visibility` ("private" | "workspace")
- `workspace_role` ("viewer" | "editor")

## Responses

### 200 OK

Content type: `application/json` — object

- `resource_type` ("asset" | "chat_conversation" | "canvas" | "project" | "scheduled_task" | "skill", required)
- `resource_id` (string, required)
- `owner_id` (string | null, required)
- `role` ("viewer" | "editor" | "owner", required)
- `shared` (boolean, required)
- `capabilities` (object, required)
  - `can_edit` (boolean, required)
  - `can_manage_people` (boolean, required)
  - `can_change_general_access` (boolean, required)
  - `can_delete` (boolean, required)
- `can_leave` (boolean, required)
- `general_access` (object, required)
  - `visibility` ("private" | "workspace" | "public", required)
  - `workspace_role` ("viewer" | "editor", required)
- `general_access_editable` (boolean, required)
- `grants` (array<object>, required)
  - `id` (string, required)
  - `user_id` (string, required)
  - `role` ("viewer" | "editor", required)
  - `granted_by_id` (string | null, required)
  - `created_at` (string (date-time), required)
- `inherited` (array<object>, required)
  - `kind` ("chat" | "canvas" | "project", required)
  - `id` (string, required)
  - `title` (string | null, required)
  - `emoji` (string | null, required)
  - `via` ("origin" | "reference", required)
  - `role` ("viewer" | "editor" | "owner", required)
  - `through` ("chat" | "canvas")
  - `audience` (boolean, required)

### Errors

- `400` (Error): The request is malformed, or failed input validation. `message` names the field and the rule it broke; `data.issues` carries them individually.
- `401` (Error): No bearer token, or a token that failed verification.
- `402` (Error): The workspace has no credits left, or the caller is over a spending limit.
- `403` (Error): Authenticated, but the caller's role in this workspace does not carry the permission this operation needs.
- `404` (Error): No resource with that id, or the caller cannot read it. The two are deliberately one answer, so an id cannot be probed for existence.
- `409` (Error): The request is well-formed, but the resource's current state forbids it — a taken name, a last admin, a limit already reached.
- `429` (Error): The caller has spent its rate-limit window. `Retry-After` says when to come back.
- `500` (Error): The request failed on our side. Safe to retry an idempotent operation with backoff.