Users
Replace a person's direct grants
Declarative: afterwards they hold a direct grant on exactly the organisations listed, and the difference from their current grants is worked out here. Every organisation being added is checked against what you can reach, so nobody grants wider than they hold. 404 when any organisation named is not yours; 400 user_access_would_be_empty when the result would leave them reaching nothing; 409 cannot_remove_own_last_access when it would remove your own last access.
This does not describe account-wide access. Somebody holding it reaches every organisation whatever this list says, and sending an empty list does not remove it — read coversWholeCustomer in the response. To change one organisation without restating the rest, use PUT or DELETE /users/{principalId}/organisations/{organisationId}, which are also safe when two administrators edit at once.
For a guest, an empty list takes back everything you granted — that is how guest access ends, and their own account elsewhere is untouched.
PUT
/
users
/
{principalId}
/
organisations
Replace a person's direct grants
curl --request PUT \
--url https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations \
--header 'Content-Type: application/json' \
--header 'X-Auth-Token: <api-key>' \
--data '
{
"organisationIds": [
"<string>"
]
}
'import requests
url = "https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations"
payload = { "organisationIds": ["<string>"] }
headers = {
"X-Auth-Token": "<api-key>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {'X-Auth-Token': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({organisationIds: ['<string>']})
};
fetch('https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'organisationIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Auth-Token: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations"
payload := strings.NewReader("{\n \"organisationIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("X-Auth-Token", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations")
.header("X-Auth-Token", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"organisationIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["X-Auth-Token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"organisationIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": {
"principalId": "<string>",
"organisationIds": [
"<string>"
],
"coversWholeCustomer": true
},
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}Authorizations
FlowPayroll JWT (raw token, no Bearer prefix)
Path Parameters
Body
application/json
Replaces the whole set of organisations a person holds a direct grant on. Does not affect account-wide access.
The complete set of organisations they hold a direct grant on afterwards.
Was this page helpful?
⌘I
Replace a person's direct grants
curl --request PUT \
--url https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations \
--header 'Content-Type: application/json' \
--header 'X-Auth-Token: <api-key>' \
--data '
{
"organisationIds": [
"<string>"
]
}
'import requests
url = "https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations"
payload = { "organisationIds": ["<string>"] }
headers = {
"X-Auth-Token": "<api-key>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {'X-Auth-Token': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({organisationIds: ['<string>']})
};
fetch('https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'organisationIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Auth-Token: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations"
payload := strings.NewReader("{\n \"organisationIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("X-Auth-Token", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations")
.header("X-Auth-Token", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"organisationIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.flowpayroll.ai/v1/administration/users/{principalId}/organisations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["X-Auth-Token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"organisationIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": {
"principalId": "<string>",
"organisationIds": [
"<string>"
],
"coversWholeCustomer": true
},
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}{
"message": {
"text": "<string>",
"token": "<string>",
"tokenArguments": [
{
"name": "<string>",
"value": null
}
]
},
"content": {
"data": null,
"metadata": {
"dateFormat": "<string>",
"dateTimeFormat": "<string>",
"paginationToken": "<string>"
}
},
"validationIssues": [
{
"field": "<string>",
"reason": "<string>",
"reasonToken": "<string>",
"reasonTokenArguments": [
{
"name": "<string>",
"value": null
}
]
}
]
}