Configures RBAC user permissions for the individual iModel. Specified permissions are assigned to the provided user.

Individual iModel permissions allow to have more granular permissions than assigned at iTwin level. This either broadens or shrinks the set of permission the user has at iTwin level. That is, once at least one user permission is configured on the given iModel, then this configuration takes precedence over permissions configured at iTwin level.

Role and User permissions are mutually exclusive and cannot be configured for an iModel at the same time.

Please refer to Access Control API to learn more about Role Based Access Control principles in general.

iModel permissions that could be assigned to the provided user:

imodels_webview - allows to view iModel in web browser, but does not allow to get its local copy and view in desktop app.

imodels_read - allows to open and view an iModel only in read-only state.

imodels_write - allows to make changes to an iModel. Allows to create and modify named versions. Allows to create mapping between PW connection and iModel to facilitate bridges.

imodels_manage - allows to manage locks, codes or local copies for the entire iModel.

Authentication

---

Requires Authorization header with valid Bearer token for scope itwin-platform.

For more documentation on authorization and how to get access token visit OAUTH2 Authorization page.

Authorization

---

User must have imodels_manage permission assigned at the iModel level. If iModel Role permissions at the iModel level are configured, then user must additionally have at least imodels_webview permission assigned at the iTwin level. If permissions at the iModel level are not configured, then user must have imodels_manage permission assigned at the iTwin level.

Alternatively the user should be an Organization Administrator for the Organization that owns a given iTwin the iModel belongs to.

For more information please refer to Account Administrator documentation section on Access Control API documentation page.

Rate limits

---

All iTwin Platform API operations have a rate limit. For more documentation on that visit Rate limits and quotas page.

{
    "userPermissions": [{
            "userId": "7890d54a-802b-4853-ba3b-1b8449a691e6",
            "permissions": ["imodels_webview"]
        },
        {
            "userId": "b091baae-77fd-4816-97aa-0108c0f6e099",
            "permissions": ["imodels_webview", "imodels_read", "imodels_write", "imodels_manage"]
        }
    ]
}

{
    "userPermissions": [{
            "userId": "7890d54a-802b-4853-ba3b-1b8449a691e6",
            "permissions": ["imodels_webview"]
        },
        {
            "userId": "b091baae-77fd-4816-97aa-0108c0f6e099",
            "permissions": ["imodels_webview", "imodels_read", "imodels_write", "imodels_manage"]
        }
    ]
}

{
    "error": {
        "code": "HeaderNotFound",
        "message": "Header Authorization was not found in the request. Access denied."
    }
}

{
    "error": {
        "code": "InsufficientPermissions",
        "message": "The user has insufficient permissions for the requested operation."
    }
}

{
    "error": {
        "code": "iModelNotFound",
        "message": "Requested iModel is not available."
    }
}

{
    "error": {
        "code": "PermissionsConflict",
        "message": "Role permissions are already configured."
    }
}

{
    "error": {
        "code": "UnsupportedMediaType",
        "message": "Media Type is not supported."
    }
}

{
    "error": {
        "code": "InvalidiModelsRequest",
        "message": "Cannot update User permissions.",
        "details": [{
                "code": "MissingRequiredProperty",
                "message": "Required property is missing.",
                "target": "userPermissions"
            },
            {
                "code": "InvalidRequestBody",
                "message": "Failed to parse request body. Make sure it is a valid JSON."
            }
        ]
    }
}

{
    "error": {
        "code": "TooManyRequests",
        "message": "More requests were received than the subscription rate-limit allows."
    }
}