> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Client Access Permissions

> Syteca ACB REST API endpoint to update which Syteca Clients a user can see and access — defines monitoring scope by Client, Client group, or rule pattern.

Updates the user's [Client access](/docs/administration/users/client-permissions) rules — defining which Syteca Clients (monitored endpoints) the user can see sessions for and manage. Rules can target individual Clients, Client groups, or pattern-based selections. Replacement semantics: the supplied rules become the user's full Client access ruleset.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The Access Token must be issued to a user with the [administrative User Management permission](/docs/administration/users/administrative-permissions).

### Replacement semantics

This endpoint **replaces** the user's Client access ruleset. To add or remove individual rules, first call [Get user details](/docs/api/acb/endpoints/get-user-details) to read the current ruleset, then PUT the desired modified set.

### Common use cases

* **Team-based Client scoping** — When a user joins a team, automatically grant access to that team's Clients via API rather than manual admin UI work.
* **Compliance segmentation** — Programmatically enforce that PCI scope users can only see PCI-tagged Clients.
* **MSSP tenant scoping** — In multi-tenant deployments, automatically restrict each customer's analysts to their tenant's Clients.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — invalid rule structure or reference to a non-existent Client / Client group.
* **403 Forbidden** — caller lacks User Management permission.
* **404 Not Found** — user doesn't exist.

## Related

<CardGroup cols={2}>
  <Card title="Client permissions" icon="laptop" href="/docs/administration/users/client-permissions">UI equivalent and full rule semantics.</Card>
  <Card title="Get user details" icon="user-search" href="/docs/api/acb/endpoints/get-user-details">Read current ruleset before updating.</Card>
  <Card title="Update user access" icon="users-round" href="/docs/api/acb/endpoints/update-user-access">Manage User-to-User access instead.</Card>
  <Card title="Update admin permissions" icon="shield-check" href="/docs/api/acb/endpoints/update-admin-permissions">Manage global admin capabilities.</Card>
</CardGroup>


## OpenAPI

````yaml PUT /api/user-management/users/{userId}/client-access
openapi: 3.0.1
info:
  title: Application Credentials Broker API
  description: API for managing users in the Application Credentials Broker system
  version: 1.0.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/user-management/users/{userId}/client-access:
    put:
      tags:
        - UserManagement
      summary: Update user Client Access permissions (internal/domain)
      description: Update Client Access permissions for a user
      parameters:
        - name: userId
          in: path
          required: true
          description: ID of the user to update Client Access permissions
          schema:
            type: integer
            format: int32
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserClientAccessPermissionsRequestDto'
      responses:
        '204':
          description: User Access permissions for a user updated successfully
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    UpdateUserClientAccessPermissionsRequestDto:
      type: object
      properties:
        client_access_rules:
          type: array
          items:
            $ref: '#/components/schemas/ClientAccessRuleDto'
          nullable: true
          description: List of direct Client Access rules
      additionalProperties: false
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    ClientAccessRuleDto:
      type: object
      properties:
        client_group_id:
          type: integer
          format: int32
          nullable: true
          description: ID of a Client group the rule applies to
        client_id:
          type: integer
          format: int32
          nullable: true
          description: ID of a specific Client endpoint the rule applies to
        permission_keys:
          type: array
          items:
            type: string
            description: Client permission identifier
          nullable: true
          description: >-
            Set of Client permissions to grant directly for this user on the
            selected group/client
      additionalProperties: false
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````