Update App Permissions

Updates the App permissions of an App.
All settings of the pre-live App (not just the permission settings) will be deployed to the live App by using this API.

MethodPUT
URLhttps://{subdomain}.kintone.com/k/v1/app/acl.json
URL(guest space)https://{subdomain}.kintone.com/k/guest/{SpaceID}/v1/app/acl.json
Authentication Password Authentication, API Token Authentication, Session Authentication
Content-Typeapplication/json

Contents

Pre-live settings

Apps may hold pre-live settings that have not yet been deployed to the live App.
Access the pre-live settings with the below URL.

URL https://{subdomain}.kintone.com/k/v1/preview/app/acl.json
URL(guest space) https://{subdomain}.kintone.com/k/guest/{SpaceID}/v1/preview/app/acl.json

Permissions

  • App management permissions are needed.

Request Parameters

Parameter Value Required Description
app Integer or String Yes The App ID.
rights Array Yes An array listing data of App permissions, in order of priority.
The "Everyone" group will be treated with the lowest priority, wherever it is placed in the list.
rights[].entity Object Yes An object containing data of the entity the permission is granted to.
rights[].entity.type String Yes The type of the entity the permission will be granted to.
  • USER: User
  • GROUP: Group
  • ORGANIZATION: Department
  • CREATOR: The creator of the App
rights[].entity.code String Conditional The code of the entity the permission is granted to.
To specify guest space users, add the string "guest/" before the guest's log in name.
If the "Everyone" group is not specified, the "Everyone" group will have no permissions to view/edit/delete.
If "CREATOR" is specified for the rights[].entity.type parameter, ignore this parameter. Otherwise, this parameter is required.
rights[].includeSubs Boolean or String The permission inheritance settings of the department the permission is granted to. This parameter is available if "ORGANIZATION" is specified for the rights[].entity.type parameter.
  • true: Permissions will be inherited.
  • false: Permissions will not be inherited.
If ignored, this value is false.
rights[].appEditable Boolean or String The App management permission of the entity.
  • The App's settings will be accessible.
  • The App's settings will not be accessible.
If ignored, this value is false.
rights[].recordViewable Boolean or String The record view permission of the entity.
  • true: Records will be viewable.
  • false: Records will not be viewable.
If ignored, this value is false.
rights[].recordAddable Boolean or String The record add permission of the entity
  • true: Records can be added.
  • false: Records cannot be added.
If ignored, this value is false.
rights[].recordEditable Boolean or String The record edit permission of the entity.
The record view permissions must also be enabled to set this value as true.
  • true: Records will be editable.
  • false: Records will not be editable.
If ignored, this value is false.
rights[].recordDeletable Boolean or String The record delete permission of the entity.
The record view permissions must also be enabled to set this value as true.
  • true: Records will be deletable.
  • false: Records will not be deletable.
If ignored, this value is false.
rights[].recordImportable Boolean or String The file import permission of the entity.
The record add permissions must also be enabled to set this value as true.
  • true: Files will be importable
  • false: Files will not be importable
If ignored, this value is false.
rights[].recordExportable Boolean or String The file export permission of the entity.
  • true: Files will be exportable
  • false: Files will not be exportable
If ignored, this value is false.
revision Integer or String Specify the revision number of the settings that will be deployed.
The request will fail if the revision number is not the latest revision.
The revision will not be checked if this parameter is ignored, or -1 is specified.

Sample Request

JavaScript (using Kintone REST API Request)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
var body = {
  'app': 1,
  'rights': [
    {
      'entity': {
        'type': 'USER',
        'code': 'user1'
      },
      'appEditable': true,
      'recordViewable': true,
      'recordAddable': true,
      'recordEditable': true,
      'recordDeletable': true,
      'recordImportable': true,
      'recordExportable': true
    },
    {
      'entity': {
        'type': 'GROUP',
        'code': 'everyone'
      },
      'includeSubs': true,
      'appEditable': true,
      'recordViewable': true,
      'recordAddable': true,
      'recordEditable': true,
      'recordDeletable': true,
      'recordImportable': false,
      'recordExportable': false
    },
    {
      'entity': {
        'type': 'CREATOR'
      },
      'appEditable': true,
      'recordViewable': true,
      'recordAddable': true,
      'recordEditable': true,
      'recordDeletable': true,
      'recordImportable': true,
      'recordExportable': true
    }
  ]
};

kintone.api(kintone.api.url('/k/v1/app/acl.json', true), 'PUT', body, function(resp) {
  // success
  console.log(resp);
}, function(error) {
  // error
  console.log(error);
});

XMLHttpRequest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
var body = {
  'app': 1,
  'rights': [
    {
      'entity': {
        'type': 'USER',
        'code': 'user1'
      },
      'appEditable': true,
      'recordViewable': true,
      'recordAddable': true,
      'recordEditable': true,
      'recordDeletable': true,
      'recordImportable': true,
      'recordExportable': true
    },
    {
      'entity': {
        'type': 'GROUP',
        'code': 'everyone'
      },
      'includeSubs': true,
      'appEditable': true,
      'recordViewable': true,
      'recordAddable': true,
      'recordEditable': true,
      'recordDeletable': true,
      'recordImportable': false,
      'recordExportable': false
    },
    {
      'entity': {
        'type': 'CREATOR'
      },
      'appEditable': true,
      'recordViewable': true,
      'recordAddable': true,
      'recordEditable': true,
      'recordDeletable': true,
      'recordImportable': true,
      'recordExportable': true
    }

  ],
  // CSRF TOKEN: used for all APIs that have an HTTP method of POST, PUT and DELETE on Kintone.
  '__REQUEST_TOKEN__': kintone.getRequestToken()
};

var url = 'https://{subdomain}.kintone.com/k/v1/app/acl.json';
var xhr = new XMLHttpRequest();
xhr.open('PUT', url);
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.onload = function() {
  if (xhr.status === 200) {
    // success
    console.log(JSON.parse(xhr.responseText));
  } else {
    // error
    console.log(JSON.parse(xhr.responseText));
  }
};
xhr.send(JSON.stringify(body));

Response Parameters

Parameter Type Description
revision String The revision number of the App settings.

Sample Response

1
2
3
{
  "revision": "3"
}