Folders

Apply permissions to many folders

POST/folders/{id}/actions/apply-permissions-to-children
documents:writeapply_permissions_to_children_folder

Sets one user's or team's access to exactly level on 1 to 500 folders of the same deal's folder tree, reaching their subfolders and documents through inheritance, and returns 202 with a job of type apply-folder-permissions. Needs write access to the path folder and every listed folder, else 403 forbidden. 422 lists every folder_ids.N failing exists or same_deal. dry_run checks all this and queues nothing. Emits folder.updated per listed folder after commit; no email. Running it again with the previous level undoes it.

Path parameters

  • idstring (uuid)Required#

    The folder the call is made from. The folders to change are listed in the body and must be in the same deal's folder tree.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · FolderPermissionsApply

  • folder_idsstring (uuid)[]Required#

    The folders to change, 1 to 500 distinct ids. Each must be a folder you can see in the same deal's folder tree as the folder in the path, and need not be a direct child.

  • member_typestringRequired#

    Whether member_id is a user or a team.

    One of: user, team
  • member_idstring (uuid)Required#

    The user or team whose access is set.

  • levelstringRequired#

    The access to give. none puts the member on the folder's no-access list; read and write put them on that list.

    One of: none, read, write
{
  "folder_ids": [
    "4e5f6071-8293-4a4b-9c6d-7e8f90112233",
    "5f607182-93a4-4b5c-8d7e-8f9011223344"
  ],
  "member_type": "user",
  "member_id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
  "level": "read"
}

Responses

202

The job that applies the permissions was started. Its result holds folders, member_type, member_id and level.

Job
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "type": "string",
    "status": "queued",
    "progress": {
      "done": 1,
      "total": 1
    },
    "result": {},
    "error": {},
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00",
    "completed_at": "2026-06-12T10:00:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is forbidden when the token's user can't write the folder: any folder in the tree of a deal the token can see is writable, otherwise the folder's write list, write flags or super admin are needed. This is deliberately broader than the platform (no editor-role check) and stricter (the check applies where the platform skips it by role). Other codes are missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/folders/{id}/actions/apply-permissions-to-children\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "folder_ids": [
    "4e5f6071-8293-4a4b-9c6d-7e8f90112233",
    "5f607182-93a4-4b5c-8d7e-8f9011223344"
  ],
  "member_type": "user",
  "member_id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
  "level": "read"
}'