---
search:
  tags:
    - administration
    - PATCH
seo:
  description: >-
    What this does: Grants or revokes a… Reference for the PATCH
    /administration/roles/{id}/permissions/{permissionKey} endpoint in the
    Leadtime Public API API.
sidebar:
  badge: PATCH
  label: Toggle single permission
title: Toggle single permission
type: openapi-operation
---
**What this does:**
Grants or revokes a single permission for a custom role. This is the most granular way to update role permissions - perfect for making individual permission changes.

**Important restrictions:**
- Base roles cannot have their permissions modified
- Only custom roles can be updated
- The permission must be valid and allowed for the role type
- Guest roles cannot be granted certain permissions (e.g., workspace administration)

**How it works:**
- Provide the permission key in the URL path (e.g., "projects.create", "tasks.delete")
- Set the "allow" field to true to grant the permission, or false to revoke it
- The permission is validated against disallowed permissions for the role type
- All other permissions remain unchanged

**Permission inheritance:**
- If the role has a parent that grants this permission, setting allow=true explicitly allows it
- If the role has a parent that grants this permission, setting allow=false explicitly disallows it (overrides inheritance)
- If the role has a parent that disallows this permission, setting allow=true explicitly allows it (overrides inheritance)

**What is returned:**
Returns the complete role details with updated permissions, showing the new state of all permissions including the one that was changed.

**Use cases:**
- Grant a specific permission to a role (e.g., allow "projects.create")
- Revoke a specific permission from a role (e.g., disallow "tasks.delete")
- Fine-tune role permissions one at a time
- Build permission management UIs with individual toggles

**Example:**
To grant "projects.create" permission: PATCH /roles/role-id/permissions/projects.create with {"allow": true}
To revoke "tasks.delete" permission: PATCH /roles/role-id/permissions/tasks.delete with {"allow": false}

<Operation source="api-reference" id="rolescontroller-togglepermission" />