ReferenceWiKi API

Permissions

Who can read or edit spaces and collections.

Method	Path	Summary
GET	`/v1/app/kb/permissions`	List permissions
POST	`/v1/app/kb/permissions`	Create / update a permission entry POST /permissions body: { object_type, object_id, subject_type, subject_id, can_read, can_write, can_manage, is_denied }
DELETE	`/v1/app/kb/permissions/:perm_id`	Remove a permission
GET	`/v1/app/kb/subjects/users`	Find people (for permission pickers)
GET	`/v1/app/kb/subjects/groups`	Find groups (for permission pickers)

#List permissions

GET/v1/app/kb/permissions

Address: https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Licence: WiKi.

Query parameters

Name	Type	Description
`object_type`	string
`object_id`	integer

Response 200

Field	Type	Description
`permissions`	array of object
`permissions[].id`	integer
`permissions[].object_type`	string: "space" \| "collection" \| "article"
`permissions[].object_id`	integer
`permissions[].subject_type`	string: "user" \| "group"
`permissions[].subject_id`	integer
`permissions[].can_read`	boolean
`permissions[].can_write`	boolean
`permissions[].can_manage`	boolean
`permissions[].is_denied`	boolean
`permissions[].created_at`	string (date-time)
`permissions[].created_by`	integer

Example response

JSON

{
  "permissions": [
    {
      "id": 42,
      "object_type": "space",
      "object_id": 7,
      "subject_type": "user",
      "subject_id": 7,
      "can_read": true,
      "can_write": true,
      "can_manage": true,
      "is_denied": true,
      "created_at": "2026-11-12T09:30:00.000Z",
      "created_by": 1
    }
  ]
}

Errors

Status	Message
400	object_type and numeric object_id are required
400	Invalid object_type
404	User not found
403	No manage permission on this object

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions' -Headers $headers

#Create / update a permission entry POST /permissions body: { object_type, object_id, subject_type, subject_id, can_read, can_write, can_manage, is_denied }

POST/v1/app/kb/permissions

Address: https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Licence: WiKi.

Request body JSON

Name	Type	Description
`object_type`	string
`object_id`	integer
`subject_type`	string
`subject_id`	integer
`can_read`	boolean
`can_write`	boolean
`can_manage`	boolean
`is_denied`	boolean

Response 201

Field	Type	Description
`permission`	any

Example response

JSON

{
  "permission": null
}

Errors

Status	Message
400	object_type and numeric object_id are required
400	Invalid object_type
400	Invalid subject_type
400	subject_id must be a numeric ID
404	User not found
403	No manage permission on this object

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions' \
  -H "X-API-Key: $BRAMBLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"object_type":"string","object_id":7,"subject_type":"Example subject type","subject_id":7,"can_read":true,"can_write":true,"can_manage":true,"is_denied":true}'

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({"object_type":"string","object_id":7,"subject_type":"Example subject type","subject_id":7,"can_read":true,"can_write":true,"can_manage":true,"is_denied":true}),
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
    json={"object_type":"string","object_id":7,"subject_type":"Example subject type","subject_id":7,"can_read":True,"can_write":True,"can_manage":True,"is_denied":True},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
$body = '{"object_type":"string","object_id":7,"subject_type":"Example subject type","subject_id":7,"can_read":true,"can_write":true,"can_manage":true,"is_denied":true}'
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions' -Headers $headers -ContentType 'application/json' -Body $body

#Remove a permission

DELETE/v1/app/kb/permissions/:perm_id

Address: https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions/:perm_id
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Licence: WiKi.

Path parameters

Name	Type	Description
`perm_id`required	integer

Response 200

Field	Type	Description
`message`	string

Example response

JSON

{
  "message": "Saved"
}

Errors

Status	Message
400	Invalid permission id
404	User not found
404	Permission not found
403	No manage permission on this object

Example request

Bash

curl -X DELETE 'https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions/7' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions/7', {
  method: 'DELETE',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.delete(
    "https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions/7",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method DELETE -Uri 'https://<your-org>.brambleit.cloud/api/v1/app/kb/permissions/7' -Headers $headers

#Find people (for permission pickers)

GET/v1/app/kb/subjects/users

Address: https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/users
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Licence: WiKi.

Query parameters

Name	Type	Description
`q`	any

Response 200

Field	Type	Description
`users`	array of object
`users[].id`	integer
`users[].label`	string
`users[].email`	string, or null

Example response

JSON

{
  "users": [
    {
      "id": 42,
      "label": "Example label",
      "email": "alex@example.com"
    }
  ]
}

Errors

Status	Message
401	Unauthenticated

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/users' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/users', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/users",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/users' -Headers $headers

#Find groups (for permission pickers)

GET/v1/app/kb/subjects/groups

Address: https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/groups
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Licence: WiKi.

Query parameters

Name	Type	Description
`q`	any

Response 200

Field	Type	Description
`groups`	array of object
`groups[].id`	integer
`groups[].label`	string

Example response

JSON

{
  "groups": [
    {
      "id": 42,
      "label": "Example label"
    }
  ]
}

Errors

Status	Message
401	Unauthenticated

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/groups' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/groups', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/groups",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/app/kb/subjects/groups' -Headers $headers

Was this page helpful?