> ## Documentation Index
> Fetch the complete documentation index at: https://docs.diversion.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a path permission

> Create a new path permission rule for this repository



## OpenAPI

````yaml post /repos/{repo_id}/granular-permissions
openapi: 3.0.3
info:
  title: Diversion Core API
  description: >-
    Definition of the Core API used to access low-level functionality of
    Diversion
  version: 0.2.0
servers:
  - url: https://api.diversion.dev/v0
    description: Base endpoint
security: []
paths:
  /repos/{repo_id}/granular-permissions:
    parameters:
      - $ref: '#/components/parameters/RepoParam'
    post:
      tags:
        - Repository Granular Permissions
      summary: Create a path permission
      description: Create a new path permission rule for this repository
      operationId: src.handlersv2.path_permission.create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateGranularPermission'
      responses:
        '201':
          $ref: '#/components/responses/Created'
        '400':
          description: Invalid path pattern or missing required fields
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          $ref: '#/components/responses/Error'
      security:
        - OAuth2:
            - coreapi/write
components:
  parameters:
    RepoParam:
      in: path
      name: repo_id
      required: true
      schema:
        type: string
        example: example_id
        minLength: 3
        maxLength: 128
      description: >-
        The repo ID of the repository. Repo _name_ can be used instead of the
        ID, but usage of ID for permanent linking and API requests is preferred.
  schemas:
    CreateGranularPermission:
      type: object
      properties:
        user_id:
          description: >-
            User ID to assign this permission to (mutually exclusive with
            group_id)
          type: string
        group_id:
          description: >-
            Group ID to assign this permission to (mutually exclusive with
            `user_id`)
          type: string
        path_pattern:
          description: >-
            Path pattern for matching files. Supports wildcards: "/path/to/file"
            for exact match, "/path/..." for recursive wildcard, "/path/*.ext"
            for extension matching.
          type: string
          minLength: 1
          maxLength: 1024
        access_level:
          $ref: '#/components/schemas/PathAccessLevel'
        permission_type:
          $ref: '#/components/schemas/GranularPermissionType'
        insert_above_rule_id:
          description: >-
            Optional. ID of an existing rule to insert this rule above (lower
            evaluation_order). If not provided, the rule is added at the top
            (highest evaluation_order/priority).
          type: string
      required:
        - path_pattern
        - access_level
        - permission_type
    Error:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        detail:
          type: string
        title:
          type: string
        type:
          type: string
      required:
        - status
        - detail
    PathAccessLevel:
      type: string
      enum:
        - ADMIN
        - WRITE
        - READ
        - NO_ACCESS
      description: >-
        Access level for path permissions. Hierarchical: ADMIN > WRITE > READ >
        NO_ACCESS.
    GranularPermissionType:
      type: string
      enum:
        - ALLOW_LT_EQ
        - ALLOW_EQ
        - DENY_ALL
        - DENY_EQ
      description: >-
        Permission type controlling how access levels are granted or denied.
        ALLOW_LT_EQ grants specified level and all lower levels. ALLOW_EQ grants
        only the exact level. DENY_ALL denies all level granted above in the
        table. DENY_EQ denies only the exact level.
    NewResourceId:
      type: object
      properties:
        id:
          type: string
          description: The id of the newly created resource
          example: example_id
        read_only:
          type: boolean
      required:
        - id
  responses:
    Created:
      description: Resource created
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/NewResourceId'
    Error:
      description: An error occurred
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    OAuth2:
      type: oauth2
      x-tokenInfoFunc: src.token_info.token_auth
      description: This API uses OAuth 2 with the implicit grant flow
      flows:
        implicit:
          authorizationUrl: https://auth.diversion.dev/oauth2/authorize
          scopes:
            coreapi/read: Operations with no possible side-effects
            coreapi/write: Modifying operations
            coreapi/admin: >-
              Organizational operations like adding a repo or changing repo
              properties

````