# Replace the organization custom role permissions

`PUT /v1/org-custom-role-permissions` · permission `roles:write`

Replaces the list with `permission_ids` (the full set, at most 1000). Adding a permission needs the `org_custom_roles` plan feature (Business); removing permissions is always allowed, and a removed permission is also taken away from every organization role in the same write. Some system permissions can never be given to organization roles (`permission_not_allowed`). The change is audited as `org_custom_role_permissions.updated`; each organization role that loses a permission is audited as `role.updated`.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `permission_ids` | string[] | yes | The full set of permission IDs (`perm_…`), at most 1000. |

## Response

`200 OK` with the new list.

```json
{
  "permission_ids": [
    "perm_01j9xs0a2b4c6d8e0f2g4h6j8k",
    "perm_01j9xs0a2b4c6d8e0f2g4h6j8m"
  ]
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 403 | `plan_feature_unavailable` | The set adds a permission and the plan does not include `org_custom_roles`. |
| 422 | `permission_not_allowed` | A permission can never be given to organization roles. |
| 422 | `validation_failed` | `permission_ids` is missing, has a malformed or unknown ID, a duplicate or more than 1000 items. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -i -X PUT "https://api.eu.keenauth.com/v1/org-custom-role-permissions" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"permission_ids":["perm_01j9xs0a2b4c6d8e0f2g4h6j8k","perm_01j9xs0a2b4c6d8e0f2g4h6j8m"]}'
```