> ## Documentation Index
> Fetch the complete documentation index at: https://docs.capedigital.co.ke/llms.txt
> Use this file to discover all available pages before exploring further.

# Assign or revoke permissions for a user

> Provides a per-request, realm-scoped KeycloakAdminService instance.

Mix in before the ViewSet base class on any ViewSet that calls Keycloak.
Connection pooling inside KeycloakAdminService makes per-request
instantiation cost negligible.

Usage:
    class RoleViewSet(KeycloakAdminMixin, viewsets.ViewSet):
        def list(self, request):
            roles = self.keycloak.list_roles()



## OpenAPI

````yaml /openapi/user.yaml post /api/v1/auth/permissions/manage-user-permissions
openapi: 3.0.3
info:
  title: CapeMedia User Service API
  version: 1.0.0
  description: |2-

        **CapeMedia User Service API** - Comprehensive user service and management system.

        ## Authentication
        This API uses **JWT Bearer tokens** for authentication.

        1. Login via `/api/v1/auth/login` to obtain tokens
        2. Include the access token in the `Authorization` header: `Bearer <access_token>`
        3. Refresh expired tokens via `/api/v1/auth/refresh-token`

        ## Versioning
        The API uses URL path versioning (e.g., `/api/v1/`, `/api/v2/`).
        Current version: **v1**
        
  contact:
    name: API Support
    email: support@capemedia.co.ke
  license:
    name: Cape Media
servers:
  - url: https://api.diginacape.co.ke/acl
    description: Production
  - url: http://localhost:8000
    description: Local
security: []
paths:
  /api/v1/auth/permissions/manage-user-permissions:
    post:
      tags:
        - Permissions
      summary: Assign or revoke permissions for a user
      description: |-
        Provides a per-request, realm-scoped KeycloakAdminService instance.

        Mix in before the ViewSet base class on any ViewSet that calls Keycloak.
        Connection pooling inside KeycloakAdminService makes per-request
        instantiation cost negligible.

        Usage:
            class RoleViewSet(KeycloakAdminMixin, viewsets.ViewSet):
                def list(self, request):
                    roles = self.keycloak.list_roles()
      operationId: permissions_manage_user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManageRolePermissionsRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ManageRolePermissionsRequest'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/ManageRolePermissionsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManageRolePermissions'
          description: ''
      security:
        - bearerAuth: []
components:
  schemas:
    ManageRolePermissionsRequest:
      type: object
      description: Serializer for assigning permissions to a role.
      properties:
        permissions:
          type: array
          items:
            type: string
            minLength: 1
          description: Permissions
        action_type:
          enum:
            - assign
            - revoke
          type: string
          description: |-
            * `assign` - assign
            * `revoke` - revoke
          x-spec-enum-id: a0c54a429880861c
        role_id:
          type: string
          minLength: 1
          description: Role ID
      required:
        - action_type
        - permissions
    ManageRolePermissions:
      type: object
      description: Serializer for assigning permissions to a role.
      properties:
        permissions:
          type: array
          items:
            type: string
          description: Permissions
        action_type:
          enum:
            - assign
            - revoke
          type: string
          description: |-
            * `assign` - assign
            * `revoke` - revoke
          x-spec-enum-id: a0c54a429880861c
        role_id:
          type: string
          description: Role ID
      required:
        - action_type
        - permissions
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Enter your JWT token in the format: Bearer <token>'

````