# A temporary solution to updating KoBoToolbox user permissions through the API

If one of the administrators is comfortable with more advanced use of the API, they could follow these instructions:

First you need to retrieve your API token

With your browser, go to https://kobo.serverurl.org/token/ and copy the token you get.
You should see something like:

{
 	"token": "aa1111111aaaaaaaaaa11aa1a1aaaa"
}

Your token is `aa1111111aaaaaaaaaa11aa1a1aaaa`

Go to https://insomnia.rest/download/core/
Download "Insomnia Core" for your operating system.

When install the software and open it.

- Create a new request
1. Click the `+` symbol
2. Create new request
3. Change `GET` to `POST`
4. Change `No Body` to `JSON`
5. Use the name you want
6. Click create


- Click on `Auth` tab
1. Change the type by clicking on the arrow from `No authentication` to `Bearer Token`
2. In token field: enter the token you got at the beginning
3. Prefix: Type `Token`


- Change API endpoint
1. On the textbox on the top, enter the url of the API endpoint used for permissions: `https://kobo.serverurl.org/api/v2/assets/<asset_uid>/permission-assignments/bulk/`
2. `<asset_uid>` is the unique string of the project.
For example, if you navigate to the project `High Frequency Survey - Remote or in-person interviews`,
If you look at the URL in your browser, you should see https://kobo.serverurl.org/#/forms/aWKJiwMPNGesLfzxdL7dCM/summary. `aWKJiwMPNGesLfzxdL7dCM` is the `asset_uid`.
So, you could use https://kobo.serverurl.org/api/v2/assets/aWKJiwMPNGesLfzxdL7dCM/permission-assignments/bulk/ to assign permissions with API.

- Build the permissions for API requests
This part is a little tricky when you are not used to and it could look like more complicated than it is really.
Let's assume this:
- `user1` is allowed to see `user2` and `user3` submissions
- `user2` can only add data
- `user3` can only add data
- `user1`, `user2`, `user3` are usernames

1. Open `JSON` tab and copy and paste this json below

[
		{
				"permission": "https://kobo.serverurl.org/api/v2/permissions/add_submissions/",
				"user": "https://kobo.serverurl.org/api/v2/users/user2/"
		},
		{
				"permission": "https://kobo.serverurl.org/api/v2/permissions/add_submissions/",
				"user": "https://kobo.serverurl.org/api/v2/users/user3/"
		},
		{
				"partial_permissions": [
						{
								"filters": [
										{"_submitted_by": {"$in": ["user2", "user3"]}}
								],
								"url": "https://kobo.serverurl.org/api/v2/permissions/view_submissions/"
						}
				],
				"permission": "https://kobo.serverurl.org/api/v2/permissions/partial_submissions/",
				"user": "https://kobo.serverurl.org/api/v2/users/user1/"
		}        
]

2. Click Send.


For each user you want to add `add_submissions`, you need to add

        ,{
                "permission": "https://kobo.serverurl.org/api/v2/permissions/add_submissions/",
                "user": "https://kobo.serverurl.org/api/v2/users/<username>/"
        }

after the last curly bracket
Also, the `<username>` should be added to the list of users that `user1` can view.
so

{"_submitted_by": {"$in": ["user2", "user3"]}}

would become

{"_submitted_by": {"$in": ["user2", "user3", "<username>"]}}