Set board access settings

Who can reach a team board. This is the one call that changes access_level, and the same call sets the board member list, because the two only make sense together.

Personal boards have no access settings: there is nobody to share with, so this endpoint answers 400 INVALID_REQUEST for one.

Who can change access#

Stricter than editing a board's name, because it changes who can see work:

• to SHARED or RESTRICTED you need Can manage Shared assets (SHARE_ASSETS). If you are not the owner you also need Can manage everyone's generations and boards (MANAGE_ALL_GENERATIONS).
• to PRIVATE the owner may always do it, and so may a holder of Can manage everyone's generations and boards.

Owning a board is therefore not enough to share it: a team that withholds Can manage Shared assets from a role keeps that role's boards private, which is the point of the permission.

Request#

curl -X PUT "https://api2.rundiffusion.com/api/v2/boards/$BOARD_ID/access?team_id=$TEAM_ID" \
  -H "Authorization: Bearer $RUNDIFFUSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"access_level": "RESTRICTED", "member_user_ids": ["k3PqV9…"]}'

const board = await fetch(
  `https://api2.rundiffusion.com/api/v2/boards/${boardId}/access?team_id=${teamId}`,
  {
    method: 'PUT',
    headers: {
      Authorization: `Bearer ${process.env.RUNDIFFUSION_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      access_level: 'RESTRICTED',
      member_user_ids: ['k3PqV9…'],
    }),
  },
).then(r => r.json());

board = requests.put(
    f"{BASE}/boards/{board_id}/access",
    headers=HEADERS,
    params={"team_id": team_id},
    json={"access_level": "RESTRICTED", "member_user_ids": ["k3PqV9…"]},
).json()

Response#

200 OK with the full board, in the same shape Get a board returns, so members reflects the change you just made.

{
  "id": "Tq8vNc…",
  "title": "Hero shots",
  "access_level": "RESTRICTED",
  "owner_user_id": "k3PqV9…",
  "team_id": "Kp7mZq…",
  "nodes": [],
  "members": [
    {
      "user_id": "k3PqV9…",
      "email": "sam@example.com",
      "created_at": "2026-08-01T09:20:00+00:00"
    },
    {
      "user_id": "m8ZtLq…",
      "email": "alex@example.com",
      "created_at": "2026-08-01T09:20:00+00:00"
    }
  ]
}

Leaving RESTRICTED clears the board member list. Setting it back later starts from the owner alone, so keep your own record if you intend to restore a group.

Errors#