Upsert an Origin Namespace Grant via the API

Set the permission a user, group, or owning-team group holds directly on an owner with POST https://api.cursor.com/v1/origin/owners/{ownerSlug}/grants. Official reference: Origin API → Upsert Namespace Grant, and Origin Grants API.

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a Cursor user access token that carries namespace:settings:write. Availability: Early Beta per the API overview.

The write replaces any permission granted directly to that principal before. Repeating a grant the principal already holds succeeds without change. The permission applies to every repository under the owner.

Cost: 5 points against the principal budget (ordinary write).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owner slug

Request body

Name exactly one principal, plus permission:

Field	Required	Meaning
user	one of	User principal. Send id (prefixed user_).
group	one of	Cursor group. Send id (prefixed grp_).
teamGroup	one of	Built-in owning-team group. Send kind: members or admins.
permission	yes	PERMISSION_READ, PERMISSION_CONTRIBUTOR, PERMISSION_WRITE, or PERMISSION_ADMIN. PERMISSION_CUSTOM returns InvalidArgument (HTTP 400).

A user must be an active member of the owning team or its organization, and a group an active group of that organization. The write must leave the owner with at least one admin; otherwise the request returns FailedPrecondition (HTTP 400).

curl --request POST \
  --url 'https://api.cursor.com/v1/origin/owners/OWNER_SLUG/grants' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "user": {
    "id": "user_01k2ja2000e0080000000000c3"
  },
  "permission": "PERMISSION_WRITE"
}'

Response

The body returns the principal and the permission now held (user / group / teamGroup plus permission).

Namespace permission strings use the PERMISSION_* ladder (including PERMISSION_CONTRIBUTOR). Repository grants use the shorter read / write / admin / custom values.

For interactive or scripted user calls, prefer origin api after origin auth login (or CURSOR_API_KEY). Do not put a Cursor API key directly in the Origin Authorization header.

Base URL: https://api.cursor.com/v1/origin.