Upsert an Origin Repository Grant via the API

Set the permission a user, group, or owning-team group holds directly on a repository with POST https://api.cursor.com/v1/origin/repos/{ownerSlug}/{repoName}/grants. Official reference: Origin API → Upsert Repository Grant, and Origin Grants API.

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a Cursor user access token that carries repository:settings:write. Availability: Early Beta per the API overview.

The write replaces any permission granted directly to that principal before. Repeating a grant the principal already holds succeeds without change. Each principal holds one grant per resource.

Cost: 5 points against the principal budget (ordinary write). Writes record the same repository.access_changed audit event as the Codebase permissions UI.

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owning entity's unique slug
repoName	yes	Repo name, unique to the owner

Request body

Name exactly one principal, plus permission:

Field	Required	Meaning
user	one of	User principal. Send id (prefixed user_).
group	one of	Cursor group. Send id (prefixed grp_).
teamGroup	one of	Built-in owning-team group. Send kind: members or admins.
permission	yes	read, write, or admin. custom returns InvalidArgument (HTTP 400).

A user must be an active member of the repository owner's team or organization. A group must be one the owner's team owns, or an active group in that team's organization; otherwise the request returns FailedPrecondition (HTTP 400).

curl --request POST \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/grants' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "user": {
    "id": "user_01k2ja2000e0080000000000c3"
  },
  "permission": "write"
}'

Response

The body returns the principal and the permission now held (user / group / teamGroup plus permission).

For interactive or scripted user calls, prefer origin api after origin auth login (or CURSOR_API_KEY). Do not put a Cursor API key directly in the Origin Authorization header.

Base URL: https://api.cursor.com/v1/origin.