Procore

Procore Specifications User Permissions API

The Specifications User Permissions API from Procore — 2 operation(s) for specifications user permissions.

Documentation GitHub OpenAPI

Operations 2

GET /rest/v2.0/companies/{company_id}/projects/{project_id}/specification_configuration/user_permissions Get the Specifications User Permissions #

PATCH /rest/v2.0/companies/{company_id}/projects/{project_id}/specification_configuration/user_permissions/{user_id} Update the Specifications User Permissions #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/procore:procore-specifications-user-permissions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Procore REST Specifications User Permissions API
  version: v1.0/v2.0
  description: Merged from the per-resource OpenAPI documents Procore publishes through its developer portal (https://developers.procore.com/api/v1/resource_groups). Originals are kept verbatim in openapi/_original/resources/.
  x-source: https://developers.procore.com/api/v1/resource_groups
servers:
- url: https://api.procore.com
  description: Production
security:
- bearerAuth: []
tags:
- name: Specifications User Permissions
paths:
  /rest/v2.0/companies/{company_id}/projects/{project_id}/specification_configuration/user_permissions:
    parameters:
    - name: Procore-Company-Id
      in: header
      description: Unique company identifier associated with the Procore User Account.
      required: true
      schema:
        type: integer
    - name: company_id
      in: path
      description: Unique identifier for the company.
      required: true
      schema:
        type: string
    - name: project_id
      in: path
      required: true
      description: Unique identifier for the project.
      schema:
        type: string
    x-compliance-level: partial
    get:
      x-doc:
        visibility: public
        stage: ga
        exposure: public
      summary: Get the Specifications User Permissions
      description: Returns the Specifications User Permissions
      tags:
      - Specifications User Permissions
      parameters:
      - name: page
        in: query
        description: Page
        required: false
        schema:
          type: integer
      - name: per_page
        in: query
        description: Elements per page
        required: false
        schema:
          type: integer
          default: 10
          minimum: 1
          maximum: 100
      - name: filters[query]
        in: query
        required: false
        description: Return item(s) containing search query
        schema:
          type: string
      - name: sort
        in: query
        required: false
        description: Direction (asc/desc) can be controlled by the presence or absence of '-' before the sort parameter
        schema:
          type: string
          enum:
          - name
          - company
      responses:
        '200':
          description: OK
          headers:
            Per-Page:
              description: Number of items retrieved per page
              schema:
                type: integer
            Total:
              description: Total number of items to be retrieved
              schema:
                type: integer
            Link:
              description: Link headers for the first, prev, next, and last link
              schema:
                type: string
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: Specification User Permissions List
                    items:
                      type: object
                      description: Specification User Permission
                      properties:
                        id:
                          type: string
                          description: Unique identifier for the user.
                          example: '5'
                        company_directory_admin:
                          type: boolean
                          description: Whether the user is an administrator of the company directory.
                          example: false
                        project_directory_admin:
                          type: boolean
                          description: Whether the user is an administrator of the project directory.
                          example: false
                        has_permission_template:
                          type: boolean
                          description: Whether a permission template governs this user's access on the project.
                          example: false
                        contact_id:
                          type: string
                          description: ID of the user's contact record in the company directory.
                          example: '1'
                        name:
                          type: string
                          description: User's name in "Last, First" format.
                          example: Willier, Paul
                        user_access_level:
                          type: object
                          properties:
                            id:
                              type: string
                              description: User Access Level Id
                              example: '1'
                            name:
                              type: string
                              description: User Access Level Name
                              example: Standard
                        vendor:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Vendor Id
                              example: '1'
                            name:
                              type: string
                              description: Vendor Name
                              example: Brickworks
        '403':
          description: Unauthorized. User does not have permissions to view the requested resource.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        description: HTTP status in screaming snake case (like BAD_REQUEST)
                      message:
                        type: string
                        description: Human readable message describing error.
                      details:
                        type: array
                        description: Additional information about the error.
                        items:
                          type: object
                          required:
                          - reason_code
                          - message
                          properties:
                            reason_code:
                              type: string
                              description: A machine-readable code that identifies the error specifically enough for the client to interpret what happened and take action.
                              example: BLANK
                            message:
                              type: string
                              description: Human readable message
                              example: Name can't be blank
                            source:
                              type: string
                              description: Source of the error
                              example: name
      x-code-samples:
      - id: node_request
        title: Node.js
        content: "const request = require('request');\n\nconst options = {\n  method: 'GET',\n  url: 'https://api.procore.com/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions',\n  qs: {\n    page: 'SOME_INTEGER_VALUE',\n    per_page: 'SOME_INTEGER_VALUE',\n    'filters[query]': 'SOME_STRING_VALUE',\n    sort: 'SOME_STRING_VALUE'\n  }\n};\n\nrequest(options, function (error, response, body) {\n  if (error) throw new Error(error);\n\n  console.log(body);\n});\n"
      - id: python_python3
        title: Python3
        content: 'import http.client


          conn = http.client.HTTPSConnection("api.procore.com")


          conn.request("GET", "/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions?page=SOME_INTEGER_VALUE&per_page=SOME_INTEGER_VALUE&filters%5Bquery%5D=SOME_STRING_VALUE&sort=SOME_STRING_VALUE")


          res = conn.getresponse()

          data = res.read()


          print(data.decode("utf-8"))'
      - id: shell_curl
        title: Curl
        content: "curl --request GET \\\n  --url 'https://api.procore.com/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions?page=SOME_INTEGER_VALUE&per_page=SOME_INTEGER_VALUE&filters%5Bquery%5D=SOME_STRING_VALUE&sort=SOME_STRING_VALUE'"
      - id: csharp_httpclient
        title: C#
        content: "var client = new HttpClient();\nvar request = new HttpRequestMessage\n{\n    Method = HttpMethod.Get,\n    RequestUri = new Uri(\"https://api.procore.com/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions?page=SOME_INTEGER_VALUE&per_page=SOME_INTEGER_VALUE&filters%5Bquery%5D=SOME_STRING_VALUE&sort=SOME_STRING_VALUE\"),\n};\nusing (var response = await client.SendAsync(request))\n{\n    response.EnsureSuccessStatusCode();\n    var body = await response.Content.ReadAsStringAsync();\n    Console.WriteLine(body);\n}"
      x-rate-limit-enabled: true
      x-procore-kong-tags:
      - rate-limit:enabled
      x-changelog:
      - summary: Add user permissions endpoint
        description: Added endpoint to list user permissions for specifications.
        endpoint: GET /companies/{company_id}/projects/{project_id}/specification_configuration/user_permissions
        type: new
        breaking: false
        datestamp: '2025-07-17'
        versions:
        - '2.0'
        x-doc:
          visibility: public
          stage: ga
          exposure: public
        link: specifications-user-permissions?version=2.0#get-the-specifications-user-permissions
      operationId: getTheSpecificationsUserPermissions
  /rest/v2.0/companies/{company_id}/projects/{project_id}/specification_configuration/user_permissions/{user_id}:
    parameters:
    - name: Procore-Company-Id
      in: header
      description: Unique company identifier associated with the Procore User Account.
      required: true
      schema:
        type: integer
    x-compliance-level: partial
    patch:
      x-doc:
        visibility: public
        stage: ga
        exposure: public
      summary: Update the Specifications User Permissions
      tags:
      - Specifications User Permissions
      parameters:
      - name: company_id
        in: path
        description: Unique identifier for the company.
        required: true
        schema:
          type: string
      - name: project_id
        in: path
        required: true
        description: Unique identifier for the project.
        schema:
          type: string
      - name: user_id
        in: path
        description: User ID
        required: true
        schema:
          type: string
      - name: user_access_level_id
        in: query
        description: User Access Level ID - '1' for None, '2' for Read-Only, '3' for Standard, '4' for Admin
        required: true
        schema:
          type: string
          enum:
          - '1'
          - '2'
          - '3'
          - '4'
          example: '4'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Specification User Permission
                    properties:
                      id:
                        type: string
                        description: Unique identifier for the user.
                        example: '5'
                      company_directory_admin:
                        type: boolean
                        description: Whether the user is an administrator of the company directory.
                        example: false
                      project_directory_admin:
                        type: boolean
                        description: Whether the user is an administrator of the project directory.
                        example: false
                      has_permission_template:
                        type: boolean
                        description: Whether a permission template governs this user's access on the project.
                        example: false
                      contact_id:
                        type: string
                        description: ID of the user's contact record in the company directory.
                        example: '1'
                      name:
                        type: string
                        description: User's name in "Last, First" format.
                        example: Willier, Paul
                      user_access_level:
                        type: object
                        properties:
                          id:
                            type: string
                            description: User Access Level Id
                            example: '1'
                          name:
                            type: string
                            description: User Access Level Name
                            example: Standard
                      vendor:
                        type: object
                        properties:
                          id:
                            type: string
                            description: Vendor Id
                            example: '1'
                          name:
                            type: string
                            description: Vendor Name
                            example: Brickworks
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        description: HTTP status in screaming snake case (like BAD_REQUEST)
                      message:
                        type: string
                        description: Human readable message describing error.
                      details:
                        type: array
                        description: Additional information about the error.
                        items:
                          type: object
                          required:
                          - reason_code
                          - message
                          properties:
                            reason_code:
                              type: string
                              description: A machine-readable code that identifies the error specifically enough for the client to interpret what happened and take action.
                              example: BLANK
                            message:
                              type: string
                              description: Human readable message
                              example: Name can't be blank
                            source:
                              type: string
                              description: Source of the error
                              example: name
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        description: HTTP status in screaming snake case (like BAD_REQUEST)
                      message:
                        type: string
                        description: Human readable message describing error.
                      details:
                        type: array
                        description: Additional information about the error.
                        items:
                          type: object
                          required:
                          - reason_code
                          - message
                          properties:
                            reason_code:
                              type: string
                              description: A machine-readable code that identifies the error specifically enough for the client to interpret what happened and take action.
                              example: BLANK
                            message:
                              type: string
                              description: Human readable message
                              example: Name can't be blank
                            source:
                              type: string
                              description: Source of the error
                              example: name
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        description: HTTP status in screaming snake case (like BAD_REQUEST)
                      message:
                        type: string
                        description: Human readable message describing error.
                      details:
                        type: array
                        description: Additional information about the error.
                        items:
                          type: object
                          required:
                          - reason_code
                          - message
                          properties:
                            reason_code:
                              type: string
                              description: A machine-readable code that identifies the error specifically enough for the client to interpret what happened and take action.
                              example: BLANK
                            message:
                              type: string
                              description: Human readable message
                              example: Name can't be blank
                            source:
                              type: string
                              description: Source of the error
                              example: name
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        description: HTTP status in screaming snake case (like BAD_REQUEST)
                      message:
                        type: string
                        description: Human readable message describing error.
                      details:
                        type: array
                        description: Additional information about the error.
                        items:
                          type: object
                          required:
                          - reason_code
                          - message
                          properties:
                            reason_code:
                              type: string
                              description: A machine-readable code that identifies the error specifically enough for the client to interpret what happened and take action.
                              example: BLANK
                            message:
                              type: string
                              description: Human readable message
                              example: Name can't be blank
                            source:
                              type: string
                              description: Source of the error
                              example: name
      x-code-samples:
      - id: node_request
        title: Node.js
        content: "const request = require('request');\n\nconst options = {\n  method: 'PATCH',\n  url: 'https://api.procore.com/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions/%7Buser_id%7D',\n  qs: {user_access_level_id: '4'}\n};\n\nrequest(options, function (error, response, body) {\n  if (error) throw new Error(error);\n\n  console.log(body);\n});\n"
      - id: python_python3
        title: Python3
        content: 'import http.client


          conn = http.client.HTTPSConnection("api.procore.com")


          conn.request("PATCH", "/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions/%7Buser_id%7D?user_access_level_id=4")


          res = conn.getresponse()

          data = res.read()


          print(data.decode("utf-8"))'
      - id: shell_curl
        title: Curl
        content: "curl --request PATCH \\\n  --url 'https://api.procore.com/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions/%7Buser_id%7D?user_access_level_id=4'"
      - id: csharp_httpclient
        title: C#
        content: "var client = new HttpClient();\nvar request = new HttpRequestMessage\n{\n    Method = HttpMethod.Patch,\n    RequestUri = new Uri(\"https://api.procore.com/rest/v2.0/companies/%7Bcompany_id%7D/projects/%7Bproject_id%7D/specification_configuration/user_permissions/%7Buser_id%7D?user_access_level_id=4\"),\n};\nusing (var response = await client.SendAsync(request))\n{\n    response.EnsureSuccessStatusCode();\n    var body = await response.Content.ReadAsStringAsync();\n    Console.WriteLine(body);\n}"
      x-rate-limit-enabled: true
      x-procore-kong-tags:
      - rate-limit:enabled
      x-changelog:
      - summary: Add user permission update endpoint
        description: Added endpoint to update user permissions for specifications.
        endpoint: PATCH /companies/{company_id}/projects/{project_id}/specification_configuration/user_permissions/{user_id}
        type: new
        breaking: false
        datestamp: '2025-07-17'
        versions:
        - '2.0'
        x-doc:
          visibility: public
          stage: ga
          exposure: public
        link: specifications-user-permissions?version=2.0#update-the-specifications-user-permissions
      operationId: updateTheSpecificationsUserPermissions
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer