Set Role Permissions for the Site List landing.role.setRights

If you are developing integrations for Bitrix24 using AI tools (Codex, Claude Code, Cursor), connect to the MCP server so that the assistant can utilize the official REST documentation.

Scope: landing

Who can execute the method: administrator or user with "full access" permission to the "Sites and Stores" section

The method landing.role.setRights sets role permissions for sites. You can specify separate permissions for each site, while others will have default permissions. The new set of permissions completely replaces the previous one.

Method Parameters

Required parameters are marked with *

Name `type`	Description
id* `integer`	The identifier of the role for which permissions need to be updated. You can obtain the identifier using the landing.role.getList method. If you pass the identifier of a non-existent role, the method will not return a separate error.
rights* `object` \| `array`	An object in the following format: `{ "0": ["read"], "<siteId>": ["read", "edit", "sett"] }` where: `0` — default permission for sites without separate settings `<siteId>` — site identifier The list of available permission codes is described below, and the structure of the object is in the parameter table rights. The method completely replaces previously saved role permissions for sites.
additional `string[]`	Additional capabilities of the role. Possible values: `menu24` — show the "Sites and Stores" menu item for the role `create` — allow creating new sites If the parameter is not passed, the current additional capabilities of the role will remain unchanged.

Parameter rights

Name
type

Description

0
string[]

Default permissions for the role for all sites that do not have separate settings.

Available permission codes are described below.

<siteId>
string[]

Role permissions for the site with the specified identifier.

The key is the site identifier, and the value is an array of permission codes. If a site with that identifier is not found, the entry will be skipped without an error.

You can obtain the site identifier using the landing.site.getList method or from the result of the landing.site.add method.

For each site, pass an array of permission codes. If a different value is passed instead of an array, the entry for that site will be skipped without an error.

Permission Codes

Code	Description
`denied`	Access to the site is denied.
`read`	View the site.
`edit`	Modify site pages.
`sett`	Change site settings.
`public`	Publish.
`delete`	Move to trash and restore from trash.

Code Examples

How to Use Examples in Documentation

cURL (Webhook)

cURL (OAuth)

PHP

BX24.js

PHP CRest

curl -X POST \
          -H "Content-Type: application/json" \
          -d '{
            "id": 11,
            "rights": {
              "0": ["read"],
              "66": ["read", "edit", "sett"],
              "71": ["denied"]
            },
            "additional": ["menu24", "create"]
          }' \
          "https://**put.your-domain-here**/rest/**user_id**/**webhook_code**/landing.role.setRights.json"

curl -X POST \
          -H "Content-Type: application/json" \
          -d '{
            "id": 11,
            "rights": {
              "0": ["read"],
              "66": ["read", "edit", "sett"],
              "71": ["denied"]
            },
            "additional": ["menu24", "create"],
            "auth": "**put_access_token_here**"
          }' \
          "https://**put.your-domain-here**/rest/landing.role.setRights.json"

try
        {
            const response = await $b24.callMethod(
                'landing.role.setRights',
                {
                    id: 11,
                    rights: {
                        0: ['read'],
                        66: ['read', 'edit', 'sett'],
                        71: ['denied']
                    },
                    additional: ['menu24', 'create']
                }
            );
        
            const result = response.getData().result;
            console.info(result);
        }
        catch (error)
        {
            console.error(error);
        }

try {
            $response = $b24Service
                ->core
                ->call(
                    'landing.role.setRights',
                    [
                        'id' => 11,
                        'rights' => [
                            0 => ['read'],
                            66 => ['read', 'edit', 'sett'],
                            71 => ['denied'],
                        ],
                        'additional' => ['menu24', 'create'],
                    ]
                );
        
            $result = $response
                ->getResponseData()
                ->getResult();
        
            echo 'Success: ' . var_export($result, true);
        } catch (Throwable $e) {
            error_log($e->getMessage());
            echo 'Error setting role rights: ' . $e->getMessage();
        }

BX24.callMethod(
            'landing.role.setRights',
            {
                id: 11,
                rights: {
                    0: ['read'],
                    66: ['read', 'edit', 'sett'],
                    71: ['denied']
                },
                additional: ['menu24', 'create']
            },
            function(result)
            {
                if (result.error())
                {
                    console.error(result.error());
                }
                else
                {
                    console.info(result.data());
                }
            }
        );

require_once('crest.php');
        
        $result = CRest::call(
            'landing.role.setRights',
            [
                'id' => 11,
                'rights' => [
                    0 => ['read'],
                    66 => ['read', 'edit', 'sett'],
                    71 => ['denied'],
                ],
                'additional' => ['menu24', 'create'],
            ]
        );
        
        if (isset($result['error']))
        {
            echo 'Error: ' . $result['error_description'];
        }
        else
        {
            echo '<pre>';
            print_r($result['result']);
            echo '</pre>';
        }

Response Handling

HTTP Status: 200

{
            "result": true,
            "time": {
                "start": 1775071662,
                "finish": 1775071663.148474,
                "duration": 1.1484739780426025,
                "processing": 0,
                "date_start": "2026-04-01T22:27:42+02:00",
                "date_finish": "2026-04-01T22:27:43+02:00",
                "operating_reset_at": 1775072263,
                "operating": 0.1147608757019043
            }
        }

Returned Data

Name
type

Description

result
boolean

The result of the call.

The method returns true if the request was processed without access or system errors.

The value true does not guarantee that permissions were recorded for each provided site. If a site is not found or the format of one of the entries is incorrect, that entry will be skipped without an error.

After the call, check the saved set of permissions using the landing.role.getRights method.

time
time

Information about the execution time of the request.

Error Handling

HTTP Status: 400

{
            "error": "MISSING_PARAMS",
            "error_description": "Not enough parameters for the call, missing: rights"
        }

Name `type`	Description
error `string`	String error code. It may consist of digits, Latin letters, and underscores
error_description `error_description`	Textual description of the error. The description is not intended to be shown to the end user in its raw form

Possible Error Codes

Code	Description
`ACCESS_DENIED`	Not enough permissions to work with the "Sites and Stores" section.
`IS_NOT_ADMIN`	The method requires administrator rights or "full access" permission to the "Sites and Stores" section.
`FEATURE_NOT_AVAIL`	Permission management in the "Sites and Stores" section is not available on the current plan.
`MISSING_PARAMS`	The required parameter `id` or `rights` is missing.

Statuses and System Error Codes

HTTP Status: 20x, 40x, 50x

The errors described below may occur when calling any method.

Status	Code Error Message	Description
`500`	`INTERNAL_SERVER_ERROR` Internal server error	An internal server error has occurred. Please contact the server administrator or Bitrix24 technical support
`500`	`ERROR_UNEXPECTED_ANSWER` Server returned an unexpected response	An internal server error has occurred. Please contact the server administrator or Bitrix24 technical support
`503`	`QUERY_LIMIT_EXCEEDED` Too many requests	The request intensity limit has been exceeded
`405`	`ERROR_BATCH_METHOD_NOT_ALLOWED` Method is not allowed for batch usage	The current method is not permitted for calls using batch
`400`	`ERROR_BATCH_LENGTH_EXCEEDED` Max batch length exceeded	The maximum length of parameters passed to the batch method has been exceeded
`401`	`NO_AUTH_FOUND` Wrong authorization data	Invalid access token or webhook code
`400`	`INVALID_REQUEST` Https required	The HTTPS protocol is required for method calls
`503`	`OVERLOAD_LIMIT` REST API is blocked due to overload	The REST API is blocked due to overload. This is a manual individual block; please contact Bitrix24 technical support to lift it
`403`	`ACCESS_DENIED` REST API is available only on commercial plans	The REST API is only available on commercial plans
`403`	`INVALID_CREDENTIALS` Invalid request credentials	The user associated with the access token or webhook used to call the method lacks the necessary permissions
`404`	`ERROR_MANIFEST_IS_NOT_AVAILABLE` Manifest is not available	The manifest is not available
`403`	`insufficient_scope` The request requires higher privileges than provided by the webhook token	The request requires higher privileges than those provided by the webhook token
`401`	`expired_token` The access token provided has expired	The provided access token has expired
`403`	`user_access_error` The user does not have access to the application	The user does not have access to the application. This means that the application is installed, but the portal administrator has restricted access to this application to specific users only
`500`	`PORTAL_DELETED` Portal was deleted	The public part of the site is closed. To open the public part of the site on an on-premise installation, disable the "Temporary closure of the public part of the site" option. Path to the setting: Desktop > Settings > Product Settings > Module Settings > Main Module > Temporary closure of the public part of the site

Continue Learning

Set Access Codes for Role

Overview of Methods

Set Role Permissions for the Site List landing.role.setRights

Method ParametersMethod Parameters

Parameter rightsParameter rights

Permission CodesPermission Codes

Code ExamplesCode Examples

Response HandlingResponse Handling

Returned DataReturned Data

Error HandlingError Handling

Possible Error CodesPossible Error Codes

Statuses and System Error CodesStatuses and System Error Codes

Continue LearningContinue Learning