> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # Set who in this org can open one Studio > Replace one Studio's audience -- the users and roles (permission groups) whose members can open it -- and leave every other Studio link, and every other field of this one, as stored. Both lists empty means everyone in the organization. The Studio must already be in the organization's navigation. ```http POST https://api2.rhombussystems.com/api/org/updatePaneLinkAudience ``` EU organizations send the same request to `https://api2.eu.rhombussystems.com`. ## Authentication and parameters - `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). - `Authorization` (header): instead of an API key, an OAuth access token (`Bearer `) with the `write` scope. - `x-auth-scheme` (header, string, default: `api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`. - `x-auth-org` (header, string): Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`. ## Request body Content type: `application/json`. Request object for setting who in this organization can open one Studio. - `paneId` (string | null): The Studio's paneId, as it appears in the organization's paneLinks. - `permissionGroupUuids` (array | null): Roles (permission groups) whose members can open the Studio. Combined with userUuids as one audience (OR); both empty means everyone in the organization. - `userUuids` (array | null): Users who can open the Studio by name. Combined with permissionGroupUuids as one audience (OR); both empty means everyone in the organization. ## Response 200 OK. Content type: `application/json` - `error` (boolean | null) - `errorCode` (string | null): Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. - `errorMsg` (string | null) - `warningMsg` (string | null) ## Errors Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors ## OpenAPI ````yaml openapi: 3.0.1 info: title: Rhombus API version: "1.0" servers: - description: Production Server url: https://api2.rhombussystems.com security: - ApiKeyAuth: [] paths: /api/org/updatePaneLinkAudience: post: description: Replace one Studio's audience -- the users and roles (permission groups) whose members can open it -- and leave every other Studio link, and every other field of this one, as stored. Both lists empty means everyone in the organization. The Studio must already be in the organization's navigation. operationId: updatePaneLinkAudience parameters: - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters." example: api-token in: header name: x-auth-scheme required: false schema: default: api-token enum: - api-token - api - api-oauth-token - federated-token - partner-api-token - partner-api - partner-api-oauth-token type: string - description: "Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`." in: header name: x-auth-org required: false schema: format: RUUID maxLength: 22 minLength: 22 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/Org_UpdatePaneLinkAudienceWSRequest" responses: "200": content: application/json: schema: $ref: "#/components/schemas/Org_UpdatePaneLinkAudienceWSResponse" description: OK "400": $ref: "#/components/responses/BadRequest" "401": $ref: "#/components/responses/Unauthorized" "403": $ref: "#/components/responses/Forbidden" "429": $ref: "#/components/responses/TooManyRequests" "500": $ref: "#/components/responses/InternalServerError" "503": $ref: "#/components/responses/ServiceUnavailable" security: - ApiKeyAuth: [] - oauth2: - write summary: Set who in this org can open one Studio tags: - Org Webservice components: schemas: Org_UpdatePaneLinkAudienceWSRequest: description: Request object for setting who in this organization can open one Studio. properties: paneId: description: The Studio's paneId, as it appears in the organization's paneLinks. nullable: true type: string permissionGroupUuids: description: Roles (permission groups) whose members can open the Studio. Combined with userUuids as one audience (OR); both empty means everyone in the organization. items: description: Roles (permission groups) whose members can open the Studio. Combined with userUuids as one audience (OR); both empty means everyone in the organization. nullable: true type: string nullable: true type: array userUuids: description: Users who can open the Studio by name. Combined with permissionGroupUuids as one audience (OR); both empty means everyone in the organization. items: description: Users who can open the Studio by name. Combined with permissionGroupUuids as one audience (OR); both empty means everyone in the organization. nullable: true type: string nullable: true type: array type: object Org_UpdatePaneLinkAudienceWSResponse: description: Response object for setting who in this organization can open one Studio. properties: error: nullable: true type: boolean errorCode: description: Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. nullable: true type: string errorMsg: nullable: true type: string warningMsg: nullable: true type: string type: object securitySchemes: ApiKeyAuth: description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). in: header name: x-auth-apikey type: apiKey oauth2: description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer `. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.' flows: authorizationCode: authorizationUrl: https://console.rhombus.com/oauth/authorize refreshUrl: https://auth-web.rhombussystems.com/oauth/token scopes: physical: Unlock doors and elevators, lockdown, alarms, speakers and robots read: View cameras, footage and settings write: Change settings and data tokenUrl: https://auth-web.rhombussystems.com/oauth/token type: oauth2 ````