> ## Documentation Index
> Fetch the complete documentation index at: https://tickblaze.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorize or revoke user entitlements

> Update your firm's entitlement status for the requested user and entitlement package. L2 market data access may be created directly. L1 access can be updated only when the user already has L1 eligibility. Call `PATCH /api/users/{user_id}/entitlements/` using the `user_id` value returned by `GET /api/entitlements/user-entitlements/`, and pass either the entitlement name or exchange codes plus level in the request body to identify which package should be changed. Use `AUTHORIZED` to grant access, `REVOKED` to remove access, or `PENDING` to restore a pending state for your firm. Revoking access for your firm may not change the entitlement status shown by later entitlement reads if the user remains eligible through another source.



## OpenAPI

````yaml /openapi.json patch /api/users/{user_id}/entitlements/
openapi: 3.0.3
info:
  title: TBBO API
  version: 1.0.0
  description: >
    Authentication uses short-lived session tokens (3 hours).


    Send the token with every request using the `Authorization` header:


    ```

    Authorization: Token <token>

    ```


    Example:


    ```

    Authorization: Token 123abc456def789

    ```


    To obtain a token, call `POST /auth/login/` with valid credentials. The
    response includes a `key` value. Use that value in the header above for
    subsequent API calls.


    How to find required IDs:


    - `challenge_id`: Prop Tech Configuration -> Challenges

    - `user_id`: Tickblaze Manager -> Users

    - `account_id`: Tickblaze Manager -> Accounts 
servers: []
security: []
tags:
  - name: withdrawals
    description: Withdrawal related endpoints
    x-displayName: Withdrawals
paths:
  /api/users/{user_id}/entitlements/:
    patch:
      tags:
        - Entitlements
      summary: Authorize or revoke user entitlements
      description: >-
        Update your firm's entitlement status for the requested user and
        entitlement package. L2 market data access may be created directly. L1
        access can be updated only when the user already has L1 eligibility.
        Call `PATCH /api/users/{user_id}/entitlements/` using the `user_id`
        value returned by `GET /api/entitlements/user-entitlements/`, and pass
        either the entitlement name or exchange codes plus level in the request
        body to identify which package should be changed. Use `AUTHORIZED` to
        grant access, `REVOKED` to remove access, or `PENDING` to restore a
        pending state for your firm. Revoking access for your firm may not
        change the entitlement status shown by later entitlement reads if the
        user remains eligible through another source.
      operationId: api_users_entitlements_partial_update
      parameters:
        - in: path
          name: user_id
          schema:
            type: integer
          description: Trader user id whose entitlement records should be updated.
          required: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedUserEntitlementStatusUpdate'
            examples:
              AuthorizeL2DataRequest:
                value:
                  entitlement: CBOT
                  level: l2
                  status: AUTHORIZED
                summary: Allow L2 data for a user
              AuthorizeMultipleExchanges:
                value:
                  exchange_codes:
                    - cme
                    - cbot
                    - comex
                    - nymex
                  level: l2
                  status: AUTHORIZED
                summary: Allow L2 data for several exchanges
              RevokeRequest:
                value:
                  entitlement: CBOT
                  level: l2
                  status: REVOKED
                summary: Revoke entitlements for a user
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchedUserEntitlementStatusUpdate'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PatchedUserEntitlementStatusUpdate'
      responses:
        '204':
          description: >-
            Your firm's targeted entitlement status was created or updated
            successfully.
        '400':
          description: Invalid `user_id` or request payload.
        '404':
          description: >-
            The requested entitlement or exchange code was not found, or the
            user does not already have the requested L1 entitlement for your
            firm.
      security:
        - tokenAuth: []
components:
  schemas:
    PatchedUserEntitlementStatusUpdate:
      type: object
      properties:
        entitlement:
          type: string
          description: Human-readable entitlement name to update for this user.
        exchange_codes:
          type: array
          items:
            type: string
          description: >-
            Exchange codes whose matching entitlements should be updated for
            this user. Use this instead of `entitlement` when changing multiple
            exchanges in one request.
        level:
          allOf:
            - $ref: '#/components/schemas/LevelEnum'
          description: >-
            Market data level for the entitlement being updated. L2 requests can
            create a new entitlement entry for your firm; L1 requests require
            existing eligibility for the requested entitlement.


            * `l1` - Level 1

            * `l2` - Level 2
        status:
          allOf:
            - $ref: '#/components/schemas/Status19bEnum'
          description: >-
            New status to apply to your firm's entitlement for the selected user
            and entitlement. This does not change eligibility from other
            sources.


            * `PENDING` - Pending Authorization

            * `AUTHORIZED` - Authorized

            * `REVOKED` - Revoked
    LevelEnum:
      enum:
        - l1
        - l2
      type: string
      description: |-
        * `l1` - Level 1
        * `l2` - Level 2
    Status19bEnum:
      enum:
        - PENDING
        - AUTHORIZED
        - REVOKED
      type: string
      description: |-
        * `PENDING` - Pending Authorization
        * `AUTHORIZED` - Authorized
        * `REVOKED` - Revoked
  securitySchemes:
    tokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Token-based authentication with required prefix "Token"

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.