> ## Documentation Index > Fetch the complete documentation index at: https://api-docs.helpyousponsor.com/llms.txt > Use this file to discover all available pages before exploring further. # Queue a bulk file permission update > Queues a background selection job that updates upload permissions for explicitly selected files, selected recipients, a search result, or an advanced filter. The job may schedule the permission change, generate blurred thumbnails, and notify donors depending on the payload. Requires admin file access through `user.permissions`. ## OpenAPI ````yaml patch /files/permissions/bulk openapi: 3.0.0 info: title: Gratona API description: >- REST API for the Gratona fundraising platform, including donor, donation, sponsorship, program, event, and integration workflows. Endpoints are organized by tag. Most endpoints require either a Passport bearer token or an issued API key — see the Security Schemes section. contact: name: Gratona Engineering url: https://gratona.com email: devs@gratona.com version: 1.0.0 servers: - url: https://api.gratona.com/v1 description: Server Version 1.0.0 security: [] tags: - name: Auth description: >- Login, signup, logout, password reset, and email verification for admin users and donors. - name: Donors description: >- Donor records: CRUD, profile fields, household linkage, search, filters, merge, and duplicate detection. - name: Donations description: >- Individual donation records, recurring commitments, soft credits, refunds, designations, and exports. - name: Sponsorships description: >- Donor-to-entity sponsorship relationships, lifecycle transitions, and sponsorship-specific filters. - name: Entities description: >- Recipient records (children, families, projects, animals, etc.), their status, and entity-level fields. - name: Programs description: >- Program / campaign configuration: hierarchy, settings, and program-level metadata. - name: Forms description: >- Custom form builder (HysForm), form fields, standardized donor fields, and field migrations. - name: Trips description: >- Mission-trip management: trips, participants, budgets, tasks, e-signatures, fundraising milestones, and background checks. - name: Communications description: >- Email templates, SMS, newsletters, donor email manager, and per-donor notes. - name: Payments description: >- Payment-gateway management (Stripe, PayPal, Flutterwave, QuickBooks). Excludes inbound webhooks — see the Webhooks tag. - name: Reports description: Dashboards, analytics, scheduled reports, and exports. - name: Admin description: >- Client-account administration: users, groups/permissions, settings, integrations, and account lifecycle. - name: Donor Portal description: >- Endpoints consumed by the donor-facing portal (donor login, dashboard, donation history, messages). - name: Recipient Portal description: Endpoints consumed by the recipient-facing portal. - name: Public description: >- Unauthenticated public endpoints: donor signup, public trip pages, peer-to-peer campaigns, public checkout. - name: Webhooks description: >- Inbound webhooks from third parties (Stripe, PayPal, Flutterwave, Checkr, DropboxSign). Annotated minimally for reference; payload shapes are owned by the upstream provider. - name: Client description: Client - name: Email Settings description: Email Settings - name: Admin Dashboard description: Admin Dashboard - name: Historical Archived Updates description: Historical Archived Updates - name: Team & access description: Team & access - name: Files description: Files - name: Wrapped description: Wrapped - name: Donor SignUp description: Donor SignUp - name: Frontend description: Frontend - name: User description: User paths: /files/permissions/bulk: patch: tags: - Files summary: Queue a bulk file permission update description: >- Queues a background selection job that updates upload permissions for explicitly selected files, selected recipients, a search result, or an advanced filter. The job may schedule the permission change, generate blurred thumbnails, and notify donors depending on the payload. Requires admin file access through `user.permissions`. operationId: 0637e00a772e9d52af44772f6f35f691 requestBody: required: true content: application/json: schema: required: - permissions properties: program_id: description: >- Nullable integer. Required when `selection_mode` is `program`, `search`, or `advanced_filter` so the job can scope files to one program. type: integer example: 42 nullable: true upload_ids: description: Nullable array of explicit upload IDs to update. type: array items: type: integer example: 815 nullable: true entity_ids: description: >- Nullable array of recipient IDs whose files should be updated. type: array items: type: integer example: 1001 nullable: true selection_mode: description: >- Nullable string. Selects files by program, search query, or advanced filter instead of explicit upload IDs. type: string enum: - program - search - advanced_filter example: search nullable: true search_query: description: >- Nullable string. Required when `selection_mode` is `search`; passed to the background selector. type: string example: school report nullable: true filter_groups: description: >- Nullable array. Required when `selection_mode` is `advanced_filter`; contains the same filter group payload used by the file filter UI. type: array items: type: object nullable: true permissions: description: >- Required permission target. `public` exposes files broadly, `donor` limits them to related donors and admins, and `admin` hides them from donors. type: string enum: - public - donor - admin example: donor scheduled_date: description: >- Nullable date. When present, the job schedules the permission change instead of applying it immediately. type: string format: date example: '2026-06-01' nullable: true notify_donor: description: >- Nullable boolean. When true and permissions become public, donor notification jobs may be dispatched. type: boolean example: true nullable: true include_profile_files: description: >- Nullable boolean. When true, profile files can be included in the selected file set. type: boolean example: false nullable: true type: object responses: '200': description: Bulk permission job queued. content: application/json: schema: properties: message: type: string example: >- Your file permission update is being processed in the background. type: object '401': description: Authentication is required. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedResponse' '422': description: Selection or validation failed. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' security: - bearerAuth: [] - apiKeyAuth: [] components: schemas: UnauthorizedResponse: title: UnauthorizedResponse description: >- Returned with HTTP 401 when the request lacks a valid Passport bearer token, a valid `X-HYS-API-Key`, or a valid session. The body is the simple `{message, status}` envelope emitted by `AuthenticateApiOrKey`. required: - message - status properties: message: description: >- Always the literal string `Unauthorized` from the `auth.api_or_key` middleware. Login endpoints return `Invalid Credentials` instead. type: string example: Unauthorized status: type: string example: error type: object ValidationErrorResponse: title: ValidationErrorResponse description: >- Returned with HTTP 422 when `Validator::make($data, $rules)` fails. The `errors` map is keyed by the failing field name; each value is an array of human-readable error messages for that field. Most controllers also include a top-level `status: error`. required: - errors properties: errors: description: >- Map of field name to array of validator error messages. Example: `{email: [The email field is required.], amount: [The amount must be a number.]}`. type: object additionalProperties: type: array items: type: string status: description: Always the literal string `error`. type: string example: error message: description: >- Optional summary message — present on some endpoints, absent on others. type: string example: The given data was invalid. nullable: true type: object securitySchemes: bearerAuth: type: http description: Passport bearer token authentication for legacy admin sessions. scheme: bearer bearerFormat: JWT apiKeyAuth: type: apiKey description: Gratona API key sent with the compatibility header X-HYS-API-Key. name: X-HYS-API-Key in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.