# grantTeamMemberCapability

Turn ONE permission on for a teammate, a switch in Manage permissions on their row. Off for a member unless granted: VIEW_ALL_CONTACTS, VIEW_ALL_DEALS, VIEW_ALL_PHONES (call and text from any team number), CONTRACTS_VIEW, CONTRACTS_MANAGE. On unless an admin turned them off (granting one gives it back): CAN_SKIPTRACE, CAN_EXPORT, CAN_WORKFLOW (run workflows), VIEW_TEAM_DIRECTORY (see who else is on the team), VIEW_TEAM_CALENDARS (see teammates' calendars on the Team calendar), VIEW_TEAM_CALLS_TEXTS (read teammates' calls and texts in the Team inbox; email only from mailboxes their owner shares), and the app sections CAN_USE_AUTOMATIONS (and workflow operations), CAN_USE_FILES, CAN_USE_MARKETPLACE, VIEW_ORGANIZATION_SETTINGS, CAN_USE_API_KEYS. Their role does not change: this is the answer to "give X access to Y" for a Member, never a promotion to Admin. userId comes from listTeamMembers. An Admin already holds every permission, so it changes nothing for one. Takes effect within a minute. Organization admins only; the person approves it on a card naming the teammate and the permission.

- Call: `POST https://server.goliathdata.com/api/v1/call` with `{ "operationId": "grantTeamMemberCapability", "variables": {...} }`
- Scope: `ADMIN`
- Type: mutation
- Idempotency: honors `Idempotency-Key` (24 h)
- Rate-limited: no

## Variables

- `userId`: `ID!` (required)
- `capability`: `OrganizationCapability!` (required, one of `VIEW_ALL_CONTACTS`, `VIEW_ALL_PIPELINE_ITEMS`, `VIEW_ALL_DEALS`, `VIEW_ALL_PHONES`, `CONTRACTS_VIEW`, `CONTRACTS_MANAGE`, `CAN_SKIPTRACE`, `CAN_EXPORT`, `CAN_WORKFLOW`, `VIEW_TEAM_DIRECTORY`, `CAN_USE_AUTOMATIONS`, `CAN_USE_FILES`, `CAN_USE_MARKETPLACE`, `VIEW_ORGANIZATION_SETTINGS`, `CAN_USE_API_KEYS`, `CAN_USE_COMPUTER`, `CAN_MANAGE_SPENDING`, `VIEW_TEAM_CALENDARS`, `VIEW_TEAM_CALLS_TEXTS`)

## Response (data, an example)

```json
{
  "teamMutation": {
    "grantTeamMemberCapability": {
      "id": "<ID>"
    }
  }
}
```

## Example

```bash
curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "operationId": "grantTeamMemberCapability",
    "variables": {
      "userId": "<userId>",
      "capability": "VIEW_ALL_CONTACTS"
    }
  }'
```