> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manus.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# team.asset.update_scope

> Overrides the permission scope of a single share record as the team admin and writes a `note` into the audit log. Requires an API key of type `KEY_TYPE_TEAM_ASSET_MGMT`.

<sup>Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).</sup>

<Warning>
  **Admin override.** This endpoint changes the share scope of a resource that does not belong to the caller. Use it from controlled DSPM workflows only and always supply a meaningful `note` — it is written to the audit log and is the only record of why the override happened.
</Warning>

<Tip>
  **Auth:** Requires an `KEY_TYPE_TEAM_ASSET_MGMT` enterprise API key. Audit-class keys are rejected.

  **Lookup `share_uid` first.** Call [team.asset.list](/enterprise/v2/team.asset.list) to discover the `uid` of the share row you want to override. The `share_uid` must belong to the same team as the API key.

  **Note is mandatory in spirit.** Although `note` is technically optional, it is written verbatim to `team_asset_audit_logs.remark` and is the only place the override's intent is recorded — supply something meaningful. The audit row also records the calling key's name in `api_key_name`, which is what operators reviewing the team asset audit log use to tell API-driven overrides apart from manual admin actions — see the [overview](/enterprise/v2/asset-governance-overview#operational-notes) for the full semantics.

  **Protocols:** Also callable via Connect RPC. See [Protocols](/enterprise/v2/protocols).
</Tip>


## OpenAPI

````yaml POST /v2/team.asset.update_scope
openapi: 3.1.0
info:
  title: Manus Team Asset Governance OpenAPI v2
  description: >-
    API for enterprise tenant administrators to enumerate and govern shareable
    team assets (DSPM workflows). Two services share this surface:
    `TeamAssetAuditApiV2Service` (read-only enumeration) and
    `TeamAssetManageApiV2Service` (admin override of share scope). The
    `KEY_TYPE_TEAM_ASSET_MGMT` key carries write access and is also accepted on
    the read endpoint; `KEY_TYPE_TEAM_ASSET_AUDIT` is read-only. All responses
    are wrapped with `{"ok": true, "request_id": "...", ...}` for success and
    `{"ok": false, "request_id": "...", "error": {"code": "...", "message":
    "..."}}` for errors. Every operation is callable via REST (paths below) or
    via Connect RPC at `/team.v2.TeamAssetAuditApiV2Service/<Method>` /
    `/team.v2.TeamAssetManageApiV2Service/<Method>`.
  version: 2.0.0
servers:
  - url: https://api.manus.im
security:
  - ApiKeyAuth: []
paths:
  /v2/team.asset.update_scope:
    post:
      summary: UpdateAssetShareScope
      description: >-
        Overrides the permission scope of a single share record as the team
        admin and writes a `note` into the audit log. Requires an API key of
        type `KEY_TYPE_TEAM_ASSET_MGMT`.
      operationId: team.v2.TeamAssetManageApiV2Service.UpdateAssetShareScope
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                share_uid:
                  type: string
                  description: >-
                    UID of the `team_asset_shares` row to override. Must belong
                    to the calling team. Look up via
                    [team.asset.list](/enterprise/v2/team.asset.list).
                permission:
                  $ref: '#/components/schemas/ShareScope'
                  description: New permission for the share.
                note:
                  type: string
                  description: >-
                    Free-form audit note. Written to the
                    `team_asset_audit_logs.remark` column and surfaced to anyone
                    reviewing why the scope was changed.
              required:
                - share_uid
                - permission
      responses:
        '200':
          description: Share scope updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                    example: true
                    description: Whether the request was successful.
                  request_id:
                    type: string
                    description: Unique identifier for this API request.
        4XX:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ShareScope:
      type: string
      description: >-
        v2 share scope. `OWNER` keeps the asset fully private; `TEAM_ONLY`
        restricts to team members; `PUBLIC` makes the asset publicly accessible
        (the underlying v1 representation is `SHARE_PERMISSION_PUBLIC` for
        `SESSION_SHARE` / `FILE_SHARE` / `WEBSITE_PUBLISH`, and
        `SHARE_PERMISSION_EXTERNAL` for `SESSION_COLLABORATION` /
        `PROJECT_SHARE`). On the response side both v1 `PUBLIC` and `EXTERNAL`
        are folded back to `SHARE_SCOPE_PUBLIC`. See the
        [overview](/enterprise/v2/asset-governance-overview#mapping-to-v1-sharepermission)
        for the full mapping.
      enum:
        - SHARE_SCOPE_OWNER
        - SHARE_SCOPE_TEAM_ONLY
        - SHARE_SCOPE_PUBLIC
    ErrorResponse:
      type: object
      description: Standard error response format returned when a request fails.
      properties:
        ok:
          type: boolean
          example: false
          description: Always false for error responses.
        request_id:
          type: string
          description: >-
            Unique identifier for this API request, useful for debugging with
            support.
        error:
          type: object
          description: Error details.
          properties:
            code:
              type: string
              description: >-
                Machine-readable error code: `invalid_argument`, `not_found`,
                `permission_denied`, `failed_precondition`, or `internal`.
            message:
              type: string
              description: Human-readable error description explaining what went wrong.
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

````