ShotGrid API and Permission Group Interoperability

Answer first

The ShotGrid API enforces the same group-based access control as the web UI. An API request succeeds only if the authenticated user has the required read, write or delete right for the entity type in the project via at least one of their groups.

When a user belongs to multiple groups, permissions are additive. If any group grants a permission for an entity type/project, the user effectively has it. Evaluation is most permissive wins, not most restrictive. Primary group is not a hard limit; all groups the user belongs to are evaluated.

ShotGrid does not provide a native per-entity ACL override layer that can deny access on a single entity instance. What is often described as an entity-specific override is in practice project-level entity type permissions, custom script filtering, or access rules. The API does not apply a separate per-entity deny that supersedes group grants.

Confirmed facts

• API access control mirrors UI access control for the same user and project.
• Effective permission = union of permissions from all groups the user belongs to for that project and entity type.
• Most permissive wins across overlapping group memberships.

Likely explanation for perceived overrides

Observed differences between UI and API or between entities are usually explained by:

• Project-level entity type permissions, not per-entity ACLs.
• Custom server-side scripts, event daemons, or access rules that filter results or block writes after the core permission check.
• Misattribution of a project or entity type permission change to a single entity.

Custom scripts can alter effective access, so observed API results may diverge from the documented core model.

Steps needed for this case

1. Authenticate as the test user via API and test a read and a write call on the target entity type. Compare success to UI access for the same user.
2. List the user's groups and the project permissions for each group for the relevant entity type.
3. Compute the union of those permissions. If the required right is present in any group, API access should succeed under core ShotGrid behavior.
4. If API fails despite a union grant, check for custom permission scripts, access rules, or field-level filtering installed on the instance.

One diagnostic detail that changes the recommendation: ShotGrid/Flow Production Tracking version and whether custom permission scripts or access rules are installed on the instance. That determines whether core additive logic applies or custom logic overrides it.