# Appropriate way to convey item mutation permissions (ALLOW not appropriate)

**URL:** <https://discuss.jsonapi.org/t/appropriate-way-to-convey-item-mutation-permissions-allow-not-appropriate/805>\
**Category:** Uncategorized\
**Created:** [October 14, 2016, 9:01pm UTC](https://discuss.jsonapi.org/t/appropriate-way-to-convey-item-mutation-permissions-allow-not-appropriate/805 "2016-10-14T21:01:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dteirney](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@dteirney](https://discuss.jsonapi.org/u/dteirney)\
**Post date:** [October 14, 2016, 9:01pm UTC](https://discuss.jsonapi.org/t/appropriate-way-to-convey-item-mutation-permissions-allow-not-appropriate/805/1 "2016-10-14T21:01:53Z")

</div>

The general guidance to determine if the authenticated user has permissions to mutate a collection appears to be to return the Allow header with the allowed methods, e.g. `Allow: GET, POST, DELETE`

We have a finer grained authorization model, and the authenticated user may have different permissions for each item in the collection. For example, a user may only be able to update content they have created, or we may be aggregating content from multiple backends, and only items retrieved from one of those backends might support update (or delete).

We’re looking at providing hypermedia links to provide this information. Has anyone done this with json:api?

Is there a best practice for the rel types to use? The IANA list of link relations only really covers `edit`.