# Create a permission using a API

**URL:** <https://community.auth0.com/t/create-a-permission-using-a-api/122233>\
**Category:** Get Help\
**Tags:** resource-servers, management-api\
**Created:** [December 3, 2023, 8:32pm UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233 "2023-12-03T20:32:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zPedrooGF](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/zpedroogf/32/51278_2.png) [@zPedrooGF](https://community.auth0.com/u/zPedrooGF)\
**Post date:** [December 3, 2023, 8:32pm UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233/1 "2023-12-03T20:32:20Z")

</div>

I would like to create permissions in my application via the API, according to the following excerpt from the [documentation](https://auth0.com/docs/get-started/apis/add-api-permissions):

```auto
curl --request PATCH \
  --url 'https://{my domain}.uk.auth0.com/api/v2/resource-servers/API_ID' \
  --header 'authorization: Bearer MGMT_API_ACCESS_TOKEN' \
  --header 'cache-control: no-cache' \
  --header 'content-type: application/json' \
  --data '{ "scopes": [{ "value": "PERMISSION_NAME", "description": "PERMISSION_DESC" }, { "value": "PERMISSION_NAME", "description": "PERMISSION_DESC" }] }'

```

In “your domain”, I put the domain of the Regular Web Application itself, in API\_ID, I put the ID of the API that takes care of my permissions, the access token is my regular user token with the permission: “update:resource\_servers”.

However, I get the error:

```auto
{
	"statusCode": 401,
	"error": "Unauthorized",
	"message": "Bad audience: https://{my api audience from my custom api} {my domain}.uk.auth0.com/userinfo"
}

```

How can I solve this?

---

<div class="post-metadata">

**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\
**Post date:** [December 4, 2023, 10:00am UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233/3 "2023-12-04T10:00:14Z")

</div>

Hi @zPedrooGF !

> [@zPedrooGF](#):
>
> In “your domain”, I put the domain of the Regular Web Application itself

Please use your Auth0 domain (where you have registered your API and other apps) instead:

 ![image](https://global.discourse-cdn.com/auth0/original/3X/d/7/d78e55bc800c4dd59679784787dad3c51a06fe6a.png)

Making this small adjustment, you should be able to successfully updater the api permissions:

 ![image](https://global.discourse-cdn.com/auth0/original/3X/9/4/94e2417a9e559dcba2d26d37ac3fbaa41c374f90.png)

Please let me know any questions!

---

<div class="post-metadata">

**Author:** ![zPedrooGF](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/zpedroogf/32/51278_2.png) [@zPedrooGF](https://community.auth0.com/u/zPedrooGF)\
**Post date:** [December 4, 2023, 12:41pm UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233/4 "2023-12-04T12:41:58Z")

</div>

Hello, thanks for the reply @marcelina.barycka !

If I understood correctly, which apparently I didn’t, it still doesn’t work

 ![image](https://global.discourse-cdn.com/auth0/original/3X/e/f/efd485b56ec968aec5280a87f41a8caab138fddb.png)

![image](https://global.discourse-cdn.com/auth0/original/3X/1/a/1a8daa5b0d6056332f3180128123320dc0019499.png)

 ![image](https://global.discourse-cdn.com/auth0/original/3X/d/d/dd4394f0bf045ee74ee440f351396bc7fa327141.png)

---

<div class="post-metadata">

**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\
**Post date:** [December 5, 2023, 10:38am UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233/5 "2023-12-05T10:38:04Z")

</div>

Hi @zPedrooGF !

How do you get the token that you later use to call the management API?  
Can you please try to get/request a new token setting the audience to be Management API Identifier (the value from the screen below):

 ![image](https://global.discourse-cdn.com/auth0/original/3X/7/2/728746c1947325d731dd202b42aa6d9b2b4411f2.png)

The reasoning is that this token allows you to call the management API thus when requesting a token for it, the audience must be set to the Management API Identifier.

Also please make sure that this token has scopes sufficient to create new permissions for your custom API.

---

<div class="post-metadata">

**Author:** ![zPedrooGF](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/zpedroogf/32/51278_2.png) [@zPedrooGF](https://community.auth0.com/u/zPedrooGF)\
**Post date:** [December 5, 2023, 11:26am UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233/6 "2023-12-05T11:26:58Z")

</div>

Hi @marcelina.barycka !!

I’m using the auth0 client ID and auth0 client secret from my normal web application with the auth0 public custom API (not the system API). I think this is why it’s not working, because I get an API explorer in my system API and this works.

Do you have any documentation to recommend reading about this? I’m lost about the workflow to use custom API

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 19, 2023, 11:27am UTC](https://community.auth0.com/t/create-a-permission-using-a-api/122233/7 "2023-12-19T11:27:12Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.