# Control which RbacGroups and/or Users have access to a mentor and with what Role

Create or update RBAC policies to manage group and user access to specific mentors. Creates role-specific policies and handles adding/removing groups and users.

Endpoint: POST /api/core/rbac/mentor-access/
Version: 4.84.1-ai-plus
Security: PlatformApiKeyAuthentication

## Request fields (application/json):

  - `platform_key` (string, required)
    Platform key where the mentor belongs

  - `mentor_id` (integer, required)
    ID of the mentor to manage access for

  - `role` (string, required)
    Role for accessing this mentor (viewer or editor)

  - `groups_to_add` (array)
    List of group IDs to grant access to this mentor

  - `groups_to_remove` (array)
    List of group IDs to revoke access from this mentor

  - `users_to_add` (array)
    List of user IDs to grant access to this mentor

  - `users_to_remove` (array)
    List of user IDs to revoke access from this mentor

## Response 200 fields (application/json):

  - `id` (integer, required)

  - `name` (string, required)
    Policy name. If not supplied, defaults to a UUID4

  - `role` (string, required)
    Role for accessing this mentor (viewer or editor)

  - `resources` (any, required)
    List of resources this policy applies to

  - `users` (array, required)

  - `users.id` (integer, required)
    edX user ID

  - `users.username` (string,null)
    edX username

  - `users.email` (string,null)
    edX email

  - `groups` (array, required)

  - `groups.name` (string)
    Optional name of the group

  - `groups.unique_id` (string, required)
    The unique identifier for the group

  - `groups.description` (string)
    Optional group description

## Response 201 fields (application/json):

  - `id` (integer, required)

  - `name` (string, required)
    Policy name. If not supplied, defaults to a UUID4

  - `role` (string, required)
    Role for accessing this mentor (viewer or editor)

  - `resources` (any, required)
    List of resources this policy applies to

  - `users` (array, required)

  - `users.id` (integer, required)
    edX user ID

  - `users.username` (string,null)
    edX username

  - `users.email` (string,null)
    edX email

  - `groups` (array, required)

  - `groups.name` (string)
    Optional name of the group

  - `groups.unique_id` (string, required)
    The unique identifier for the group

  - `groups.description` (string)
    Optional group description


## Response 400 fields

## Response 403 fields

## Response 404 fields