# Change what someone may do

`POST https://rest.wordplus.cloud/wordplus/realtime/calls/{name}/permit`

Changes what someone may do in a group call while it runs: `publish` makes a listener a speaker, or a speaker a
listener again, which takes down what they send. `subscribe` stops or starts what they get of the others. At least
one of the two.

It is theirs at once when they are in the call, and their page hears `permissions`. The call and room tokens
signed for them before follow it too, so an older token cannot undo it. A token your server signs after follows
your rule, so keep the change where the rule reads it.

In the packages: `realtime.call( name ).permit( user, { publish, subscribe } )`.

## Parameters

| Name | In | |
|---|---|---|
| `name` (required) | path | The group call name, percent-encoded: `meeting:7` is `meeting%3A7`. |

## Request

```json
{
  "user": "43",
  "publish": true
}
```

## Answer

Whether they were in it.

```json
{
  "ok": true,
  "changed": true
}
```

## Refusals

- **400**: `bad_request`, `bad_room`: the request is not one the API takes. `reserved`: an event name kept for the room itself.
- **401**: `missing_signature`, `stale_signature` (a clock off by more than 5 minutes), `unknown_site`, `bad_signature` (a wrong secret, or a body or path other than the one signed).
- **403**: `not_included`: your plan does not include it.

## Examples

`wordplus()` (in Go `app.Request()`) signs and sends the request: https://docs.wordplus.cloud/api/signing/ has it in each language.

**curl**

```bash
wordplus POST '/wordplus/realtime/calls/class%3A7/permit' '{"user":"43","publish":true}'
```

**Node**

```js
const { changed } = await wordplus('POST', `/wordplus/realtime/calls/${encodeURIComponent('class:7')}/permit`, { user: '43', publish: true });
```

**Python**

```python
changed = wordplus("POST", f"/wordplus/realtime/calls/{quote('class:7', safe='')}/permit", {"user": "43", "publish": True})["changed"]
```

**PHP**

```php
$changed = wordplus('POST', '/wordplus/realtime/calls/'.rawurlencode('class:7').'/permit', ['user' => '43', 'publish' => true])['changed'];
```

**Go**

```go
answer, err := app.Request("POST", "/wordplus/realtime/calls/"+url.PathEscape("class:7")+"/permit", map[string]any{"user": "43", "publish": true})
```