Here is an example
ThingTemplates[Entity].AddInstanceRunTimePermission({
principal: GroupName /* STRING */,
allow: true /* BOOLEAN */,
resource: ServiceName /* STRING */,
type: "ServiceInvoke" /* STRING */,
principalType: "Group" /* STRING */
});
or for a collection:
Resources["CollectionFunctions"].AddCollectionRunTimePermission({
principal: "System" /* STRING */,
allow: true /* BOOLEAN */,
resource: "*" /* STRING */,
type: "ServiceInvoke" /* STRING */,
principalType: "User" /* STRING */,
collectionName: "Things" /* STRING */
});
So you can call something like this with an API call using <server>/Thingworx/ThingTemplates/Services/AddInstanceRunTimePermission
For design time you would do AddInstanceDesignTimePermission
Also for the Template itself vs. instance, just remove the word instance.
!!Caution: If you are looking to do this through API calls, set proper security so that you don't open things up to allow the application key user to set permissions where they shouldn't or do other things. I recommend you create a specific service that does things within a defined context and scope and give permission to the appkey user to run that service only. Then from within that service you can validate and secure and use the system user to invoke the add permission services.
