diff --git a/rest_client_zrok/share/update_share_responses.go b/rest_client_zrok/share/update_share_responses.go
index 96726ef6..5c25b46c 100644
--- a/rest_client_zrok/share/update_share_responses.go
+++ b/rest_client_zrok/share/update_share_responses.go
@@ -26,6 +26,12 @@ func (o *UpdateShareReader) ReadResponse(response runtime.ClientResponse, consum
 			return nil, err
 		}
 		return result, nil
+	case 400:
+		result := NewUpdateShareBadRequest()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
 	case 401:
 		result := NewUpdateShareUnauthorized()
 		if err := result.readResponse(response, consumer, o.formats); err != nil {
@@ -105,6 +111,62 @@ func (o *UpdateShareOK) readResponse(response runtime.ClientResponse, consumer r
 	return nil
 }
 
+// NewUpdateShareBadRequest creates a UpdateShareBadRequest with default headers values
+func NewUpdateShareBadRequest() *UpdateShareBadRequest {
+	return &UpdateShareBadRequest{}
+}
+
+/*
+UpdateShareBadRequest describes a response with status code 400, with default header values.
+
+bad request
+*/
+type UpdateShareBadRequest struct {
+}
+
+// IsSuccess returns true when this update share bad request response has a 2xx status code
+func (o *UpdateShareBadRequest) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this update share bad request response has a 3xx status code
+func (o *UpdateShareBadRequest) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this update share bad request response has a 4xx status code
+func (o *UpdateShareBadRequest) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this update share bad request response has a 5xx status code
+func (o *UpdateShareBadRequest) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this update share bad request response a status code equal to that given
+func (o *UpdateShareBadRequest) IsCode(code int) bool {
+	return code == 400
+}
+
+// Code gets the status code for the update share bad request response
+func (o *UpdateShareBadRequest) Code() int {
+	return 400
+}
+
+func (o *UpdateShareBadRequest) Error() string {
+	return fmt.Sprintf("[PATCH /share][%d] updateShareBadRequest ", 400)
+}
+
+func (o *UpdateShareBadRequest) String() string {
+	return fmt.Sprintf("[PATCH /share][%d] updateShareBadRequest ", 400)
+}
+
+func (o *UpdateShareBadRequest) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
 // NewUpdateShareUnauthorized creates a UpdateShareUnauthorized with default headers values
 func NewUpdateShareUnauthorized() *UpdateShareUnauthorized {
 	return &UpdateShareUnauthorized{}
diff --git a/rest_model_zrok/update_share_request.go b/rest_model_zrok/update_share_request.go
index a6b58f75..28a66045 100644
--- a/rest_model_zrok/update_share_request.go
+++ b/rest_model_zrok/update_share_request.go
@@ -17,9 +17,15 @@ import (
 // swagger:model updateShareRequest
 type UpdateShareRequest struct {
 
+	// add access grants
+	AddAccessGrants []string `json:"addAccessGrants"`
+
 	// backend proxy endpoint
 	BackendProxyEndpoint string `json:"backendProxyEndpoint,omitempty"`
 
+	// remove access grants
+	RemoveAccessGrants []string `json:"removeAccessGrants"`
+
 	// shr token
 	ShrToken string `json:"shrToken,omitempty"`
 }
diff --git a/rest_server_zrok/embedded_spec.go b/rest_server_zrok/embedded_spec.go
index 0427b7ec..227e9820 100644
--- a/rest_server_zrok/embedded_spec.go
+++ b/rest_server_zrok/embedded_spec.go
@@ -988,6 +988,9 @@ func init() {
           "200": {
             "description": "share updated"
           },
+          "400": {
+            "description": "bad request"
+          },
           "401": {
             "description": "unauthorized"
           },
@@ -1721,9 +1724,21 @@ func init() {
     "updateShareRequest": {
       "type": "object",
       "properties": {
+        "addAccessGrants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "backendProxyEndpoint": {
           "type": "string"
         },
+        "removeAccessGrants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "shrToken": {
           "type": "string"
         }
@@ -2728,6 +2743,9 @@ func init() {
           "200": {
             "description": "share updated"
           },
+          "400": {
+            "description": "bad request"
+          },
           "401": {
             "description": "unauthorized"
           },
@@ -3461,9 +3479,21 @@ func init() {
     "updateShareRequest": {
       "type": "object",
       "properties": {
+        "addAccessGrants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "backendProxyEndpoint": {
           "type": "string"
         },
+        "removeAccessGrants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "shrToken": {
           "type": "string"
         }
diff --git a/rest_server_zrok/operations/share/update_share_responses.go b/rest_server_zrok/operations/share/update_share_responses.go
index 61577381..a651975b 100644
--- a/rest_server_zrok/operations/share/update_share_responses.go
+++ b/rest_server_zrok/operations/share/update_share_responses.go
@@ -36,6 +36,31 @@ func (o *UpdateShareOK) WriteResponse(rw http.ResponseWriter, producer runtime.P
 	rw.WriteHeader(200)
 }
 
+// UpdateShareBadRequestCode is the HTTP code returned for type UpdateShareBadRequest
+const UpdateShareBadRequestCode int = 400
+
+/*
+UpdateShareBadRequest bad request
+
+swagger:response updateShareBadRequest
+*/
+type UpdateShareBadRequest struct {
+}
+
+// NewUpdateShareBadRequest creates UpdateShareBadRequest with default headers values
+func NewUpdateShareBadRequest() *UpdateShareBadRequest {
+
+	return &UpdateShareBadRequest{}
+}
+
+// WriteResponse to the client
+func (o *UpdateShareBadRequest) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(400)
+}
+
 // UpdateShareUnauthorizedCode is the HTTP code returned for type UpdateShareUnauthorized
 const UpdateShareUnauthorizedCode int = 401
 
diff --git a/sdk/python/sdk/zrok/zrok_api/models/update_share_request.py b/sdk/python/sdk/zrok/zrok_api/models/update_share_request.py
index 069f143b..3548c101 100644
--- a/sdk/python/sdk/zrok/zrok_api/models/update_share_request.py
+++ b/sdk/python/sdk/zrok/zrok_api/models/update_share_request.py
@@ -29,23 +29,33 @@ class UpdateShareRequest(object):
     """
     swagger_types = {
         'shr_token': 'str',
-        'backend_proxy_endpoint': 'str'
+        'backend_proxy_endpoint': 'str',
+        'add_access_grants': 'list[str]',
+        'remove_access_grants': 'list[str]'
     }
 
     attribute_map = {
         'shr_token': 'shrToken',
-        'backend_proxy_endpoint': 'backendProxyEndpoint'
+        'backend_proxy_endpoint': 'backendProxyEndpoint',
+        'add_access_grants': 'addAccessGrants',
+        'remove_access_grants': 'removeAccessGrants'
     }
 
-    def __init__(self, shr_token=None, backend_proxy_endpoint=None):  # noqa: E501
+    def __init__(self, shr_token=None, backend_proxy_endpoint=None, add_access_grants=None, remove_access_grants=None):  # noqa: E501
         """UpdateShareRequest - a model defined in Swagger"""  # noqa: E501
         self._shr_token = None
         self._backend_proxy_endpoint = None
+        self._add_access_grants = None
+        self._remove_access_grants = None
         self.discriminator = None
         if shr_token is not None:
             self.shr_token = shr_token
         if backend_proxy_endpoint is not None:
             self.backend_proxy_endpoint = backend_proxy_endpoint
+        if add_access_grants is not None:
+            self.add_access_grants = add_access_grants
+        if remove_access_grants is not None:
+            self.remove_access_grants = remove_access_grants
 
     @property
     def shr_token(self):
@@ -89,6 +99,48 @@ class UpdateShareRequest(object):
 
         self._backend_proxy_endpoint = backend_proxy_endpoint
 
+    @property
+    def add_access_grants(self):
+        """Gets the add_access_grants of this UpdateShareRequest.  # noqa: E501
+
+
+        :return: The add_access_grants of this UpdateShareRequest.  # noqa: E501
+        :rtype: list[str]
+        """
+        return self._add_access_grants
+
+    @add_access_grants.setter
+    def add_access_grants(self, add_access_grants):
+        """Sets the add_access_grants of this UpdateShareRequest.
+
+
+        :param add_access_grants: The add_access_grants of this UpdateShareRequest.  # noqa: E501
+        :type: list[str]
+        """
+
+        self._add_access_grants = add_access_grants
+
+    @property
+    def remove_access_grants(self):
+        """Gets the remove_access_grants of this UpdateShareRequest.  # noqa: E501
+
+
+        :return: The remove_access_grants of this UpdateShareRequest.  # noqa: E501
+        :rtype: list[str]
+        """
+        return self._remove_access_grants
+
+    @remove_access_grants.setter
+    def remove_access_grants(self, remove_access_grants):
+        """Sets the remove_access_grants of this UpdateShareRequest.
+
+
+        :param remove_access_grants: The remove_access_grants of this UpdateShareRequest.  # noqa: E501
+        :type: list[str]
+        """
+
+        self._remove_access_grants = remove_access_grants
+
     def to_dict(self):
         """Returns the model properties as a dict"""
         result = {}
diff --git a/specs/zrok.yml b/specs/zrok.yml
index f8031ab7..155f3730 100644
--- a/specs/zrok.yml
+++ b/specs/zrok.yml
@@ -651,6 +651,8 @@ paths:
       responses:
         200:
           description: share updated
+        400:
+          description: bad request
         401:
           description: unauthorized
         404:
@@ -1127,6 +1129,14 @@ definitions:
         type: string
       backendProxyEndpoint:
         type: string
+      addAccessGrants:
+        type: array
+        items:
+          type: string
+      removeAccessGrants:
+        type: array
+        items:
+          type: string
 
   verifyRequest:
     type: object
diff --git a/ui/src/api/types.js b/ui/src/api/types.js
index 052dad52..153ff723 100644
--- a/ui/src/api/types.js
+++ b/ui/src/api/types.js
@@ -321,6 +321,8 @@
  * 
  * @property {string} shrToken 
  * @property {string} backendProxyEndpoint 
+ * @property {string[]} addAccessGrants 
+ * @property {string[]} removeAccessGrants 
  */
 
 /**