Give access to an object via API and keep existing access

When a user is given access to an object via an API, the existing access is all removed and the new access is the only access that remains. We should be able to add/remove/edit individual rights without editing all access on the object.