Добавить права доступа к пользователю на сериализаторе

Я пытаюсь добавить/обновить разрешения для пользователей по id на сериализаторе, но ничего не изменилось (ни добавить, ни обновить) и я не получаю никаких ошибок, поэтому я не могу знать, где проблема, я пробовал эти методы и ничего не работает. спасибо всем.

сериализатор (обновление):

class UpdateSerializer(serializers.ModelSerializer):
    """Handle serialization and deserialization of User objects."""

    # user_permissions = PermissionSerializer(many=True, write_only=True)
    # user_permissions = serializers.SlugRelatedField(
    #     many=True, read_only=True, slug_field="id"
    # )
    def get_user_permissions(self, user):
        return list(user.user_permissions.all().values_list("id", flat=True))

    class Meta:
        model = User
        fields = [
            "email",
            "password",
            "tel",
            "first_name",
            "last_name",
            "registration_id",
            "avatar",
            "is_deleted",
            "user_permissions",
        ]

        extra_kwargs = {
            "is_deleted": {"write_only": True},
            "password": {"write_only": True},
        }

    # override the update method to save the data
    def update(self, instance, validated_data):
        """Perform an update on a User."""
        password = validated_data.pop("password", None)
        # permissions_list = self.get_user_permissions()
        # permissions = Permission.objects.filter(id__in=permissions_list)
        permissions = self.request.data["user_permissions"]
        # permissions = Permission.objects.filter(id__in=Permission.objects.all()).values
        instance.user_permissions.set(permissions)
        for (key, value) in validated_data.items():
            setattr(instance, key, value)

        if password is not None:
            instance.set_password(password)
        instance.save()
        return instance

представление пользователя:

class UpdateUserView(generics.RetrieveUpdateAPIView):
    permission_classes = [IsAuthenticated]
    serializer_class = UpdateSerializer
    queryset = User.objects.all()

    def update(self, request, *args, **kwargs):
        instance = self.get_object()
        serializer = self.serializer_class(instance, data=request.data, partial=True)

        if serializer.is_valid(raise_exception=True):
            self.perform_update(serializer)
            return Response(serializer.data)

        if getattr(instance, "_prefetched_objects_cache", None):
            # If 'prefetch_related' has been applied to a queryset, we need to
            # forcibly invalidate the prefetch cache on the instance.
            instance._prefetched_objects_cache = {}
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

Итак, есть идеи, пожалуйста?!

class UpdateSerializer(serializers.ModelSerializer):
    """Handle serialization and deserialization of User objects."""

    # user_permissions = PermissionSerializer(many=True, read_only=True)
    user_permissions = serializers.SlugRelatedField(
        many=True, queryset=Permission.objects.all(), slug_field="id"
    )

    class Meta:
        model = User
        fields = [
            "email",
            "password",
            "tel",
            "first_name",
            "last_name",
            "registration_id",
            "avatar",
            "is_deleted",
            "user_permissions",
        ]

        extra_kwargs = {
            "is_deleted": {"write_only": True},
            "password": {"write_only": True},
        }

    # override the update method to save the data
    def update(self, instance, validated_data):
        """Perform an update on a User."""
        password = validated_data.pop("password", None)
        permissions = validated_data.pop("user_permissions", None)

        for (key, value) in validated_data.items():
            setattr(instance, key, value)

        if password is not None:
            instance.set_password(password)

        if permissions is not None:
            instance.user_permissions.set(permissions)

        instance.save()

        return instance