Update User

PATCH /api/users/:id

Request BodyCopy Anchor Link

{
  "firstName": "Jane",
  "lastName": "Smith",
  "role": "admin",
  "isActive": true,
  "customerIds": ["11111111-1111-4111-8111-111111111111", "22222222-2222-4222-8222-222222222222"] // Update the list of assigned customers via public IDs
}

Notes:

• customerIds accepts customer public IDs and legacy numeric IDs.
• Public IDs are the preferred format for new integrations.
• firstName and lastName are limited to 100 characters, role must be one of admin, editor, readonly, responder, customerIds holds at most 500 entries.
• The global platform flags (isGlobalAdmin, isGlobalSupporter) cannot be set through this endpoint; they are ignored if sent.

GuardsCopy Anchor Link

• You cannot deactivate yourself or change your own role.
• The last active admin of an organization cannot be demoted or deactivated. Promote another user to admin first.
• A user who is a global admin or global supporter can only be modified by a global admin.

Common errorsCopy Anchor Link

• 400 Bad Request when the body fails validation (unknown field type, string too long, customerIds not an array)
• 400 Bad Request with data.code: "invalidRole" when role is not one of the allowed values
• 400 Bad Request with data.code: "userSelfChangeForbidden" when you try to deactivate yourself or change your own role
• 400 Bad Request with data.code: "lastAdminProtected" when the change would leave the organization without an active admin
• 403 Forbidden with data.code: "globalUserProtected" when a tenant admin tries to modify a global admin or global supporter
• 404 Not Found when the user does not exist in your organization

ResponseCopy Anchor Link

Returns the updated user object. See Error Codes for error responses.