PUT /api/users/{user_id} · PATCH /api/users/{user_id}
Updates a user’s profile. Both PUT and PATCH methods are accepted — only the fields present in the request body are changed.
Permission rules:
- A non-admin user may only update their own record (
user_idmust match the token’s user). Attempts to update another user’s record return403. - Non-admin users may change
first_name,last_name,email, andusername. Anyroleoris_activefield in the request body is silently stripped before processing. - Administrators may update any user, including changing their
roleandis_activestatus.
Authentication
Requires a valid Bearer access token.Path Parameters
The ID of the user to update.
Request Body
Updated first name for the user.
Updated last name for the user.
Updated email address. Must be a valid unique email format. Stored in lowercase.
Updated username. Must be 3–80 characters, letters/digits/underscores/hyphens only, and unique.
Activate or deactivate the user account. Admin only — this field is ignored for non-admin requests.
Assign a new role to the user. Admin only — this field is ignored for non-admin requests. Allowed values:
admin, user.Response
true when the update succeeds.Human-readable confirmation message.
The updated user object.
Errors
| Status | Description |
|---|---|
400 | No data provided, or an invalid role value was supplied. |
401 | Missing or invalid access token. |
403 | The authenticated user is not an admin and is requesting to update another user. |
404 | No user exists with the given user_id. |