Change a member's role

PATCH /v1/orgs/{orgId}/members/{userId}

Nobody can give or change a role above their own, only owners change owners, and the last owner can't be demoted.

Authorization

bearer

Authorizationheader · stringrequired

Session token from POST /v1/auth/login with "transport": "bearer". Browsers use the session cookie that login sets instead.

Path

orgIdstringrequired

maxLength: 64

userIdstringrequired

maxLength: 64

Body

application/json

rolestringrequired

maxLength: 64

Responses

errors: application/problem+json

200

401

Unauthorized

403

Forbidden

404

Not Found

409

Conflict

422

Unprocessable Entity

500

Internal Server Error

Match errors on the problem's code, which stays the same, not on its message.

Send a request

Server

Bearer token

orgId path

userId path

Body

The request goes from your browser straight to this server; nothing passes through this site. The API must allow this site's origin for CORS.

Requestexample

curl -X PATCH "$API_URL/v1/orgs/$ORG_ID/members/$USER_ID" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "role": "admin"
}'

body := strings.NewReader(`{
  "role": "admin"
}`)
req, err := http.NewRequestWithContext(ctx, http.MethodPatch,
	apiURL + "/v1/orgs/" + orgID + "/members/" + userID, body)
if err != nil {
	return err
}
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer res.Body.Close()

const res = await fetch(`${apiUrl}/v1/orgs/${orgId}/members/${userId}`, {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "role": "admin"
  }),
});
const data = await res.json();

Responseexample

{
  "email": "ada@example.com",
  "joined_at": "2026-09-15T12:00:00Z",
  "role": "member",
  "user_id": "usr_mfrggzdfmztwq2lkmfrggzdfmy"
}

{
  "code": "string",
  "status": 401,
  "title": "Unauthorized",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 403,
  "title": "Forbidden",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 404,
  "title": "Not Found",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 409,
  "title": "Conflict",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 422,
  "title": "Unprocessable Entity",
  "detail": "string",
  "errors": [
    {
      "message": "expected length >= 1",
      "location": "body.name"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}