Updates the role of a user who was explicitly added to a group (a group_members row, shown as access_type: "group" by GET /api/v1/groups/{group_id}/members). Accepts either the coarse role (admin/viewer) or a role_id: a system role or one of your organization's custom roles (see GET /api/v1/roles). Provide exactly one. Requires a global API key.

Organization members are out of scope: their access to every group in the org comes from their organization role, so a group-level write would not change what they can do. Targeting one returns 409; use PATCH /api/v1/organizations/members/{user_id} instead. The API key's own user cannot be modified. There is no last-admin restriction at group scope: a group's only admin can be demoted, since organization admins retain admin access to every group in the organization.

Roles other than admin and viewer are honored for access but are not yet rendered in the dashboard. A role_id such as Editor or Billing Manager grants that role's real permissions on every website in the group, but the dashboard's group member list currently collapses any non-admin role to "Viewer". Prefer admin / viewer at group scope when a customer administrator also needs to see the assigned role.

{
  "role": "viewer",
  "role_id": "789e0123-e89b-12d3-a456-426614174000"
}

{
  "success": true,
  "member": {
    "role": "viewer"
  }
}