---
title: "Update app user"
method: PUT
path: "/api/apps/{app_id}/entities/User/{user_id}"
---

# Update app user

`PUT /api/apps/{app_id}/entities/User/{user_id}`

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Changes a user's role or the extra fields the app stores on them, and returns the updated user.

Send `role` to change the user's role. It isn't checked against the roles the app defines, so a misspelled role is saved as sent. If the user also belongs to a group shared with the app, they keep the highest role any of their groups gives them, so the `role` in the response can be higher than the one you sent. Only the app's owner can change the owner's role.

Every other field you send is merged into the user's record. A field you leave out keeps its value. The fields aren't checked against the `User` schema, so a misspelled name is stored under that name. `email` and `full_name` belong to the user's account and are ignored, as are `id`, `collaborator_role`, and a few fields Base44 manages itself.

Field-level security rules on the `User` entity apply. A `role` you send is saved before the other fields are checked, so a call rejected for another field, by one of those rules or for an oversized value, changes none of the other fields but still changes the role.

Updating a user triggers the app's webhooks for the `User` entity.

<Warning>The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time.</Warning>

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>

## Path parameters

- `user_id` string, required — ID of the user, as `id` in the response of [List app users](/api-reference/list-app-users).
- `app_id` string, required — ID of the app the user belongs to.

## Request body

- object — The fields to change. Any field other than `role` is stored on the user as sent.
  - `role` string — New role for the user in the app, such as `user` or `admin`.

## Response `200`

The updated user.

- object — One user of an app.
  - `id` string, nullable — ID of the user.
  - `email` string, nullable — Email the user signs in with.
  - `full_name` string, nullable — The user's name, or `null` if they haven't given one.
  - `role` string, nullable — The user's role in the app. `user` and `admin` are built in, and an app can define its own.
  - `collaborator_role` 'editor', nullable — `editor` when the user can also edit the app in Base44, otherwise `null`.
  - `created_date` string, nullable — When the user joined the app, as a UTC timestamp in ISO 8601 format.
  - `updated_date` string, nullable — When the user's record last changed, as a UTC timestamp in ISO 8601 format.

## Other responses

- `400` — You tried to change the app owner's role and you aren't the owner, or, on some apps, a field value is over 20,000 characters.
- `401` — Missing or invalid credentials.
- `403` — You don't have editor access to this app, a field-level security rule refuses a field you're changing, or your API key is read-only.
- `404` — App not found, or the app has no user with this ID.
- `422` — The body is missing, or isn't a JSON object.
- `429` — Rate limit exceeded. The base limit is 70 requests per minute. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets.

## Changes

- **2026-09-27** `5e69adeb8667` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/base44/apis/base44-app-management-api/changes/api/apps/:app_id/entities/User/:user_id/put.md)

---

[API](https://skmtc.dev/base44/apis/base44-app-management-api.md) · [All operations](https://skmtc.dev/base44/apis/base44-app-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/base44/apis/base44-app-management-api/revisions/5e69adeb8667?raw)