---
title: "Update workspace member role"
method: PUT
path: "/api/workspace/members/{email}/role"
---

# Update workspace member role

`PUT /api/workspace/members/{email}/role`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/workspace/members/{email}/role`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Changes a member's role in a workspace to `admin`, `editor`, or `viewer`. The new role applies right away. For someone whose invitation is still pending, it's the role they get when they accept.

You can't change your own role or the owner's. A role that a group grants can only be changed at the group, with [Update workspace group](/api-reference/update-workspace-group) or by changing its members. `admin` needs the Business plan or higher. Moving someone to `viewer` removes their own credit limit, and promoting a guest makes them a full member. Setting the role a member already has succeeds, so retrying is safe.

This is limited to 30 requests per minute, shared with [Update workspace member role](/api-reference/update-workspace-member-role), [Remove workspace member](/api-reference/remove-workspace-member), [Set member credit limit](/api-reference/set-member-credit-limit), and [Set default member credit limit](/api-reference/set-default-member-credit-limit). A signed-in session has its own limit, and every personal access token for the workspace shares one. Some workspaces have a different limit.

<Note>Call this as an owner or admin of the workspace, with a personal access token for that workspace sent as a Bearer token, or from a signed-in session. A read-only token is refused, and workspace API keys aren't accepted.</Note>

## Path parameters

- `email` string, required: Email of the member whose role to change, exactly as `email` in [List workspace members](/api-reference/list-workspace-members) returns it. Matching is exact, including case. URL-encode it: `@` as `%40` and `+` as `%2B`.

## Query parameters

- `workspaceId` string, required: ID of the workspace. With a personal access token, use the token's workspace. Get it from `organization_id` in [Get app](/api-reference/get-app).

## Request body

- UpdateMemberRoleRequest: A member's new role.
  - `role` 'admin' | 'editor' | 'viewer', required: The member's new role. `admin` needs the Business plan or higher.

## Response `200`

The member has the new role.

- ChangeResult: Confirms the change.
  - `status` 'success', required: Always `success`.
  - `message` string, required: Short confirmation. Its wording can change, so don't parse it.

## Other responses

- `400`: A group grants the member's role, or the member is a service account whose role can't change.
- `401`: Missing or invalid credentials.
- `403`: You aren't an owner or admin of the workspace, your token is for a different workspace or is read-only, your credential can't be used on this endpoint, you're changing your own role or the owner's, or `role` is `admin` and the workspace's plan doesn't allow admins.
- `404`: No member or pending invitation with this email in the workspace.
- `409`: Your workspace requires an unlocked SSO session.
- `422`: Validation Error
- `429`: Rate limit exceeded.

## Changes

- **2026-10-11** `80287813ab84`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-10-07** `dddf17e0f9f0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/base44/apis/base44-app-management-api/changes/api/workspace/members/:email/role/put.md)

---

[API](https://skmtc.dev/base44/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/base44/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/base44/apis/base44-app-management-api/revisions/c534f09cf314?raw)