--- title: "Change a member's account role" method: PATCH path: "/v1/accounts/{account_id}/members/{member_id}" tags: ["Members"] --- # Change a member's account role `PATCH /v1/accounts/{account_id}/members/{member_id}` ## Request - Base URL: `https://app.beel.es/api` - URL: `https://app.beel.es/api/v1/accounts/{account_id}/members/{member_id}` - Auth: HTTP bearer Changes a member's `account_role` between `ADMIN` and `MEMBER`. - **`OWNER`:** not an assignable value here. An account has exactly one owner, and ownership is handed over only through `PUT /v1/accounts/{account_id}/owner`, which promotes the new owner and steps the current one down in the same operation. - **Last owner:** the account's last `OWNER` cannot be demoted. ## Request body - ChangeMemberRoleRequest - `account_role` 'OWNER' | 'ADMIN' | 'MEMBER', required: Who administers the account. Independent of `access_level`, which says how much access someone has to a given company. `OWNER` — full control, including billing, API keys and transferring ownership. Exactly one per account, so it is never an accepted value when you SET a role (inviting a member or changing one's role): both reject it with `422 OWNER_ROLE_NOT_ASSIGNABLE`. Ownership moves only through `PUT /v1/accounts/{account_id}/owner`. `ADMIN` — everything an `OWNER` can do, except transferring ownership. `MEMBER` — no account administration. Access to each company is granted individually and reported as `access_level`; a member only sees the companies granted to them. ## Response `200` Member role updated successfully - object: The envelope every successful JSON response of the BeeL. API is wrapped in. There are no bare resources in v1 and none are planned: the payload always hangs off `data`. - A **single resource** is an object in `data`. - A **collection** hangs off a named key inside `data`, together with its `pagination`, also inside `data` — `data: {invoices: [...], pagination: {...}}`. - A collection carries `pagination` unless its operation declares itself a **closed catalogue**: a fixed, bounded list with nothing to page through. The declaration is explicit in the operation; a missing `pagination` is never something to infer. - `GET /v1/accounts` pages by cursor (`data: {accounts: [...], next_cursor}`). It is a documented variant of pagination, not another envelope. Putting the array straight into `data` with `pagination` as its sibling is the shape a v2 would adopt; v1 is not being flipped to it. - `success` boolean, required - `data` object, required: A member of the account (a person with access) and their role. - `member_id` string, uuid, required: Membership UUID — the handle for every member operation (change role, set grants, remove, transfer ownership). Identifies this person **in this account**. - `person_id` string, uuid, required: Person UUID — the stable identity of the human. The same person keeps this `person_id` in every account they belong to (with a different `member_id` in each), so you can recognise the same person across the accounts you manage. Not needed to call any endpoint. - `email` string, email, nullable: Email address of the person. - `account_role` 'OWNER' | 'ADMIN' | 'MEMBER', required: Who administers the account. Independent of `access_level`, which says how much access someone has to a given company. `OWNER` — full control, including billing, API keys and transferring ownership. Exactly one per account, so it is never an accepted value when you SET a role (inviting a member or changing one's role): both reject it with `422 OWNER_ROLE_NOT_ASSIGNABLE`. Ownership moves only through `PUT /v1/accounts/{account_id}/owner`. `ADMIN` — everything an `OWNER` can do, except transferring ownership. `MEMBER` — no account administration. Access to each company is granted individually and reported as `access_level`; a member only sees the companies granted to them. - `grants` MemberGrant[]: The member's company grants (empty for OWNER/ADMIN, who have implicit access to all). - `company_id` string, uuid, required: Unique identifier (UUID) of the company within the account. - `access_level` 'VIEW' | 'OPERATE', required: Access the member has over this company. - `company_name` string, nullable: Legal name of the company; the trade name is never used here. `null` when the company has no legal name yet (possible before onboarding completes) or no longer exists. Treat it as optional: a client must not require it to be present. Never falls back to the identifier: `company_id` already carries it. - `permissions` MemberPermissions, required: Which management actions you may take on THIS member, resolved by the server for the authenticated caller. Use it to decide what to offer instead of discovering the answer through a `403`. It is advisory: every action is enforced server-side regardless, so you never need to reimplement the role policy. - `can_change_role` boolean, required: Whether the caller may change this member's role (to one of `assignable_roles`). - `assignable_roles` AccountRole[], required: Roles the caller may assign to this member (excludes the current one, the ones reserved to a higher role, and always `OWNER` — ownership is handed over with `can_transfer_ownership`, not by assigning the role). - `can_remove` boolean, required: Whether the caller may remove this member from the account. - `can_transfer_ownership` boolean, required: Whether the caller (OWNER) may transfer ownership to this member. - `can_edit_grants` boolean, required: Whether the caller may edit this member's company grants (MEMBER only). - `meta` ResponseMeta - `timestamp` string, date-time - `request_id` string ## Other responses - `400`: Bad request. From a dashboard session, a `BeeL-Environment` header whose value is not a known environment answers `ENVIRONMENT_HEADER_INVALID`, with the header named in `error.details` (`{"BeeL-Environment": "invalid"}`); it is never read as production. `BUSINESS_RULE_VIOLATION` is the generic answer to an operation the resource does not admit in its current state when that state has no code of its own. It carries no `details`; read the resource again before retrying. - `401`: Missing or invalid authentication. Like every other error, `message`/`detail` is localized according to `Accept-Language` (`es`, `en`, `ca`); defaults to English when the header is missing or asks for none of those. - `403`: Every cause listed under the plain `403` above, plus the three that govern a change to a member: `MEMBER_MANAGEMENT_FORBIDDEN`, when your role in the account does not manage its members (only an `OWNER` or an `ADMIN` does); `OWNER_ROLE_RESERVED`, when the member you act on is an `OWNER` and you are not one, since an `ADMIN` manages members but not owners; and `LIVE_CREDENTIAL_REQUIRED`, when the call is made with a test API key (`beel_sk_test_…`). - `404`: `MEMBER_NOT_FOUND` — no member with that id belongs to the account. Membership ids are not shared between accounts, so a member of another account answers the same way. - `422`: Validation error. `error.code` is `OWNER_ROLE_NOT_ASSIGNABLE` (`account_role` was `OWNER`; use `PUT /v1/accounts/{account_id}/owner` instead — returned to every caller, owners included, and also when the member already is the owner) or `LAST_OWNER_PROTECTED` (the change would demote the account's only owner). - `429`: Rate limit exceeded. `RATE_LIMIT_EXCEEDED` when the request rate of your credential is over its limit; `TOO_MANY_REQUESTS` when an email the operation sends is held back because too many went out to that recipient in a short time. Either way, retry after the `Retry-After` seconds. `QUOTA_EXCEEDED` is the other `429`: the operation would go over a quota of your plan for the current period (issued invoices, for instance). Retrying does not help until the quota resets or the plan changes. `error.details` carries `feature_code`, `current_usage`, `quota_limit` and `reset_date`, and `RateLimit-Reset` the seconds until the reset when it is known. - `500`: Internal server error - `default`: Any status code the operation does not list above. Every operation declares it, so a generated client always has a branch to fall into and never loses the cause of a failure it did not anticipate. This is where the transport-level answers land — `405`, `406`, `415` and `429` — together with any status a future version of the API starts returning. All of them carry the same error envelope as the codes listed explicitly, so `error.code` is what tells them apart: switching on the status code alone is not enough. See «Transport-level errors» in the API description for when each one is produced. A `402` carrying `SUBSCRIPTION_REQUIRED` lands here when the account has no active subscription. `error.details` says why and what to do: `current_status` (absent if it never had one), `required_permission` and `action`. A `503` carrying `SERVICE_UNAVAILABLE` lands here too, with a `Retry-After` header: a dependency of BeeL itself (the database, the email provider) was momentarily unavailable and nothing was done. Retry after those seconds. A `502` carrying `EXTERNAL_SERVICE_ERROR` also lands here: an outbound integration the operation depends on failed or did not answer in time. It is a transient condition — retry with the same `Idempotency-Key` where the operation accepts one. One exception to the envelope: a failure of the network edge that never reaches the application (`502`, `503`, `504`, `524`) is generated by Cloudflare and its body is not BeeL's — it may not even be JSON. Treat those as "no answer", and retry. --- [API](https://skmtc.dev/beel/apis/beel-public-api.md) · [All operations](https://skmtc.dev/beel/apis/beel-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/beel/apis/beel-public-api/revisions/ffbc0ae31f79?raw)