---
title: "Update a user"
method: PATCH
path: "/v2/users/{user_id}"
tags: ["Users"]
---

# Update a user

`PATCH /v2/users/{user_id}`

## Request

- Base URL: `https://api.byndid.com`
- URL: `https://api.byndid.com/v2/users/{user_id}`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/docs/v2/users/:user_id/patch.ts> (a function with typed inputs; its response is checked against the schema)

To update only specific attributes of an existing user, send a PATCH request to `/v2/users/$USER_ID`. Values in the request body for immutable or read-only fields get ignored. Fields omitted from the request body will be left unchanged.
If the request conflicts with an existing resource, you'll receive a 409 error.

## Path parameters

- `user_id` string, required

## Request body

- object: Request for UpdateUser.
  - `user` User, required: A user is a member of an organization that uses Beyond Identity.
    - `id` string: A unique identifier for the user within a tenant that is automatically generated on creation. This field is immutable and read-only.
    - `create_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets created. This field is immutable and read-only.
    - `update_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets updated. This field is immutable and read-only.
    - `last_auth_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user last authenticated. This field is immutable and read-only.
    - `tenant_id` string: A unique identifier for the user's tenant that is set automatically on creation. This field is immutable and read-only.
    - `external_id` string: A required unique identifier for the user within the tenant.
    - `email_address` string: A required email address serving as primary contact for user.
    - `username` string: A required username for the user.
    - `display_name` string: A required human-readable name for the user that is used for display purposes.
    - `state` 'ACTIVE' | 'SUSPENDED' | 'DELETED': State of the user that gets updated automatically when the user is updated. This field is read-only.
    - `source` string: The source that created the user. This field is immutable and read-only.
    - `has_active_passkey` boolean: A flag representing if the user has at least one device credential in an ACTIVE state. It's updated automatically when the user creates or revokes any passkeys. This field is read-only.

## Response `200`

The response is a JSON object containing standard user attributes.

- User: A user is a member of an organization that uses Beyond Identity.
  - `id` string: A unique identifier for the user within a tenant that is automatically generated on creation. This field is immutable and read-only.
  - `create_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets created. This field is immutable and read-only.
  - `update_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user gets updated. This field is immutable and read-only.
  - `last_auth_time` string, date-time: A time value in the ISO8601 combined date and time format that gets generated automatically and represents the time the user last authenticated. This field is immutable and read-only.
  - `tenant_id` string: A unique identifier for the user's tenant that is set automatically on creation. This field is immutable and read-only.
  - `external_id` string: A required unique identifier for the user within the tenant.
  - `email_address` string: A required email address serving as primary contact for user.
  - `username` string: A required username for the user.
  - `display_name` string: A required human-readable name for the user that is used for display purposes.
  - `state` 'ACTIVE' | 'SUSPENDED' | 'DELETED': State of the user that gets updated automatically when the user is updated. This field is read-only.
  - `source` string: The source that created the user. This field is immutable and read-only.
  - `has_active_passkey` boolean: A flag representing if the user has at least one device credential in an ACTIVE state. It's updated automatically when the user creates or revokes any passkeys. This field is read-only.

## Other responses

- `400`: Bad request.
- `401`: Unauthorized.
- `403`: Forbidden.
- `404`: The resource was not found.
- `409`: Conflict.
- `429`: Rate limit exceeded.
- `500`: Server error.

---

[API](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api.md) - [All operations](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/llms.txt) - [OpenAPI document](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/revisions/562e14b2e4ba?raw)