---
title: "Update a user"
method: PATCH
path: "/v1/users/{id}"
tags: ["User"]
---

# Update a user

`PATCH /v1/users/{id}`

## Request

- Base URL: `https://api.cardda.com`
- URL: `https://api.cardda.com/v1/users/{id}`
- Auth: HTTP bearer

Updates the user's profile. `user_type` and `identifier` cannot be changed
once set (unless by staff). `email` is writable only by the owner of the
record; a range of financial/role attributes is writable only by Cardda
staff. An optional nested `company` object can create or update the user's
owned company. Not company-scoped (self-service, on the whitelist).

## Path parameters

- `id` string, required

## Request body

- object
  - `first_name` string
  - `last_name` string
  - `phone` integer
  - `identifier` string: Immutable once set (for non-staff).
  - `user_type` string: Cannot be changed once set (unless by Cardda staff).
  - `email` string, email: Writable only by the owner of the record.
  - `country` string
  - `nationality` string
  - `address` string
  - `occupation` string
  - `gender` integer
  - `is_pep` boolean
  - `birthdate` string, date-time
  - `terms_accepted` boolean
  - `legal_address` object
  - `company` object: Optional nested company create/update for the user's owned company.

## Response `200`

The updated user.

- User: An individual user (Firebase-authenticated). The `id` is the Firebase UID. Internal attributes (`ever_paid`, `roles`, `statistics`, ...) are **not part of the documented public contract** and are intentionally omitted here. The supported user shape is documented below.
  - `id` string, required: Firebase UID.
  - `first_name` string, nullable
  - `last_name` string, nullable
  - `email` string, nullable
  - `phone` integer, nullable
  - `identifier` string, nullable: Tax id / national id of the user.
  - `country` string, nullable
  - `nationality` string, nullable
  - `address` string, nullable
  - `occupation` string, nullable
  - `gender` integer, nullable
  - `birthdate` string, date-time, nullable
  - `is_pep` boolean: Whether the user is a politically exposed person.
  - `legal_address` object, nullable
  - `user_type` string, nullable
  - `status` string
  - `terms_accepted` boolean
  - `legal_representative` boolean, nullable
  - `has_powers_to_act` boolean, nullable
  - `whatsapp_verified` boolean
  - `milestone_ids` string[]: Computed list of milestone ids reached by the user.
  - `n_companies` integer: Number of companies the user belongs to (computed).
  - `company_role` string, nullable: The user's role in the current company context (computed).
  - `plh_profile_complete` boolean: Whether the user's PLH profile is complete (computed; serialized as `plh_profile_complete?`).
  - `missing_plh_profile_fields` string[]
  - `needs_password_setup` boolean: Whether the user still needs to set a password (computed; serialized as `needs_password_setup?`).
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: Unauthorized (e.g. attempting to change an immutable field)
- `404`: User not found
- `422`: Validation failed

---

[API](https://skmtc.dev/cardda/apis/organization-api.md) - [All operations](https://skmtc.dev/cardda/apis/organization-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cardda/apis/organization-api/revisions/32a4430278a8?raw)