---
title: "Updates information about a user for the specified username and organization shortname (accessible to all registered users)"
method: PUT
path: "/registry/org/{shortname}/user/{username}"
tags: ["Registry User"]
---

# Updates information about a user for the specified username and organization shortname (accessible to all registered users)

`PUT /registry/org/{shortname}/user/{username}`

<h2>Access Control</h2>  <p>All registered users can access this endpoint</p>  <h2>Expected Behavior</h2>  <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>  <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>  <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>

## Path parameters

- `shortname` string, required
- `username` string, required

## Query parameters

- `active` boolean
- `active_roles.add` 'ADMIN'
- `active_roles.remove` 'ADMIN'
- `name.first` string
- `name.last` string
- `name.middle` string
- `name.suffix` string
- `new_username` string
- `org_short_name` string

## Headers

- `CVE-API-ORG` string, required
- `CVE-API-USER` string, required
- `CVE-API-KEY` string, required

## Response `200`

Returns the updated user information

- UpdateRegistryUserResponseJson — unresolved $ref

## Other responses

- `400` — Bad Request
- `401` — Not Authenticated
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2025-11-04** `26ede34bbf48` — 1 info
  - endpoint added
- **2025-10-14** `2c44a137d9b0` — 1 breaking
  - api path removed without deprecation
- **2025-09-19** `efebaec5edf0` — 3 breaking, 17 info
  - added the new required `header` request parameter `CVE-API-KEY`
  - added the new required `header` request parameter `CVE-API-ORG`
  - added the new required `header` request parameter `CVE-API-USER`
  - api operation id `registryUserUpdateSingle` was added
  - …16 more
- **2025-09-19** `f7f264af5155` — 5 breaking, 12 warning, 3 info
  - removed the media type `application/json` for the response with the status `400`
  - removed the media type `application/json` for the response with the status `401`
  - removed the media type `application/json` for the response with the status `403`
  - removed the media type `application/json` for the response with the status `404`
  - …16 more

[Change history](https://skmtc.dev/cveproject/apis/cve-services-api/changes/registry/org/:shortname/user/:username/put.md)

---

[API](https://skmtc.dev/cveproject/apis/cve-services-api.md) · [All operations](https://skmtc.dev/cveproject/apis/cve-services-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cveproject/apis/cve-services-api/revisions/2cdcaecb4385?raw)