---
title: "Update user"
method: PATCH
path: "/users/{userId}"
tags: ["users"]
---

# Update user

`PATCH /users/{userId}`

Updates a user's information. Requires admin role.

## Path parameters

- `userId` string, required

## Request body

- UpdateUserRequest — Request body for updating a user
  - `username` string — New username (must be unique)
  - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer' — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
  - `workspaceAccess` WorkspaceAccess — Workspace access policy. all=true grants the top-level role in every workspace. all=false requires explicit workspace grants and a top-level viewer role.
    - `all` boolean, required — Whether this identity can access all workspaces
    - `grants` WorkspaceGrant[], required — Workspace-specific grants used when all=false
      - `workspace` string, required — Workspace name. The reserved names all and default are not allowed.
      - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
  - `isDisabled` boolean — Whether to disable the user account

## Response `200`

User updated successfully

- UserResponse — Response containing user information
  - `user` User, required — User information
    - `id` string, required — Unique user identifier
    - `username` string, required — User's username
    - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
    - `workspaceAccess` WorkspaceAccess, required — Workspace access policy. all=true grants the top-level role in every workspace. all=false requires explicit workspace grants and a top-level viewer role.
      - `all` boolean, required — Whether this identity can access all workspaces
      - `grants` WorkspaceGrant[], required — Workspace-specific grants used when all=false
        - `workspace` string, required — Workspace name. The reserved names all and default are not allowed.
        - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
    - `authProvider` 'builtin' | 'oidc' — Authentication provider (builtin or oidc)
    - `isDisabled` boolean — Whether the user account is disabled
    - `createdAt` string, date-time, required — Account creation timestamp
    - `updatedAt` string, date-time, required — Last update timestamp

## Other responses

- `400` — Invalid request
- `401` — Not authenticated
- `403` — Forbidden - requires admin role
- `404` — User not found
- `409` — Conflict - username already exists
- `default` — Unexpected error

## Changes

- **2026-05-24** (v1) `8a2d5d3e9608` — 6 warning
  - added the new `rate_limited` enum value to the `code` response property for the response status `400`
  - added the new `rate_limited` enum value to the `code` response property for the response status `401`
  - added the new `rate_limited` enum value to the `code` response property for the response status `403`
  - added the new `rate_limited` enum value to the `code` response property for the response status `404`
  - …2 more
- **2026-04-30** (v1) `50e1d517afc1` — 6 info
  - removed the `rate_limited` enum value from the `code` response property for the response status `400`
  - removed the `rate_limited` enum value from the `code` response property for the response status `401`
  - removed the `rate_limited` enum value from the `code` response property for the response status `403`
  - removed the `rate_limited` enum value from the `code` response property for the response status `404`
  - …2 more

[Change history](https://skmtc.dev/dagucloud/apis/dagu/changes/users/:userId/patch.md)

---

[API](https://skmtc.dev/dagucloud/apis/dagu.md) · [All operations](https://skmtc.dev/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/8a2d5d3e9608/schema)