---
title: "Change what somebody may do"
method: PATCH
path: "/api/v1/teams/{id}/members/{userId}"
tags: ["Team"]
---

# Change what somebody may do

`PATCH /api/v1/teams/{id}/members/{userId}`

## Request

- Base URL: `http://localhost:5180`
- URL: `http://localhost:5180/api/v1/teams/{id}/members/{userId}`
- Auth: API key in cookie `better-auth.session_token`

The last owner cannot be demoted, because a team with no owner is one nobody can manage.

## Path parameters

- `id` string, required
- `userId` string, required

## Request body

- object
  - `permissions` 'owner' | 'member', required

## Response `200`

The members as they now stand.

- object
  - `ok` unknown, required
  - `data` object, required
    - `members` object[], required
      - `id` string, required
      - `teamId` string, required
      - `userId` string: Absent while an invitation to `pendingEmail` is outstanding.
      - `permissions` 'owner' | 'member', required
      - `pendingEmail` string
      - `invitedByUserId` string
      - `name` string, required
      - `email` string, required
      - `createdAt` string, required
      - `updatedAt` string, required
    - `notified` boolean: Whether the mail telling them they are on the team was accepted for delivery. False means the place is held but nobody has been told, so the invitation is worth sending again.
  - `meta` object, required
    - `requestId` string, required: Echoed in the x-request-id header. Quote it in a bug report.

## Other responses

- `409`: That is the last owner.

---

[API](https://skmtc.dev/dardaris/apis/dardaris-api.md) · [All operations](https://skmtc.dev/dardaris/apis/dardaris-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dardaris/apis/dardaris-api/revisions/4aff33835c73?raw)