---
title: "Set a user's RBAC roles"
method: PUT
path: "/api/users/{id}/roles"
tags: ["Users"]
---

# Set a user's RBAC roles

`PUT /api/users/{id}/roles`

## Request

- Base URL: `http://localhost:3013`
- URL: `http://localhost:3013/api/users/{id}/roles`
- Auth: HTTP bearer

Replaces the user's roles. The set holds exactly one of admin, requester, viewer plus any extra roles. Demoting a user below admin removes the ability to answer approval requests, even when the user is listed as an approver. Fails with 409 when it would leave no active admin.

## Path parameters

- `id` string, required

## Request body

- object
  - `roles` string[], required

## Response `200`

The user's roles after the change

- UserRbacRoles
  - `userId` string, required
  - `roles` RbacRole[], required
    - `id` string, required
    - `name` string, required
    - `description` string, nullable, required
    - `isBuiltin` boolean, required
    - `grantsAll` boolean, required
    - `primary` boolean, required
    - `verbs` string[], required

## Other responses

- `400`: Invalid role set
- `403`: Not allowed to change roles
- `404`: User not found
- `409`: Would leave no active admin

## Changes

- **2026-10-23** `66be60f880e3`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/desplega-ai/apis/agent-swarm-api/changes/api/users/:id/roles/put.md)

---

[API](https://skmtc.dev/desplega-ai/apis/agent-swarm-api.md) - [All operations](https://skmtc.dev/desplega-ai/apis/agent-swarm-api/llms.txt) - [OpenAPI document](https://skmtc.dev/desplega-ai/apis/agent-swarm-api/revisions/7e4c7198192a?raw)