---
title: "Update administrator role"
method: PUT
path: "/console/v1/admins/{globalAdminID}/role"
tags: ["Administrators"]
---

# Update administrator role

`PUT /console/v1/admins/{globalAdminID}/role`

## Request

- Base URL: `https://apis.druva.com/platform`
- URL: `https://apis.druva.com/platform/console/v1/admins/{globalAdminID}/role`
- Auth: API key in header `Authorization`

Change the role and product-level access control configuration for the specified administrator. The request body must contain the complete desired role configuration. Any existing role settings not included in the request will be removed.
<br>**Role behavior:**
<br>- **Druva Cloud** - The administrator gets full access across all products. The productAccessControls field is ignored.
<br>- **Product** - The productAccessControls field is required and defines per-product role and resource-level access.
<br>
<br>The available product roles and access controls applicable for a role can be fetched using the [List roles](/reference/listrolesrequest) API. 
 > 📘 **Note** 
 To use this API endpoint, enable the [Administrator API from Druva Cloud settings](/reference/administrators).

## Path parameters

- `globalAdminID` string, required

## Headers

- `Content-Type` 'application/json', required

## Request body

- AdminsGlobalAdminIDRoleBody
  - `role` 'Product' | 'Druva Cloud', required: Select the role of the administrator. - Druva Cloud - Druva Cloud Administrator is a super administrator who gets all the rights of all the administrative roles across products, based on the services enabled for your account and the privileges needed to modify account settings. - Product - Product administrator can perform all core product-related activities such as configuring, managing, and monitoring.
  - `productAccessControls` AdminRoleProductAccessControlsProducts[]: Product-level access control configuration for role updates.
    - `productID` integer: Possible values are 8193 - Insync, 12289 - Enterprise Workloads
    - `productRole` string: The role of the administrator. Administrator role types are available in the Cloud Console. ``` Possible Enterprise Workloads roles are : - Cloud Administrator - Cloud Administrator (View-only) - Data Protection Officer - Organization Administrator - Organization Administrator (View-only) - Group Administrator - Group Administrator (View-only) Possible inSync roles are : - Cloud Admin - Data Protection Officer - Help Desk Admin - Legal Admin - Profile Admin - Sensitive Data Governance Admin - View Only Admin - Workload Admin ``` :fa-info-circle: You can also assign any custom role that is created in the product console.
    - `accessControl` Consolev1adminsProductAccessControlsAccessControls[]: A list containing data about the sites and groups to which admin needs to be granted access
      - `collectionName` string: The name of the site/organization or Workloads/Profiles/Legal Hold Types for which you want to allow admin to access
      - `collectionID` integer: The id of the site/organization or Workloads/Profiles/Legal Hold Types for which you want to allow admin to access
      - `resource` string: Resource can be Organization / Groups or Workloads/Profiles/Legal Hold Types
      - `itemList` Consolev1adminsProductAccessControlsItemList[]: Details of group of which admin access is provided
        - `itemID` integer: Group id of the site the admin should be granted access
        - `itemName` string: Group name of the site the admin should be granted access

## Response `200`

Success

- UpdateAdminRoleResponse
  - `globalAdminId` string: The unique ID associated with the admin
  - `globalCustomerId` string: The unique ID associated with the customer
  - `adminEmail` string: The email of the admin
  - `adminName` string: The name of the admin
  - `role` string: The role of the admin
  - `productAccessControls` GetAdminResponseProductAccessControls[]: Product-level access control configuration with detailed rights and permissions
    - `accessControl` GetAdminResponseAccessControl[]
      - `resource` string: Resource can be Organization / Groups for Enterprise Workloads, or Workloads/Profiles/Legal Hold Types for Insync
      - `fullAccess` boolean: It describes whether the admin has full access to above specified resource or not
      - `collection` GetAdminResponseCollection[]
        - `fullAccess` boolean: It describes whether the admin has full access to above specified resource or not
        - `type` string: Type can be Groups / Sites for Enterprise Workloads, or Workloads/Profiles/Legal Hold Types for Insync
        - `itemList` Consolev1adminsProductAccessControlsItemList[]
          - `itemID` integer: Group id of the site the admin should be granted access
          - `itemName` string: Group name of the site the admin should be granted access
        - `name` string: The name of the site/organization or Workloads/Profiles/Legal Hold Types for which your admin has access
        - `collectionID` integer: The id of the site/organization or Workloads/Profiles/Legal Hold Types for which your admin has access
    - `product` string: The name of the licensed product
    - `roleDetailsURL` string: This url redirects you to the product page where it describes the role details for the admin
    - `description` string: Description of the role of that particular admin
    - `rights` GetAdminResponseRights1[]: These rights describe the functionalities of product should be accessible to admin. For example, it tells whether this admin is allowed to take backup of user data.
      - `category` string: Name of the category to which the rights depend or are listed under. Like - Backup And Restore Management - Server Management etc
      - `rights` GetAdminResponseRights[]
        - `right` string: Name of the right which is to be provided
        - `allotted` boolean: Is the above right mentioned allotted or not
    - `editAllowed` boolean: This describes that whether the admin has edit access or not
    - `role` string: This describes the role of the admin
    - `consoleRights` GetAdminResponseConsoleRights: Console rights define which functionalities of DCP console should be accessible to admin. For example, it tells whether this admin is allowed to create other admins using DCP UI.
      - `customer` GetAdminResponseConsoleRightsCustomer
        - `IPFencing` GetAdminResponseConsoleRightsCustomerIPFencing: The IPFencing policy empowers you to restrict access to the Druva Cloud Platform Console from outside your corporate network. It helps you control, monitor, and protect your data from unauthorized access from outside the organization.
          - `read` boolean: This describes whether read is allowed over IPFencing
          - `write` boolean: This describes whether write is allowed over IPFencing
        - `passwordPolicy` GetAdminResponseConsoleRightsCustomerPasswordPolicy: A Password Policy is a set of rules that encourage the use of strong passwords for ensuring added data security. inSync supports password policies for the users and administrators.
          - `read` boolean: This describes whether read is allowed over passwordPolicy
          - `write` boolean: This describes whether write is allowed over passwordPolicy
        - `SSOSettings` GetAdminResponseConsoleRightsCustomerSSOSettings: Single Sign-On (SSO) is a mechanism that allows users to access multiple resources using a single action of authentication and authorization.
          - `read` boolean: This describes whether read is allowed over SSOSettings
          - `write` boolean: This describes whether write is allowed over SSOSettings
      - `adminSelf` GetAdminResponseConsoleRightsAdminSelf
        - `name` GetAdminResponseConsoleRightsAdminSelfName: This is attribute of admin for displaying it's identity
          - `read` boolean: This describes whether read is allowed over name
          - `write` boolean: This describes whether write is allowed over name
        - `timeZone` GetAdminResponseConsoleRightsAdminSelfTimeZone: This is the timezone of the admin who has logged in or using the api
          - `read` boolean: This describes whether read is allowed over timeZone
          - `write` boolean: This describes whether write is allowed over timeZone
        - `country` GetAdminResponseConsoleRightsAdminSelfCountry: This is the country of the admin who has logged in or using the api
          - `read` boolean: This describes whether read is allowed over country
          - `write` boolean: This describes whether write is allowed over country
        - `changePassword` boolean: This describes whether the admin is allowed to change password or not
      - `adminOthers` GetAdminResponseConsoleRightsAdminOthers
        - `name` GetAdminResponseConsoleRightsAdminSelfName: This is attribute of admin for displaying it's identity
          - `read` boolean: This describes whether read is allowed over name
          - `write` boolean: This describes whether write is allowed over name
        - `timeZone` GetAdminResponseConsoleRightsAdminOthersTimeZone: This describes whether write is allowed over timeZone
          - `read` boolean: This describes whether read is allowed over timeZone
          - `write` boolean: This describes whether write is allowed over timeZone
        - `country` GetAdminResponseConsoleRightsAdminOthersCountry: This describes whether write is allowed over country
          - `read` boolean: This describes whether read is allowed over country
          - `write` boolean: This describes whether write is allowed over country
        - `role` GetAdminResponseConsoleRightsAdminOthersRole: This describes the role of logged admin whether he has rights to modify role of other admin or not
          - `read` boolean: This describes whether read is allowed over role
          - `write` boolean: This describes whether write is allowed over role
        - `passwordReset` boolean: This describes whether passwordReset is allowed or not
        - `createAdmin` boolean: This describes whether this admin is allowed to create a admin or not
        - `deleteAdmin` boolean: This describes whether this admin is allowed to delete a admin or not
    - `productId` integer: The unique ID of the licensed product

## Other responses

- `400`: Bad Request
- `404`: The requested resource was not found.
- `500`: The request was not processed due to an internal error.

---

[API](https://skmtc.dev/druva/apis/platform.md) - [All operations](https://skmtc.dev/druva/apis/platform/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/platform/revisions/80533a559af4?raw)