---
title: "Change a member's role (`owner`, `member`, `viewer`), or give them a `custom` list of permissions. Needs `people.manage`; only an owner makes, changes or removes an owner, and nobody gives a permission they do not hold. The last owner cannot be demoted. The person is emailed unless they changed their own role"
method: PATCH
path: "/v1/organization/members/{userId}"
---

# Change a member's role (\`owner\`, \`member\`, \`viewer\`), or give them a \`custom\` list of permissions. Needs \`people.manage\`; only an owner makes, changes or removes an owner, and nobody gives a permission they do not hold. The last owner cannot be demoted. The person is emailed unless they changed their own role

`PATCH /v1/organization/members/{userId}`

## Request

- Base URL: `https://api.evictionsapi.com`
- URL: `https://api.evictionsapi.com/v1/organization/members/{userId}`
- Auth: HTTP bearer

## Path parameters

- `userId` string, required

## Request body

- union
  - object
    - `role` 'owner' | 'member' | 'viewer', required
  - object
    - `role` 'custom', required
    - `permissions` string[], required

## Response `200`

The member after the change. Asking for the role they already have changes nothing.

- object: A member of the organization. A signed-in session gets every field but `caseEmails` (the person's own row only) and `lastLoginAt` (people who manage people only); an API key gets `id`, `name` and `role`, never an email.
  - `id` string, required: The person's user id: how a case names its complaint signer, and the `userId` of the member routes.
  - `membershipId` string
  - `name` string, nullable, required
  - `email` string
  - `role` 'owner' | 'member' | 'viewer' | 'custom', required: The person's role in the organization.
  - `permissions` string[]: What the person may change in the organization: the preset of their role, or the list of a `custom` role.
  - `caseEmails` 'all' | 'mine' | 'none': Which of the organization's case emails the person gets. On the caller's own row only.
  - `joinedAt` string, date-time
  - `lastLoginAt` string, date-time, nullable: The person's last sign-in. Only to people who manage people.
  - `you` boolean: Whether this is the caller.
  - `disabled` boolean: Whether the platform disabled the account: a disabled person performs nothing.

## Other responses

- `400`: The request is invalid.
- `401`: The credential is missing or invalid.
- `403`: `forbidden`: an API key (sessions only). `permission_denied`: the person cannot manage the organization's people; or is not an owner and the change concerns an owner (making one, changing one, removing one); or is not an owner and gives a permission they do not hold themselves (nobody grants what they do not hold).
- `404`: `not_found`: the person is not an active member of the organization (the same answer whether or not they exist).
- `409`: `last_owner`: the person is the organization's last owner. Make someone else an owner first.
- `422`: The case did not pass a check.

---

[API](https://skmtc.dev/evictionsapi/apis/evictions-api.md) · [All operations](https://skmtc.dev/evictionsapi/apis/evictions-api/llms.txt) · [OpenAPI document](https://skmtc.dev/evictionsapi/apis/evictions-api/revisions/28459213a1a3?raw)