---
title: "Change an account member role"
method: PATCH
path: "/accounts/{account}/members/{member}"
tags: ["Account"]
---

# Change an account member role

`PATCH /accounts/{account}/members/{member}`

## Request

- Base URL: `https://api.factuarea.com/v1`
- URL: `https://api.factuarea.com/v1/accounts/{account}/members/{member}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Change the account `role` of a member (`admin` or `member`), its `external_advisor` mark, or both; at least one is required.
- Moving to `admin` revokes the member’s grants. Returns 200.
- 422 `external_advisor_already_assigned`; 422 `business_rule_violation` for the owner.
- The credential scope must cover every tax ID. Requires the `members:write` scope, which `*` does not cover: the API key must list it explicitly.

## Path parameters

- `account` string, uuid, required
- `member` string, uuid, required

## Headers

- `Idempotency-Key` string
- `Factuarea-Version` string, date

## Request body

- ChangeAccountMemberRoleV1Request
  - `role` 'admin' | 'member': New account role: `admin` or `member`. Required when `external_advisor` is not sent.
  - `external_advisor` boolean: Mark or unmark the member as the external advisor of the account (only a `member`, one per account). Required when `role` is not sent.

## Response `200`

- object
  - `data` AccountMember, required: A member of your ACCOUNT. The membership is of the account, not of a tax ID: an `owner` or `admin` reaches every tax ID of the account, and a `member` only the tax IDs of its `grants`.
    - `id` string, uuid, required: Opaque identifier of the account member, a UUID v7. It is the `{member}` of the member routes, not the identifier of the person.
    - `object` 'account_member', required: Always `account_member`.
    - `name` string, required: Full name of the person.
    - `email` string, email, required: Email address of the person.
    - `role` 'owner' | 'admin' | 'member', required: Account role. There is exactly one `owner`; ownership is transferred, never assigned.
    - `external_advisor` boolean, required: Whether this member is the external advisor of the account (always a `member`, at most one per account, and it does not take a seat of the plan).
    - `grants` object[], required: Per-tax-ID grants of a `member`, limited to the tax IDs your credential reads. Always empty for an `owner` or `admin`.
      - `object` 'account_member_grant', required: Always `account_member_grant`.
      - `company_id` string, uuid, required: Opaque identifier (UUID v7) of the tax ID of the account the grant applies to.
      - `level` 'view' | 'operate', required: Access level on that tax ID: `view` is read-only, `operate` can also write.
    - `permissions` AccountMemberPermissions, required: What the person behind the credential can do on this member right now. It is computed for the reader, so two credentials can read different permissions for the same member.
      - `can_change_role` boolean, required: Whether the reader can change the account role of this member.
      - `assignable_roles` string[], required: Roles the reader can assign to this member; empty when `can_change_role` is `false`.
      - `can_remove` boolean, required: Whether the reader can remove this member from the account.
      - `can_transfer_ownership` boolean, required: Whether the reader can transfer the account ownership to this member.
      - `can_edit_grants` boolean, required: Whether the reader can set or revoke the grants of this member.
    - `joined_at` string, date-time, nullable, required: Instant (ISO 8601) the person joined the account, or `null` when it is not known.
    - `last_access_at` string, date-time, nullable, required: Lower bound (ISO 8601) of the last time the person accessed the account, or `null` if they never did. It reflects the last session, not every request.

## Other responses

- `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version.
- `401`: Missing or invalid API key.
- `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the plan does not include the public API or this feature (`addon_not_active`, `feature_not_available_in_plan`), or the module is not available with a test key (`module_not_available_in_sandbox`).
- `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key.
- `422`: Validation failed — e.g. the API key plan limit was reached, or an invoice language outside the allowed catalog (`es`, `en`, `ca`). The `error.param` field identifies which input is invalid, if any. `idempotency_key_reused`: the `Idempotency-Key` was already used with a different body; send a new key or the same body. `invalid_param_format` on `Idempotency-Key`: the key must be 1 to 255 printable ASCII characters.
- `429`: Rate limit exceeded. Retry after the duration in `Retry-After`.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)