---
title: "Update a user"
method: PATCH
path: "/users/{id}"
tags: ["Users"]
---

# Update a user

`PATCH /users/{id}`

## Request

- Base URL: `https://gateway.pmnts.io/v2/partners`
- URL: `https://gateway.pmnts.io/v2/partners/users/{id}`
- Auth: HTTP basic

Updates the user's `name`, `email`, `role` or `password`. The
`password` is write-only — it is accepted here but never returned.

## Request body

- UserUpdateRequest: Any subset of the user's `name`, `email`, `role` or `password`. The `password` is write-only.
  - `name` string
  - `email` string, email
  - `password` string: Accepted on write only; never returned on reads.
  - `role` 'admin' | 'member'

## Response `200`

The updated user.

- User: A partner dashboard user.
  - `id` string, required: User id (e.g. `123-RU-9f3k2m8q`).
  - `name` string, required: The user's full name (e.g. `Jane Smith`).
  - `email` string, email, required: The user's email address (e.g. `jane@acme.example`).
  - `role` 'admin' | 'member', required: The user's access level.
  - `status` 'active' | 'locked' | 'reset_requested', required: The user's account status.
  - `mfa_enabled` boolean: Whether multi-factor authentication is enabled for the user.
  - `sso_linked` boolean: Whether the user is linked to the partner's IdP.
  - `last_login_at` string, date-time, nullable: When the user last logged in — ISO 8601 UTC (e.g. `2026-06-01T09:30:00Z`). `null` if never.
  - `created_at` string, date-time, nullable: When the user was created — ISO 8601 UTC (e.g. `2026-05-01T00:00:00Z`).
  - `updated_at` string, date-time, nullable: When the user was last updated — ISO 8601 UTC (e.g. `2026-05-15T00:00:00Z`).

## Other responses

- `401`: Missing or invalid HTTP Basic credentials.
- `404`: Resource not found.
- `422`: The request couldn't be completed. A `validation_error` is something the caller can fix — a bad payload, a merchant that failed validation, or a processor rejecting a field (e.g. the MID); the reason is in `fields`, keyed by a processor-agnostic field name. A `processor_error` is an unactionable upstream failure (a processor was unreachable, busy, or errored); `fields` is empty and the caller should retry or escalate. Raw upstream detail is never surfaced here — only a parsed, processor-neutral reason.

---

[API](https://skmtc.dev/fatzebra/apis/fat-zebra-partner-api.md) - [All operations](https://skmtc.dev/fatzebra/apis/fat-zebra-partner-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fatzebra/apis/fat-zebra-partner-api/revisions/10f1181ea916?raw)