---
title: "Change a member's role"
method: PATCH
path: "/vaults/{id}/members/{userId}"
tags: ["Contract Intelligence"]
---

# Change a member's role

`PATCH /vaults/{id}/members/{userId}`

## Request

- Base URL: `https://app.gc.ai/api/external/v1`
- URL: `https://app.gc.ai/api/external/v1/vaults/{id}/members/{userId}`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/gc-ai/apis/gc-ai-external-api/docs/vaults/:id/members/:userId/patch.ts> (a function with typed inputs; its response is checked against the schema)

Set a vault member's role.

A vault always keeps at least one owner, so demoting the last one returns `400`. Promote another member first, then demote.

The person has to hold a role in the vault already. To grant a first role, use `POST /vaults/{id}/members`.

Requires the `owner` role in the vault and the organization-level permission to manage vaults.

Requires a user-scoped API key (`u:gcai_...`). A vault is shared with named people, so an organization-scoped key has no identity to resolve vault access with.

## Path parameters

- `id` string, uuid, required: The vault ID
- `userId` integer, required: GC AI user ID of the member, as `user_id` from `GET /vaults/{id}/members`.

## Request body

- UpdateVaultMemberRoleRequest
  - `role` 'owner' | 'editor' | 'viewer', required: The role this member should hold from now on.

## Response `200`

The updated vault member

- VaultMember
  - `user_id` integer, required: GC AI user ID of the member. This is the same identifier `GET /me` reports for the calling user, so a caller can pick their own row out of the list.
  - `email` string, nullable, required: Member email address, or null when the account has none on file.
  - `name` string, nullable, required: Member display name, preferring the name they chose for themselves. Null when the account has no name on file.
  - `role` 'owner' | 'editor' | 'viewer' | 'null', nullable, required: The member's role in this vault: `owner` (manage members and settings), `editor` (add documents and edit extracted data), or `viewer` (read and annotate). Null on the rare stored value GC AI cannot read as a role. Such a grant carries no permissions at all, so remove it and add the person again.
  - `added_at` string, nullable, required: ISO 8601 timestamp when the member was added, or null for grants written before GC AI recorded that.

## Other responses

- `400`: Invalid request body, or A vault needs at least one owner. Promote another member first.
- `401`: Missing or malformed API key
- `403`: Contract Intelligence is not enabled for this account. Contact support to request access., or the caller is not a vault owner
- `404`: Vault not found, access denied, or user is not a member of this vault
- `409`: The vault is archived. Restore it with `POST /vaults/{id}/restore` before changing it.
- `422`: Vault access is per-user and requires a user-scoped API key (u:gcai_...).
- `429`: Rate limit exceeded. See [Rate Limits](https://docs.gc.ai/api-reference/concepts/rate-limits) for the tiers, limits, and how to back off.
- `500`: Internal server error
- `503`: Service temporarily unavailable

---

[API](https://skmtc.dev/gc-ai/apis/gc-ai-external-api.md) - [All operations](https://skmtc.dev/gc-ai/apis/gc-ai-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gc-ai/apis/gc-ai-external-api/revisions/2bbdfddf7107?raw)