---
title: "Update team member"
method: PATCH
path: "/api/team-members/{sid}"
tags: ["team_members"]
---

# Update team member

`PATCH /api/team-members/{sid}`

## Request

- Base URL: `https://beta.getsales.io/id/v1`
- URL: `https://beta.getsales.io/id/v1/api/team-members/{sid}`
- Auth: HTTP bearer and API key in header `Team-SID`

Re-scope a member: replace permissions and/or account_sids (each in full). A narrowing revokes the member's live sessions in this workspace (the peers follow in five minutes; they sign in again); a widening waits for their next refresh. Inside the caller's own grant (403 insufficient_permission / account_not_allowed). The owner's row patches like any other (ownership moves by transfer_team_ownership). Empty body: 422 nothing_to_update; a value-identical patch is accepted.

Contract:
- MCP tool `update_team_member`, registry package `mcp.id/team_members`, mount `id.identity`.
- Operation `update`, response envelope `update`.
- Flags: none.

## Path parameters

- `sid` string, required: Team member (membership or invite) sid (ts_mb_...).

## Request body

- UpdateTeamMemberRequest: Request body of `update_team_member`.
  - `permissions` string[]: Full replacement, stored as sent; each token must be held by the caller.
  - `account_sids` string[], nullable: Full replacement of the slice; null resets to every sender identity. An empty list is refused (422).

## Response `200`

`update` success envelope.

- UpdateTeamMemberResponse
  - `success` true, required
  - `operation` 'update', required
  - `item` object, required
    - `sid` string, required: Membership sid (ts_mb_...).
    - `team_sid` string, required: The workspace (ts_tm_...).
    - `user_sid` string, nullable, required: The member's account (us_mb_...); null while the invite is pending.
    - `email` string, required: The invited address.
    - `status` 'invited' | 'active' | 'revoked', required: invited = pending; active = a member; revoked = removed.
    - `permissions` string[], required: The explicit token list the member holds, stored as sent (no floor is unioned in).
    - `account_sids` string[], nullable, required: The sender identities the member may see and use (ln_ac_...); null = every one of the workspace.
    - `created_by` object, required: Who invited.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `created_at` string, required: ISO 8601 UTC.
    - `updated_at` string, required: ISO 8601 UTC.
    - `deleted_at` string, nullable, required: ISO 8601 UTC; null = live.
  - `updated_fields` string[], required
  - `previous_values` object, required
  - `kept_fields` string[]: The fields this write did not change because the person's own value stands on them (stamped person); read the item for what landed.
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/revisions/95e48541fe85?raw)