---
title: "PUT /v1/projects/{project}/instances/{instance}/users"
method: PUT
path: "/v1/projects/{project}/instances/{instance}/users"
tags: ["users"]
---

# PUT /v1/projects/{project}/instances/{instance}/users

`PUT /v1/projects/{project}/instances/{instance}/users`

Updates an existing user in a Cloud SQL instance.

## Path parameters

- `project` string, required
- `instance` string, required

## Query parameters

- `databaseRoles` string[]
- `host` string
- `name` string
- `revokeExistingRoles` boolean

## Request body

- User — A Cloud SQL user resource.
  - `sqlserverUserDetails` SqlServerUserDetails — Represents a Sql Server user on the Cloud SQL instance.
    - `disabled` boolean — If the user has been disabled
    - `serverRoles` string[] — The server roles for this user
  - `host` string — Optional. The host from which the user can connect. For `insert` operations, host defaults to an empty string. For `update` operations, host is specified as part of the request URL. The host name cannot be updated after insertion. For a MySQL instance, it's required; for a PostgreSQL or SQL Server instance, it's optional.
  - `type` 'BUILT_IN' | 'CLOUD_IAM_USER' | 'CLOUD_IAM_SERVICE_ACCOUNT' | 'CLOUD_IAM_GROUP' | 'CLOUD_IAM_GROUP_USER' | 'CLOUD_IAM_GROUP_SERVICE_ACCOUNT' | 'CLOUD_IAM_WORKFORCE_IDENTITY' | 'ENTRAID_USER' — The user type. It determines the method to authenticate the user during login. The default is the database's built-in user type.
  - `databaseRoles` string[] — Optional. Role memberships of the user
  - `iamStatus` 'IAM_STATUS_UNSPECIFIED' | 'INACTIVE' | 'ACTIVE' — Indicates if a group is active or inactive for IAM database authentication.
  - `password` string — The password for the user.
  - `instance` string — The name of the Cloud SQL instance. This does not include the project ID. Can be omitted for `update` because it is already specified on the URL.
  - `kind` string — This is always `sql#user`.
  - `dualPasswordType` 'DUAL_PASSWORD_TYPE_UNSPECIFIED' | 'NO_MODIFY_DUAL_PASSWORD' | 'NO_DUAL_PASSWORD' | 'DUAL_PASSWORD' — Dual password status for the user.
  - `name` string — The name of the user in the Cloud SQL instance. Can be omitted for `update` because it is already specified in the URL.
  - `etag` string — This field is deprecated and will be removed from a future version of the API.
  - `project` string — The project ID of the project containing the Cloud SQL database. The Google apps domain is prefixed if applicable. Can be omitted for `update` because it is already specified on the URL.
  - `passwordPolicy` UserPasswordValidationPolicy — User level password validation policy.
    - `enablePasswordVerification` boolean — If true, the user must specify the current password before changing the password. This flag is supported only for MySQL.
    - `status` PasswordStatus — Read-only password status.
      - `locked` boolean — If true, user does not have login privileges.
      - `passwordExpirationTime` string, google-datetime — The expiration time of the current password.
    - `allowedFailedAttempts` integer — Number of failed login attempts allowed before user get locked.
    - `passwordExpirationDuration` string, google-duration — Expiration duration after password is updated.
    - `enableFailedAttemptsCheck` boolean — If true, failed login attempts check will be enabled.
  - `iamEmail` string — Optional. The full email for an IAM user. For normal database users, this will not be filled. Only applicable to MySQL database users.

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/sqladmin.md) · [All operations](https://skmtc.dev/google/apis/sqladmin/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/sqladmin/revisions/e9eef8a2afcd/schema)